Restricted environments
Running a self-hosted Sentrasec deployment where outbound network access is limited or not allowed.
Some environments cannot allow any outbound connection. Sentrasec can be self-hosted, and we scope deployments for restricted networks individually.
This page sets out what to expect, so you can judge the fit before we talk.
What runs locally
In a self-hosted deployment, these run on your infrastructure:
| Self-hosted | |
|---|---|
| Scanning | Your infrastructure |
| Deduplication | Your infrastructure |
| Triage decisions | Your infrastructure |
| Findings and records | Your database |
Triage decisions are deterministic and made from evidence in your app, so they do not depend on a language model.
What needs outbound access
- Vulnerability data. SCA and container scans compare against advisory data. Without updates, that data ages, and findings for newly published vulnerabilities will be missing.
- Explanation prose. A language model writes the plain-language explanation of each decision.
- Integrations. Slack, Microsoft Teams, Jira, Linear, webhooks and email all need a route out.
How each of these works in your environment, or whether it is switched off, is agreed during scoping.
Verifying what a scan used
Every scan is kept as a record. When a finding is questioned later, that record shows what ran and when.
Getting set up
Restricted-network deployments are handled as part of onboarding, including how updates reach the deployment and how often.
Book a demo to talk about a restricted-network deployment.