Security and trust
Public websites are public records. Sentra CMS is built so you can show who changed what, when — and so only the right people can.
How we protect your site
Two-factor sign-in
Required for every staff account. Optional network allowlist and idle sign-out.
Roles by department
Editors and department heads only touch their own departments.
Append-only audit log
Every change by a person, API key or the assistant. Exportable for records requests.
Encrypted secrets
Integration keys and deploy keys are encrypted; keys are never shown again after saving.
Hosting
US-based cloud infrastructure with encrypted storage, nightly backups and tested restores.
Your data, your repository
Published sites live in your own Git repository. Export everything at any time.
Isolation between cities
Every record belongs to one site; one city’s users and keys can never see another’s.
Accessibility conformance
VPAT/ACR documentation for procurement, reviewed with GOVvpat.
Control who can publish
Set approval paths per department: author, accessibility gate, department head, web admin. Police and fire can use a fast track.
- Web admin, department head, editor, developer and viewer roles
- Emergency role for alerts and emergency mode
- API keys scoped and limited to drafts
Report a security issue
Email [email protected]. We acknowledge reports within two business days. See also our subprocessors.
See Sentra CMS with your own website
We’ll scan your current site for free, then show you what it looks like on Sentra CMS, accessible from day one.