Automated scan result

Security Posture

A Sentrasec security grade reports the result of an automated scan of an application, on the date that scan ran. Automated scanning is not an audit and is not a certification. A scan checks only what Sentrasec can observe directly; anything it cannot observe is reported as not assessed, never assumed to pass.

What a badge does and does not claim

One scan, one date — unless continuous. A grade reflects the scan it was issued from. With continuous verification enabled, re-scans run on a schedule and the badge tracks them; without it, the badge tells you the state of the application when that scan ran, and the verification page shows the date.

Not an audit. No auditor reviewed this application. “Audited” has a specific meaning to a regulator and Sentrasec does not perform one — and your trust page should not say it either.

Verifiable by anyone. The badge links to a public verification page that re-checks the certificate’s Ed25519 signature on every request. If the certificate expires or is revoked, both the badge and that page say so within about a minute. A certificate that cannot be verified renders as exactly that — the badge never over-claims.

Embed your badge

Paste this next to your SOC 2 / ISO marks, replacing the host and certificate id with the ones from your workspace. The badge is a live SVG — no scripts, no external references, safe under a strict CSP.

<a href="https://<your-api-host>/api/v1/verify/YOUR-CERT-ID">
  <img src="https://<your-api-host>/api/v1/verify/YOUR-CERT-ID/badge.svg"
       alt="SentraSec security certificate status"
       width="296" height="60">
</a>

Three ready-made variants (badge-only, badge with explanation, and logo-strip) ship in examples/trust-page-block.html, with host-specific instructions for Vanta, SafeBase, Delve and plain HTML in examples/trust-hosts/. Keep the link wrapper: the verification page is what makes the badge evidence rather than decoration.

Our own badge

Sentrasec scans Sentrasec, and this spot renders our own live badge — through the same snippet above, with nothing special behind it. It appears here the moment our continuous-mode certificate is issued; we will not render a static image in its place, for the same reason we tell you not to.

Security Posture: Sentrasec