Princeton IT Services logoPrinceton SentinelRequest a demo
How it works

Architecture built for identity and data residency

Sentinel was built for organizations that take data residency seriously - because it runs entirely inside one: yours.

The pipeline

Graph in, remediation out - inside your tenant

Four stages, all running in your own Azure subscription. Nothing is crawled from endpoints and no copy of your data is shipped to a vendor cloud.

Connect

An Entra app registration with read-only Graph permissions, deployed in your subscription.

  1. 1Register in Entra ID
  2. 2Grant read-only scopes
  3. 3Deploy to your Azure

Ingest

A scheduled worker syncs SharePoint, OneDrive, sharing, and Copilot telemetry into your database.

  1. 1Graph delta sync
  2. 2Store in your Postgres
  3. 3Refresh materialized views

Score

Deterministic scoring runs over the cached inventory, with an optional AI narrative on top.

  1. 1Score sites & agents
  2. 2Compute risk levels
  3. 3Write AI summaries

Act

Dashboards surface the queue; admins remediate and export, and everything is logged.

  1. 1Review the queue
  2. 2Revoke / quarantine
  3. 3Audit & report

Entra ID single sign-on

Staff sign in with their existing work account. Access is scoped to the Entra ID groups you choose, with separate roles for admins, users, and data stewards.

Runs in your own tenant

Deployed into your Azure subscription. Inventory lives in your PostgreSQL database and card-level data never leaves your environment. There is no shared multi-tenant backend.

Read-only by default

Sentinel connects to Microsoft Graph with least-privilege, read-only permissions. Remediation actions - like revoking a link - happen only when an admin approves them.

Full audit trail

Every revoke, quarantine, and access change is logged with actor, target, and timestamp. Signed license keys gate the product; nothing is used to train public models.

Deployment & data residency

Your tenant, your data, your control

Princeton Sentinel ships as containers you run on Azure Container Apps - a Next.js web app, a Python worker, and a PostgreSQL database - deployed into your own subscription. The cached Microsoft 365 inventory lives in your database, sign-in and role membership run through your Microsoft Entra ID, and any AI summaries are generated inside that same boundary. There is no shared multi-tenant backend, access is scoped to the Entra groups you choose (admin, user, and data steward), signed license keys gate the product, and nothing is ever used to train public models.

Have a security questionnaire?

Bring it to the demo - we'll walk your IT and security teams through identity, data flows, permissions, and hardening in the same session.

Request a demo