Sengol
What exists today. Not a roadmap.
Everything on this page is shipped and enforced, not planned. Sengol runs inside your perimeter, holds your keys where you tell it to, and produces evidence a third party can verify without trusting Sengol at all.
No phone-home
Sengol does not call home. Licences are checked offline against a public key, evaluators run against a judge endpoint you configure, and a self-hosted install works identically air-gapped or connected. There is nothing in the product whose function depends on reaching a Sengol server at runtime.
Verify without trusting us
Every record is HMAC-signed, hash-chained and Ed25519-countersigned. An auditor checks a bundle with sengol-verify — a separate open-source tool with no dependency on Sengol, no network call, and no licence to hold. If Sengol disappeared tomorrow, evidence already exported would still verify.
Who can do what, provable after the fact.
-
Entra ID / OIDC single sign-on
Sign in through your identity provider with app-role mapping, re-derived on every login.
-
SCIM provisioning
User and group lifecycle synced automatically from your IdP — provisioned and deprovisioned without a ticket.
-
Local users with TOTP MFA
No IdP required. Local accounts support time-based one-time-password multi-factor authentication.
-
Audited break-glass
An emergency access path exists for when SSO is down — and using it writes its own signed record.
-
Four built-in roles
Admin, approver, auditor (read-only) and viewer — a fixed, well-understood set rather than a role you have to design yourself.
-
Signed admin audit
Every administrative action — role changes, config edits, overrides — is itself a signed record, not a plain log line.
Your keys, your VPC, a hardened supply chain.
-
Signing keys in KMS
Evidence signing keys live in your key management service, not in an environment variable or a config file.
-
Non-root containers
Every shipped container runs as a non-root user by default — no privilege to drop that you have to remember to configure.
-
SBOM and signed images
A software bill of materials ships with every release, and container images are signed so you can verify provenance before you deploy.
-
Runs in your VPC
Docker Compose, Helm or Terraform, on AWS, Azure, GCP, OpenShift or on-prem. Nothing about the architecture requires a connection out.
-
Air-gap capable
Runs fully disconnected when that's the requirement. Licence checks are offline; nothing else needs a network path to Sengol.
-
No telemetry
Sengol does not collect usage telemetry from your deployment and send it anywhere. What you run stays yours to observe.
Retention that holds, erasure that doesn't break the chain.
-
Retention floors
A statutory or policy-driven minimum retention period that evidence cannot be disposed of before, enforced by the store, not by convention.
-
Tombstone erasure
A data-subject erasure or right-to-be-forgotten request replaces the underlying content with a tombstone while preserving the hash chain — erasure doesn't leave the evidence trail unverifiable.