Dark Web Telemetry & Attack Surface Surveillance
Continuous dark web leak intelligence for your people, credentials, and domains — engineered with per-tenant AES-256-GCM envelope encryption and HMAC-SHA256 blind indexes, so sensitive identifiers are never stored in plaintext.
Extracted 14 identifier candidates → normalized to canonical form
Local preview: nothing you type here is sent, stored or looked up.
Unified Threat Defense Across
Four Core Security Pillars
Unlike fragmented point tools, Sentinel merges attack surface inventory, deep web telemetry, and privacy-first cryptography into a single command center.
External Attack Surface Management
Inventory your internet-facing perimeter and prove ownership before anything is actively scanned.
Perimeter Asset Inventory
Register domains, subdomains, IP addresses and ranges, ASNs, URLs, cloud buckets and code organizations. Every value is normalized before it is stored.
Ownership Verification
A DNS TXT record proves you control a domain. Active checks only ever touch verified domains and the subdomains found under them.
Subdomain & Certificate Discovery (in development)
Certificate Transparency logs as a source for new subdomains and expiring certificates.
Exposure Context (in development)
Exposed services correlated with the CISA Known Exploited Vulnerabilities catalog and FIRST EPSS scores.
25 Monitored Asset Types
Sensitive Values Encrypted At Rest
Sentinel implements a privacy-first data architecture: whether it’s a corporate CIDR or an executive’s SSN, every asset goes through a canonical normalizer, and personal and secret identifiers are envelope-encrypted and matched through keyed blind indexes. Identifier formats cover the US, Canada, the UK, EU countries, Australia and New Zealand.
How Sentinel Protects Sensitive Identifiers
When you register a sensitive asset (like an executive’s SSN or passport number), Sentinel derives an HMAC-SHA256 blind index for matching and envelope-encrypts the canonical value under your organization’s own data key. From then on only a masked form is shown; passwords and health IDs are kept as fingerprints only.
How Sentinel Protects
In 3 Stages
From the moment an identifier is enrolled to an alarm reaching your security team, sensitive values stay encrypted, matches are deduplicated, and every alarm carries a due date.
Asset Ingestion & Blind-Index Hashing
Register domains, subdomains, cloud buckets, or personal identifiers. The normalizer canonicalizes the value; personal and secret identifiers get an HMAC-SHA256 blind index and are envelope-encrypted under your organization key.
Collection & Blind-Index Matching
Background workers collect leaked documents from paste sites and public code. Each identifier found goes through the same normalizers as your assets and is matched by keyed hash, so stored values are never decrypted for matching.
Fingerprinted Alarms & SLA Workflows
Re-seen findings increment occurrence counts rather than creating duplicate alarms. Each alarm carries masked evidence, an assignee, a due date set by severity, and an audit trail of every status change.
Security Vaults for People
And Enterprise Teams
From free personal email breach surveillance to full zero-knowledge identity vaults and corporate EASM command centers.
Free Plan
Essential dark web & breach surveillance for your primary email addresses.
Personal Pro
Complete identity vault for passwords, phones, national IDs, cards, and 1 personal domain.
Business SOC
Full attack surface, brand lookalike detection, and multi-analyst SOC triage for teams.
Frequently Asked Questions
Technical answers about how Sentinel stores sensitive identifiers, where matches come from, and how alarms are handled.
Ready to Detect Your Compromised Assets Before Attackers Exploit Them?
Register your domains, people and credentials, and get a deduplicated, masked alarm when one of them appears in a leak source.