Art. 32 GDPR and the four checks
Sentris is evidence of technical measures taken. It is not evidence of GDPR compliance, and nobody selling a tool can issue that.
Art. 32(1) GDPR requires technical and organisational measures appropriate to the risk, and 32(1)(b) names the goal those measures serve: the ongoing confidentiality and integrity of processing systems and services. Below is which measure each Sentris check inspects. It is a statement about what was examined, not about the outcome, and not about your organisation as a whole.
C1 · Row Level Security missing or granted to everyone
Art. 32(1)(b) — confidentiality · access control at the data layer
A table in the public schema without Row Level Security is readable through the anon key that ships in every visitor's browser. Access control at the row level is the measure; this check reports where it is absent or written as using (true).
C2 · Secrets committed to the repository
Art. 32(1)(b) — confidentiality of processing systems
A service_role key, a Stripe secret key or an AI-provider key in the repository authenticates whoever holds it. The measure is that such credentials live outside the code; this check reports where they do not, and never stores the value it found.
C3 · Route takes a caller-supplied identifier with no access check
Art. 32(1)(b) — confidentiality · authorisation of access
An endpoint that returns the record whose id you name, without checking who is asking, hands one data subject another's personal data. The measure is that access is scoped to the authenticated caller; this check reports where no such check appears.
C4 · Storage bucket marked public
Art. 32(1)(b) — confidentiality of stored data
Every object in a public bucket is retrievable by anyone with the URL — no key, no session. The measure is that stored files are served through short-lived signed URLs; this check reports buckets declared public in config, a migration or a createBucket call.
What a scan result is good for
A finished scan prints on one page: the date, the scope, what was checked, what was explicitly not, and the result. That is a document you can file with a record of processing activities under Art. 30, or hand to a DPO who asked what you did about access control this quarter. It records an examination you carried out. It does not attest to anything.
Open any scan result and print it — the print stylesheet drops the navigation and the interactive parts and keeps the evidence.
Explicitly out of scope
Naming what a tool does not do is the part that makes the rest of it usable as evidence:
- · Server infrastructure & DDoS
- · Dependency CVEs
- · TLS / cryptography depth
- · Social engineering
- · Business logic beyond access control
- · Mobile apps
- · Load / performance