Update Sentinel
Sign inStart free trial
Tech specs · Security

A patch tool should never become the way in.

Update Sentinel is designed so that nothing reaches a machine unless it's signed, verified and approved, and every change leaves a trail.

Chain of custody

From the source to the machine, checked at every step.

Signed at the source

Packages, manifests and scripts get a detached RSA-3072 signature.

Pinned trust

Relays and agents trust only keys pinned at install time.

Hash-verified content

Every chunk is SHA-256 checked on every write and every read.

Recorded

Changes land in your organization's own SHA-256 hash-chained log.

Package and script signing

  • RSA-3072 with RSASSA-PSS and SHA-256, detached, over a canonical manifest hash
  • Covers packages, manifests, scripts and self-updates
  • Agents and relays refuse to install anything without a pinned key
  • A key handed down from upstream is never trusted
  • Pin several keys at once for planned key rotation

Content integrity

  • Content moves in 4 MiB chunks, addressed by SHA-256
  • Hashes checked on every write to and read from the cache
  • Immutable manifests describe exactly what ships
  • Microsoft payloads are checked against the digests in Microsoft's signed wsusscn2.cab
  • USB transfer bundles carry the manifest, chunks and signature in one file, and are checked against your organization before import
  • Third-party apps come only from a closed, vetted catalog with pinned versions and SHA-256 hashes

Machine identity and enrollment

  • Built-in X.509 hierarchy: root, organization, relay and endpoint certificates
  • Each node generates its own RSA-3072 key and a PKCS#10 request
  • An admin approves every join before a node is trusted
  • Private keys stay in the Windows certificate store, DPAPI or owner-only files on Linux

Accounts and sessions

  • Passwords hashed with Argon2id
  • Account lockout after repeated failed sign-ins
  • RS256-signed tokens: 15-minute access, single-use rotating refresh
  • Role-based access: organization admin, deployment operator, package curator, auditor, read-only, plus custom roles

Network posture

  • Relays only connect outward to the tier above. Nothing inbound from the cloud
  • Agents talk only to their site relay
  • The relay's one inbound firewall rule is limited to the local subnet
  • Cloud secrets live in Azure Key Vault
  • Every host and port is listed in the firewall rules

Least privilege on the machine

  • Relay runs as NetworkService
  • Agent runs as LocalSystem, which Windows Update and DISM require
  • Data folders locked to SYSTEM and Administrators
  • Windows scripts run non-interactively in PowerShell Constrained Language Mode
By design

What Update Sentinel will never do.

The less a tool can do on your machines, the less an attacker can do with it.

  • No remote desktop
  • No remote command line
  • No unsigned scripts, ever
  • No arbitrary installers: apps come only from the vetted catalog
  • No inbound connections into your plant
Audit trail

Tamper-evident, and you can prove it.

  • Append-only log with its own SHA-256 hash chain for your organization
  • Verify the whole chain from the app or the API
  • Forward events to your SIEM: syslog (RFC 5424, CEF) over UDP/TCP, or an HTTPS JSON webhook
# GET /api/v1/audit/verify  (example response data)
{ "intact": true, "eventCount": 18342, "firstBrokenSequence": null }
Roadmap

Early access: what's on the way.

Multi-factor sign-in

Authenticator-app codes for local accounts are on the roadmap.

Code-signed installers

Installer signing is on the release plan.

Independent pen test

A third-party penetration test is part of our release plan.

Want the architecture details? See Platform & Architecture for relays, sync and system requirements.

Your next Patch Tuesday could be the easy one.

Set up a relay, add a few machines, and watch your first rollout finish on schedule.

Start your free trial
7-day free trial · No sales call needed