Security pages are often full of reassuring words and very few facts. We'd rather tell you exactly what Sentra 311 does today, and what isn't done yet.
Keeping each city's data separate
Sentra 311 serves many cities from one platform. Every table carries a city ID, and every query goes through a single city-scoped helper, so code can't accidentally read across cities. Our automated tests call every API endpoint as one city and check that it can't see or change another city's records. A new endpoint without that coverage fails the build.
Who can see what
Access follows roles: city admin, department head, dispatcher, call-taker and field worker. Permissions are checked by the server on every request, not just hidden on screens.
- Field workers see their own department's requests and never see residents' contact details.
- Restricted departments can be hidden from call-takers.
- Department heads see reports for their own departments.
- Public pages never show resident names, emails or phone numbers. Public addresses show the street without a house number.
Records of changes
An audit log records changes to settings, users and other admin actions. Every request has a timeline of who did what and when. Updates require the version a person was looking at, so two people can't silently overwrite each other.
Resident data
We collect what's needed to fix the problem and keep residents informed:
- Contact details are optional. Residents can report without an account or an email.
- Emails go out only for real changes to a request.
- We don't sell data or use it for advertising.
- Chat conversations are deleted after 90 days by default. A request filed through the chat keeps its own copy.
Analytics without cookies
Cities can see how their report page, apps and portal are used, such as visits, reports started and finished, and app opens. These counts don't use cookies and don't store IP addresses, device details or names. Unique visitors are counted with a hash that changes every day, and not at all when a browser sends a Do Not Track or Global Privacy Control signal. Cities can turn analytics off.
Photos
Residents' photos are shown through links that expire. Cities control which photos appear on public pages, photo by photo. See the public performance page. Automatic blurring of faces and license plates is on our roadmap. Until then, staff should review photos before allowing them on public pages.
AI
The AI features use Claude from Anthropic. Residents' messages are processed to understand their request. Messages can't change what the system is allowed to do; filing a request always needs the resident's confirmation, and status lookups need the request number plus the email on file or the tracking code.
Infrastructure
Our production setup runs behind Cloudflare, with files in Amazon S3 and email through a transactional email provider. Secrets are kept out of the code repository.
On our roadmap
We want to be clear about what isn't done:
- Single sign-on with your Microsoft or Google accounts, through Clerk.
- SOC 2 certification. We're starting the policies and evidence now, because it takes months.
- Automatic photo redaction for faces and license plates.
- A published VPAT for accessibility, alongside our accessibility work.
What we ask of cities
Security is shared. A few practices on the city side make a big difference:
- Give every person their own login. Shared accounts make the audit trail useless. Field workers are unlimited for every city, so there's no cost reason to share.
- Deactivate people when they leave. Admins can deactivate a user in the portal, which ends their access right away and keeps their history.
- Use the least access that works. Not everyone needs to be a city admin. Department heads and dispatchers can do most daily work.
- Mark sensitive departments as restricted, such as police or code enforcement, if call-takers shouldn't see them.
- Review photos before publishing them, especially before automatic redaction is available.
Data you can take with you
Your data belongs to your city. Requests export to CSV at any time, with one column per custom form field, and reports export to CSV and PDF. The API gives your IT team access to the same data the portal uses.
Questions?
If your IT or security team has a questionnaire, send it to us. We'll answer it plainly, including "not yet" where that's the truth. Contact us.