Sentry also has a Privacy Policy

Read about your privacy

Security & Compliance

Last updated on July 25, 2023

Security and compliance are top priorities for Sentry because they are fundamental to your experience with the product. Sentry is committed to securing your application’s data, eliminating systems vulnerability, and ensuring continuity of access.

Sentry uses a variety of industry-standard technologies and services to secure your data from unauthorized access, disclosure, use, and loss. All Sentry employees undergo background checks before employment and are trained on security practices during company onboarding and on an annual basis.

Security is directed by Sentry’s Chief Technology Officer and maintained by Sentry’s Security & Operations team.

Infrastructure and Network Security

Physical Access Control

Sentry is hosted on Google Cloud Platform. Google data centers feature a layered security model, including extensive safeguards such as:

  • Custom-designed electronic access cards
  • Alarms
  • Vehicle access barriers
  • Perimeter fencing
  • Metal detectors
  • Biometrics

According to the Google Security Whitepaper: Google data centers also implement “security measures such as laser beam intrusion detection and 24/7 monitoring by high-resolution interior and exterior cameras” to detect and track intruders. In addition, “access logs, activity records, and camera footage are available in case an incident occurs” and “experienced security guards, who have undergone rigorous background checks and training, routinely patrol” Google data centers.

Sentry employees do not have physical access to Google data centers, servers, network equipment, or storage.

Logical Access Control

Sentry is the assigned administrator of its infrastructure on Google Cloud Platform, and only designated authorized Sentry operations team members have access to configure the infrastructure on an as-needed basis behind a two-factor authenticated virtual private network. Specific private keys are required for individual servers, and keys are stored in a secure and encrypted location.

Penetration Testing

Sentry undergoes annual penetration testing conducted by an independent, third-party agency. For testing, Sentry provides the agency with an isolated clone of sentry.io and a high-level diagram of application architecture.  No customer data is exposed to the agency through penetration testing.

Information about any security vulnerabilities successfully exploited through penetration testing is used to set mitigation and remediation priorities. A summary of penetration test findings is available to customers via their Sentry account or upon request.

Third-Party Audit

Google Cloud Platform undergoes various third-party independent audits regularly and can provide verification of compliance controls for its data centers, infrastructure, and operations. This includes, but is not limited to, the SSAE 18-compliant SOC 2 certification and ISO 27001 certification. Sentry undergoes regular third-party independent audits on a regular basis and Sentry’s SOC 2 report and ISO 27001 certificate are available to customers via their Sentry account or upon request.

Intrusion Detection and Prevention

Unusual network patterns or suspicious behavior are among Sentry’s most significant concerns for infrastructure hosting and management. Sentry and Google Cloud Platform’s intrusion detection and prevention systems (IDS/IPS) rely on both signature-based security and algorithm-based security to identify traffic patterns that are similar to known attack methods.

IDS/IPS involves tightly controlling the size and make-up of the attack surface, employing intelligent detection controls at data entry points, and developing and deploying technologies that automatically remedy dangerous situations, as well as preventing known threats from accessing the system in the first place.

Sentry does not provide direct access to security event forensics but does provide access to the engineering and customer support teams during and after any unscheduled downtime.

Business Continuity and Disaster Recovery

High Availability

Every part of the Sentry service uses properly-provisioned, redundant servers (e.g., multiple load balancers, web servers, replica databases) in the case of failure. As part of regular maintenance, servers are taken out of operation without impacting availability.

Business Continuity

Sentry keeps hourly encrypted backups of data in multiple regions on Google Cloud Platform. While never expected, in the case of production data loss (i.e., primary data stores lost), we will restore organizational data from these backups.

Disaster Recovery

In the event of a region-wide outage, Sentry will bring up a duplicate environment in a different Google Cloud Platform region. The Sentry operations team has extensive experience performing full region migrations.

Data Flow

Data into System

SDKs securely send events, containing information on errors and exceptions, to the Sentry server, which processes and stores the events. Audit data of processing and storing is transmitted to our in-house logging infrastructure through encrypted connections.

We believe SDKs should provide some mechanism for proactively scrubbing data, ideally through an extensible interface that the user can customize. Sentry provides documentation outlining SDK configuration to filter out bits of data for security and privacy purposes, but that otherwise delivers the rest of the event data intact. Scrubbing the following values is recommended:

  • Values where the keyname matches password, passwd, or secret
  • Values that match the regular expression of r'^(?:\d[ -]\*?){13,16}\$' (credit card-like)
  • Session cookies
  • Authentication header (HTTP)

Data through System

Data is sent securely to Sentry via TLS to an HTTPS endpoint. All data is AES-256bit encrypted, both in transit and at rest. Sentry aggregates events along with contextual data related to the user’s environment, preceding events, and the release and deployment changeset. Events data is also enriched with artifacts like source maps or symbols uploaded by the user or sourced externally.

Sentry’s latest SSL Labs Report can be found here.

