Walters Sentinel is the security and compliance platform of APW Consulting Ltd, trading as Walters Sentinel, a company registered in England and Wales (06087068), VAT registered (GB902021393), registered with the Information Commissioner’s Office (ZC277121) and with the D-U-N-S number 219014037.
The application runs on servers in London (Oracle Cloud Infrastructure, uk-london-1). The database is held in Ireland, in the EU (Turso, on Amazon Web Services). Email is sent from London (Amazon SES, eu-west-2).
Every supplier that handles personal data is listed, with what it handles and where, at walterssentinel.com/legal/subprocessors, and the account owner is emailed at least 30 days before a new one starts.
For organisations that need everything in the UK and on infrastructure nobody else uses, Enterprise offers a dedicated deployment: its own server in a London data centre, with its own database, encryption key and backups.
In transit: every connection uses TLS, and browsers are told to use nothing else (HTTP Strict Transport Security, including subdomains).
At rest: personal details, free text, files and tokens are encrypted by the application, with AES-256-GCM, before they are written to the database, so the database provider and every copy of the database hold only ciphertext. Values that have to be looked up by exact match use a deterministic AES-256 construction keyed separately. The database provider also encrypts its storage.
Keys: the key exists only on the application server and in one encrypted offline copy held by the company’s technical lead. It is never in source code or in the database. Nightly backups are encrypted again as whole files, with a key derived for that purpose.
On Enterprise, an organisation can have a key of its own, or one wrapped by its own key in AWS KMS or Azure Key Vault, bound to that organisation. Withdrawing it in the vault makes that organisation’s data unreadable by anybody, us included, until it is restored.
Signing in with a password always needs a one-time code sent by email as well; it cannot be switched off. People can instead sign in with a passkey, or through Microsoft, Google, Apple or their organisation’s own identity provider, which apply their own checks. Sessions end after ten minutes of inactivity unless a person chooses to stay signed in on their own device, and can be ended from any other device.
Organisations can require sign-in through their own identity provider (OpenID Connect) for everybody at their domains, and let it add and remove people automatically (SCIM). Roles limit what each person can do, and every change is written to an audit log whose entries are chained by hash, so an altered or deleted entry shows.
Our servers accept SSH with keys only; password sign-in is switched off. Access to production systems and customer data is limited to named personnel.
Database queries are parameterised throughout. Pages carry a Content Security Policy and refuse to be framed by other sites. Sign-in and public forms are rate-limited. API keys are scoped per route and stored only as hashes, and every webhook we send is signed.
Every release is checked by automated verification suites, more than a thousand checks, run against a scratch database before it is deployed, including an audit that no database query handles encrypted data in a way that would weaken it. Production data is never used for testing. A backup is taken before every production deployment.
The servers run a supported long-term release of Ubuntu with automatic security updates switched on.
A personal data breach affecting a customer’s data is reported to that customer without undue delay and in any event within 48 hours, as our data processing agreement sets out, and to the ICO within 72 hours where the law requires.
Security problems can be reported at walterssentinel.com/security, which also publishes a security.txt.
If a court, the police or another authority asks us for a customer’s data, we check that the request is valid and lawful, give no more than it requires, and tell the customer before we answer unless the law forbids it, so that they can respond to it themselves. Every such request, and what we did with it, is recorded.
We do not yet hold ISO 27001 certification or a SOC 2 report. We would rather say so than describe a plan as a certificate. In their place: this overview, our answers to the common questionnaire questions, our data processing agreement and sub-processor list, and a call with us to go through anything your security team needs. Enterprise Assured includes completing your own questionnaire and a security review with us every year.
| Where | What |
|---|---|
| Information Commissioner’s Office | Data protection register, reference ZC277121 |
| Companies House | Company number 06087068 |
| Qualys SSL Labs | How walterssentinel.com’s encryption is set up, tested live |
| Mozilla Observatory | Our security headers, tested live |