Security at Sentra 311

Hosting

Sentra 311 runs on servers in the United States, from a US-based cloud server provider, reachable only through Cloudflare.

• Cloudflare DNS, TLS, firewall and DDoS protection in front of every request; the server only accepts traffic from Cloudflare
• MySQL database with nightly backups to Amazon S3 (US West), kept 30 days
• Photos and files in a private Amazon S3 bucket, shared only through expiring links; encrypted at rest by S3
• Email through Resend with SPF, DKIM and DMARC on sentra311.com
• Health checks every five minutes with alert emails when anything stops

City and resident data

Each city only ever sees its own data.

• Every table is separated by city, and that separation is tested automatically on every API endpoint
• Encrypted in transit (TLS) everywhere
• Resident contact details visible only to roles that need them; field workers don’t see them
• Restricted departments (such as code enforcement) keep their requests private to their own staff
• Public pages never show names, contact details or house numbers; staff choose which photos may appear publicly
• An audit log of settings and request changes
• Residents can report without an account; analytics are cookie-free and store no personal data

Staff access

• Five roles (admin, department head, dispatcher, call-taker, field worker) with permissions enforced by the server, not just hidden in the screen
• Every update checks the record’s version, so two people can’t silently overwrite each other
• Deactivated staff lose access; their history stays attributed
• Coming: staff sign-in through Clerk with single sign-on (Microsoft or Google), the same identity service CivicCA uses

AI

Sentra 311 uses Anthropic’s Claude for a few features (request type suggestions, the resident chat, chat insights, translation drafts and the in-product help assistant). It receives only what each feature needs. See subprocessors.

Compliance roadmap

• SOC 2: on our roadmap; ask us for current status
• A security questionnaire response is available on request (procurement)

Report a vulnerability

Email [email protected] with the subject “Security”. See also security.txt.