Data out of System

Once the event is processed, it can then be accessed via Sentry’s user interface and REST APIs. Sentry integrates with a variety of third-party tools so developers can combine error data from Sentry with data from other systems, manage workflows efficiently, and be alerted of errors through notification and chat tools, in addition to email and SMS. Therefore, Sentry’s high standards for security and compliance also extend to its partner network.

Data Security and Privacy

Data Encryption

All data in Sentry servers is encrypted at rest. Google Cloud Platform stores and manages data cryptography keys in its redundant and globally distributed Key Management Service. So, if an intruder were ever able to access any of the physical storage devices, the Sentry data contained therein would still be impossible to decrypt without the keys, rendering the information a useless jumble of random characters.

Encryption at rest also enables continuity measures like backup and infrastructure management without compromising data security and privacy.

Sentry exclusively sends data over HTTPS transport layer security (TLS) encrypted connections for additional security as data transits to and from the application.

Data Retention

Sentry retains event data in production for 30 days for free plans and 90 days for paid plans by default. Individual events are aggregated into broader issues. Individual events are deleted after the above retention period. Issues are deleted when all associated events are deleted. We create regular backups of event data in production. We delete backups 90 days after creation.

Data Removal

When a customer terminates their subscription and deletes their account by selecting the option in their Sentry organization settings, all event data stored in the account becomes inaccessible to the customer within 24 hours. The event data associated with the account will be deleted from production upon the expiration of the retention period set forth in “Data Retention” above. Data can also be deleted upon request and via Sentry’s REST API and UI.

Users have the ability to remove events via bulk deletion of all events within an issue and can permanently remove data related to a given tag.

PII Scrubbing

We recommend that users do not send any personally identifiable information (PII) to Sentry. To mitigate accidents and other security risks, Sentry offers server-side filtering as a default setting. The Data Scrubber option in Sentry’s settings automatically removes values that appear to be sensitive information so that it will not be stored on Sentry’s servers.

Additionally, users can specify values to be scrubbed in the Project Settings. IP Address storage can also be disabled. The latter is particularly important if you’re concerned about PII and using Sentry’s Browser JavaScript SDK.

Application Security

Multi-Factor Authentication

In addition to password login, multi-factor authentication (MFA) provides an added layer of security to Sentry. We encourage MFA as an important step towards securing data access from intruders. Sentry users can deploy universal second-factor devices like YubiKeys (which can also be used to confirm the sudo prompt) or time-based one-time password (TOTP) apps like Google Authenticator as additional factors. This also applies to sign-in with an SSO provider.

Sentry’s organization list also displays who has MFA enabled so users can vet their own organization’s security.

Single Sign-On

Sentry’s single sign-on (SSO) implementation prioritizes security. We aggressively monitor linked accounts and disable them with any reasonable sign that the account’s access has been revoked. SSO also improves user experience by streamlining login and improving access from trusted domains. Sentry currently offers SSO via Google Business Apps and GitHub Organizations.

SAML 2.0

To facilitate user authentication through the web browser and improve identity management, Sentry offers Security Assertion Markup Language (SAML)-based SSO and System Cross-Domain Identity Management (SCIM) as standard features to customers on its Business and Enterprise plans. SAML 2.0 enhances user-based security and streamlines signup and login from trusted portals to enhance user experience, access management, and auditability. SCIM enables automated account provisioning.

Sentry integrates with SAML 2.0 and SCIM providers including Azure Active Directory and Okta.

REST API Authentication (API Key)

Sentry’s REST API uses an auth token for authentication. Authentication tokens are passed using the auth header and are used to authenticate a user account with the API.

We strongly recommend using organization-wide authentication tokens.

Email Security

The Sentry service includes email notifications and reports. Sender policy framework (SPF) is a system to prevent email address spoofing and minimize inbound spam. We have SPF records set through Dyn, our domain name service (DNS), and domain-based message authentication, reporting, and conformance (DMARC) set up for monitoring reports to prevent the possibility of phishing scams. Sentry users can see the TXT records on dmarc.sentry.io and sentry.io:

Click to Copy
\$ dig \_dmarc.sentry.io TXT +short "v=DMARC1; p=reject; fo=1; aspf=r; pct=100; rua=mailto:dmarc_agg@vali.email; ruf=mailto:security@sentry.io;" \$ dig sentry.io TXT +short | grep spf "v=spf1 include:_spf.google.com include:mail.zendesk.com include:sendgrid.net include:mktomail.com include:mg-spf.greenhouse.io -all"

Audit Controls

We know user administration is central to security and management, and auditing user logs is often the first step in both an emergency response plan and policy compliance requirements. All Sentry customers get admin controls governing identity, access, and usage to keep your data safe, secure, and centrally managed.

Membership within Sentry is handled at the organization level. The system is designed so each user has a singular account that can be reused across multiple organizations (even those using SSO). Each Sentry user should have their own account and can choose their own personal preferences and notifications settings. Access to organizations is dictated by role:

  • Billing
  • Member
  • Admin
  • Manager
  • Organization Owner

For any organization on a Sentry plan, the project administration portal is the hub for seeing and managing users and usage. The member list includes the username, email, status, added date, teams, and role for each user. The admin or owner can revoke access by project, team, or org and change the user role. Additionally, the admin can request login and password history and revoke passwords and active sessions for any user via request to Sentry Support.

