Sentin-AI scans the data you actually have — databases, cloud storage, business applications — and classifies the personal data inside, so you know exactly what lives where. Discovery first; everything else follows.
Import data assets from your systems of record — databases, warehouses, cloud accounts — so what we scan reflects reality, not a spreadsheet from last year.
Shipped: automated asset onboardingOne scanner, inside your network, reads your systems through their normal interfaces with read-only access you grant — finding personal data in places nobody documented and storage nobody remembers creating. Nothing is installed on the servers it scans.
Shipped: 59 catalogued sources — cloud stores, databases, endpoints and business applications. Of the 40 cloud connectors, 28 are proven against provider emulators or the real engine and 12 are not yet; the 19 database, application and endpoint sources have no evidence register yet, and we say so rather than counting them as provenAn AI classification engine labels findings — contact, financial, biometric, government identifiers — with sensitivity levels and risk flags per asset.
Shipped: automated classification with role-based access controlScan results can write into the Consent Tree inventory — the same scan store the platform's own scanners feed — and every finding carries remediation status in the Sentin-AI console, so discovery ends in fixes, not another PDF. A critical finding also opens a real compliance task on the Consent Tree side, not only in Sentin-AI's own console.
Built: Consent Tree inventory sync + compliance-task creation on critical findings (enabled per deployment) + in-console remediation trackingSentin-AI goes where your data is. You run one scanner per network zone, where you choose. It opens no incoming port and reads each system the way any other client of that system would. Three ways to run it, and we name which one you are buying, because they make different promises.
Installed from an offline bundle on your own servers. Nothing leaves: no licence server, no telemetry, no updates fetched. Our install drill records every packet the installed product sends. The count to anywhere outside the installation is zero, and a deliberate test connection proves the recording works.
Drilled 11 Sep 2026: offline install, zero outbound connections from the productRuns in your own AWS, GCP or Azure account, scanning under a read-only role you create. If you connect it to your Consent Tree account, that connection carries metadata only — which store, what kind of personal data, how much, what risk — never a value. You switch it on, and it is off until you do.
The Sentin-AI console at sentinai.consentree.in, for data you are able to let a service reach. The quickest start, and the one mode where your findings are held by us rather than inside your network — so we never describe it with the words above.
| What you want scanned | How it is reached | State, 11 Sep 2026 |
|---|---|---|
| Databases | The scanner connects over the network with a read-only account you issue | Built for five database engines |
| Cloud storage and warehouses | The scanner runs in your account under a read-only role | Built; not yet run against a customer’s real cloud account |
| File shares | Mounted read-only into the scanner | Built; exercised in our offline install drill |
| Microsoft 365, Google Workspace | Their standard APIs, through an app registration you approve | Built; not yet run against a real tenant |
| Laptops and desktops | The one place something is installed: an optional endpoint agent, pushed by your device-management tool to the machines you choose (details below) | Scan and upload exercised in our drill; the Windows, macOS and Linux service installers not yet run on a managed fleet |
A small service that scans the folders you name on a schedule you set (daily by default, never more than hourly), masks every value before it leaves the machine, checks the outgoing bytes again, and sends a signed result to your own Sentin-AI. It connects out only and listens on no port.
Its key is upload-only. It can send scan results and do nothing else. It cannot pick up console jobs, which can carry the credentials for your other systems, so a key copied off a lost laptop reaches none of them. Every finding is named after the machine it came from.
Not yet: a signed Windows installer or a notarised macOS package — those need your organisation’s code-signing certificates.
Your licence is a signed file, checked on your own server against a public key built into the product, and it can be bound to one installation. There is no licence server. When a licence lapses, new scans pause after a grace period and every finding stays readable.
For renewal, the console produces a signed usage report you can read before you send it. The product never sends it for you.
Every release is checksummed, and since 11 Sep 2026 each also has a component list (SBOM) and a vulnerability scan of every image, shared on request. Not yet: a release signature under a published key — until then a checksum proves a bundle arrived intact, not that it came from us.
The scanner enumerates and scans data stores across AWS, GCP and Azure — from databases to cloud storage to messaging queues — plus the on-prem systems behind your firewall.
$ sentin-ai cloud scan-s3 --bucket hr-records --upload → scanning s3://hr-records · read-only, sampled FINDINGS (masked — values never leave) AADHAAR kyc/q2.csv 2 PAN kyc/q2.csv 2 PAYMENT_CARD refunds/queue.txt 1 → outbound payload re-scanned: no raw identifier → uploaded · store names and counts above are an example
Before shipping, we pointed the scanner at our own lead-capture database. It flagged personal data we were holding without a documented purpose — a real finding, in our own backyard, of exactly the kind the DPDP Act penalises. We fixed it, kept the receipt, and kept the habit.
That’s the standard this product is held to: if it can’t find our mistakes, it has no business looking for yours.
A first scan takes minutes and reads like a revelation. Bring a database; we’ll bring the scanner.
Book a discovery session →