Cette documentation technique est disponible en anglais.
Sentinel ID combines account permissions, device approval and review workflows to help organisations control access to sensitive records. The controls work alongside the organisation’s network security and operating procedures.
Connection and account controls
| Area | Implemented control | Deployment action |
|---|---|---|
| Web workspace | Approved installed-client proof when required, revocation and idle expiry | Enable policy and test privileged and normal accounts |
| Public access | Separate gateway with outbound private agent | Configure TLS, proxy trust and firewalls, then remove public backend forwarding |
| Sessions | One active login per account, rotating refresh credentials and security-version checks | Exercise replaced-session logout, expiry and revocation |
| Authenticator | App-based OTP, compulsory enrolment countdown, recovery codes and controlled reset | Enrol eligible web users and protect recovery procedures |
| Temporary access | Permission grants expire after the selected number of days | Review permissions and test expiry |
| Field devices | Per-installation approval and signing-key proof | Approve actual devices and test offline expiry |
| APIs | Scoped keys, record visibility and configured IP restrictions | Grant required scopes and record permitted ranges |
The Android Field app is exempt from the desktop client and web OTP requirements. It still uses account, approved-device and local-storage controls. Partner APIs can use the gateway without a desktop client. Camera upload credentials follow their dedicated ingest controls.
Scope and approvals
Officers belong to a Unit / Station. Case approval permissions distinguish own-unit and agency review, alongside agency visibility and the configured self-approval policy. Sensitive administrative changes have dedicated review controls.
Special approvals cover identity links, missing-biometric additions, people created from case details and suspected duplicate-person resolution. A separate biometric-removal permission controls deletion requests. Test with requesters and reviewers from different units and agencies. A suggestion is advisory and does not establish identity.
Security planning
Agree who may connect, which devices need approval and who can review sensitive changes. Keep the application and database on protected infrastructure, use secure connections and protect recovery keys. Test access with staff from different units and agencies before rollout.
Evidence, files and reports
Evidence originals have digests, custody events and integrity checks. Configured signatures and legal holds support controlled handling. Verify signed exports against a previously trusted public key. Baselining legacy material now does not prove earlier custody.
Reports and downloads respect feature permissions and record scope. Relevant operational pages offer date ranges and supported drill-down. Temporary processing and resumable staging have separate cleanup. Temporary purges do not delete enrolled biometrics or protected evidence originals. Missing media cannot pass an evidence integrity check.
Audit, assurance and recovery
Use queued activity logging, integrity checks and misuse review to examine recorded actions. External audit archives, capture assurance, attestation and National ID / Bank ID / TAX ID verifiers need actual services and credentials. A disabled integration is not a completed verification.
Provision encrypted backup keys, verify archives and rehearse restoration in isolation. Monitor failed sign-ins, revocation, unusual exports, audit delivery failures, certificate expiry and resource saturation. Complete independent security testing and representative capacity tests before acceptance.
See Gateway deployment, Data protection and Operations.