In the audit log, all of the actions by user and event within the Sentry UI (e.g., member.invite, project.create) are listed chronologically by time and IP address so you’ll always have a view into your organization’s most recent history.

Secure Application Development (Application Development Lifecycle)

Sentry practices continuous delivery, which means all code changes are committed, tested, shipped, and iterated on in a rapid sequence. A continuous delivery methodology, complemented by pull request, continuous integration (CI), and automated error tracking, significantly decreases the likelihood of a security issue and improves the response time to and the effective eradication of bugs and vulnerabilities. Release notes and details for Sentry and its SDKs can be found on their respective GitHub release pages (e.g., Sentry releases and raven-js releases).

Corporate Security

Malware Protection

At Sentry, we believe that good security practices start with our own team, so we go out of our way to protect against internal threats and local vulnerabilities. All company-provided workstations are enrolled in Mobile Device Management (MDM) and Endpoint Detection and Response (EDR) solutions to enforce security settings including full-disk encryption, screen lock, and OS updates.

Risk Management

Sentry follows the risk management procedures outlined in NIST SP 800-30, which include nine steps for risk assessment and seven steps for risk mitigation.

All Sentry product changes must go through code review, CI, and build pipeline to reach production servers. Only designated employees on Sentry’s operations team have secure shell (SSH) access to production servers.

We perform testing and risk management on all systems and applications on a regular and ongoing basis. New methods are developed, reviewed, and deployed to production via pull request and internal review. New risk management practices are documented and shared via staff presentations on lessons learned and best practices.

Sentry performs risk assessments throughout the product lifecycle per the standards outlined in HIPAA Security Rule, 45 CFR 164.308:

  • Before the integration of new system technologies and before changes are made to Sentry physical safeguards

  • While making changes to Sentry physical equipment and facilities that introduce new, untested configurations

  • Periodically as part of technical and non-technical assessments of the security rule requirements as well as in response to environmental or operational changes affecting security

Contingency Planning

The Sentry operations team includes service continuity and threat remediation among its top priorities. We keep a contingency plan in case of unforeseen events, including risk management, disaster recovery, and customer communication sub-plans that are tested and updated on an ongoing basis and thoroughly reviewed for gaps and changes at least annually.

Security Policies

Sentry maintains an internal wiki of security policies, which is updated on an ongoing basis and reviewed annually for gaps. An overview of specific security policies is available to Sentry enterprise customers upon request:

  • Access Management
  • Change Management
  • Data Request
  • Data Management
  • Information Security
  • Incident Response
  • Policy Management and Maintenance
  • Risk Management
  • Vendor Management
  • Vulnerability Management

Background Checks

Sentry conducts background checks for all new hires, including verification on the following:

  • Identity verification
  • Global watchlist check
  • National criminal records check
  • County criminal records check
  • (U.S. only) Sex offender registry check

Security Training

All new employees receive onboarding and systems training, including environment and permissions setup, formal software development training (if pertinent), security policies review, company policies review, and corporate values and ethics training.

All employees additionally complete security training at least once a year. Policies presented to employees as part of the onboarding process are reviewed once a year to ensure we are keeping up with best practices.

Disclosure Policy

Sentry follows the incident handling and response process recommended by SANS, which includes identifying, containing, eradicating, recovering from, communicating, and documenting security events. Sentry notifies customers of any data breaches as soon as possible via email and phone call, followed by multiple periodic updates throughout each day addressing progress and impact. Sentry Enterprise plans include a dedicated customer success manager who holds responsibility for customer communication, as well as regular check-ins and escalations.

Sentry maintains a live report of operational uptime and issues on our status page. Anyone can subscribe to updates via email from the status page. Any known incidents are reported there, as well as on our Twitter feed.

Vulnerability Disclosure

Anyone can report a vulnerability or security concern with a Sentry product by contacting security@sentry.io and including a proof of concept, a list of tools used (including versions), and the output of the tools. We take all disclosures very seriously, and once we receive a disclosure we rapidly verify each vulnerability before taking the necessary steps to fix it. Once verified, we periodically send status updates as problems are fixed.

To encrypt sensitive information that is sent to us, our PGP key can be found on keyservers with the fingerprint:

Click to Copy
E406 C27A E971 6515 A1B1 ED86 641D 2F6C 230D BE3B

Follow this repo to get the latest security advisories about our codebase.

Other Resources

Compliance Certifications

Sentry has obtained the following compliance certifications:

  • SOC2 Type I
  • SOC2 Type II
  • HIPAA Attestation
  • ISO 27001

If you already use Sentry, you can access the report and certificate via your Sentry account. Otherwise, contact us for a copy of any report(s) you’re interested in reading (it’ll be less infuriating than your social feed.)

Data Privacy

To ensure that personal data you send Sentry is afforded the protections required by applicable data protection laws, Sentry offers a Data Processing Addendum that incorporates its data privacy commitments.

© 2024 • Sentry is a registered Trademark
of Functional Software, Inc.