Sentinel for Small Business
One console for your servers, Android devices and alerts.
The console runs in production today. Policies, compliance reports and audit views are partial or not built.
- For
- Organisations with 5–250 devices
- Devices
- 5–250 devices
- Platforms
- Web console · Linux servers · Android
- Works today
- 18 of 23 listed features
Is Sentinel for Small Business the right edition?
Organisations with 5–250 devices
Servers, company Android phones and the alerts about them, in one tenant.
An IT generalist, not a SOC
Monitoring, checks and alerting that work without a security team to tune them.
Teams that need roles
Administrators, users and a read-only viewer role, scoped to the organisation.
You have a security team or manage customers as an MSP
→ Sentinel Enterprise XDRYou only run servers
→ Safeavio ServerGuard
Small organisations have the same attackers and fewer people.
Servers, phones and alerts usually live in separate tools, so nobody sees one picture until something has gone wrong. The SMB console brings servers, enrolled Android phones and security alerts into one organisation, with each organisation's data isolated from every other.
- Password guessing against your servers' SSH
- Websites and databases that go down without anyone noticing
- Company phones that are rooted, unlocked or carrying remote-access apps
- Privileged changes made with no record of who made them
From install to response
- 01
Create the organisation
Sign up; your organisation becomes a tenant. Every server, device and event is stamped with it.
- 02
Add servers
Install the agent with one command and paste its API key into the console.
- 03
Enrol company phones
Generate an enrolment code and enter it in the Android app.
- 04
Set checks and alerts
Uptime, HTTP and database checks, with alerts to email, Slack, Discord, Telegram or a webhook.
- 05
Respond with a record
Administrators act through typed, audited server commands. Reboot, shutdown and firewall-disable require a preview and a confirmation.
- 06
Invite the team
Add members as admin, user or viewer. Permissions are re-derived from membership on every call.
Every feature, with its state today
Grouped by where it runs. A feature is available only when it works in production or in the current download.
- Available
- 09
- Limited
- 09
- Not released
- 01
- Coming
- 04
Fleet and inventory
- Server inventory and live metricsAvailable
CPU, memory, disk, network, processes, services, containers, logs.
- Android enrolment codes and device inventoryAvailable
Posture, risk flags and command history per phone.
- Remote lock, alarm and locate for company phonesAvailable
Commands are leased, delivered once and acknowledged honestly.
- Sentinel desktop endpointsNot released
Enrolment exists in the console, but the desktop app is only an unsigned pre-release, so enrol it only to test.
- Device groupsComing
Grouping devices for policy and reporting.
Monitoring and alerting
- Uptime and HTTP monitoringAvailable
Tenant-scoped checks with alerting.
- Database monitoringAvailable
MySQL, PostgreSQL, Redis and MongoDB; stored credentials encrypted at rest.
- Service dependency viewAvailable
Which services depend on which.
- Alert notification channelsAvailable
Email, Slack, Discord, Telegram and webhooks; channel secrets encrypted at rest.
- Log explorerLimited
Search the events agents actually report; supported saved-query and retention limits apply.
Incidents and response
- Incident queue with evidenceAvailable
Correlated incidents with the events behind them.
- Incident historyLimited
Lifecycle history, investigation and case workflows; availability depends on role and reported events.
- Typed server actionsAvailable
35 typed actions with preview and confirmation for reboot, shutdown and firewall-disable. Some actions need the full Linux agent.
- Approval queueLimited
A named approver, distinct from the person who asked. In progress.
Organisation and governance
- Members and rolesLimited
Admin, user and read-only viewer. Teams, locations and departments are not built.
- Audit logLimited
Recorded and readable through the audit API; some views are not built.
- PoliciesLimited
Android policies exist in the API; policy versions and exceptions do not.
- Reports from real dataLimited
Some report types are not built.
- Compliance summaryComing
No compliance reports today.
Security posture
- Firewall view and controlLimited
Administrators only, through the audited command path.
> Full Linux agent
- Encryption, secure boot, patch and vulnerability postureComing
Not collected.
- Silent device encryptionComing
Never. The SMB ceiling forbids it.
> Will not be built
Agent updates
- Signed agent updates with staged rolloutLimited
Rollout in 5 / 25 / 50 / 100 % bands with a reasoned rollback. The current Windows agent verifies signed manifests but has less runtime evidence than Linux; agents installed before 1 October 2026 need one manual upgrade.
Where it runs, as it is today
Web console
safeavio.com, in any current browser.
Linux servers
The supported agent.
Android
Company phones enrolled with a code.
macOS / Windows servers
Agents exist; less tested. Windows is not verified in production.
Windows / macOS endpoints
Sentinel desktop is an unsigned pre-release.
Who can see what, and what is enforced
An administrator can see
- Server metrics, logs and security events
- Posture, policy state and detections for enrolled phones
- Who did what, in the audit log
An administrator cannot see
- An employee's personal content, unless that person consented for that device
- Any other organisation's data
- Consumer devices that are not enrolled in the organisation
Tenant isolation is enforced in the data-access layer, and a build check fails on any unscoped read. Database row security is also enforced in production (PostgreSQL), so a query that forgets the tenant returns nothing. Data is held in one region on one host; region selection is not built.
Edition ceiling: Sentinel for Small Business may never
- Silently encrypt devices
- Read an employee's personal content without per-device consent
A product boundary, not a setting. No flag, plan upgrade or API call can raise it.
How data moves
Each box is a step the data passes through, labelled with where it runs.
- your serverAgent or phoneAPI key / device token
- our hubIngest guardrate, size, dedup, clock skew
- our hubTenant stampset by the server
- our hubCorrelation6 versioned rules
- consoleConsolerole-checked
- consoleAdministratoradmin role
- our hubTyped actionno free-form commands
- our hubPreview + confirmfor destructive actions
- our hubAudit recordwho, what, when
- your serverAgentargument vector, no shell
A failure is reported as a failure, never as queued or done.
Specifications
| Console | Web, at safeavio.com. |
|---|---|
| Roles | Admin, user and viewer (read-only). Access tokens are revoked on logout; refresh tokens are single-use. |
| Server agent | Linux supported; macOS and Windows less tested. |
| Phones | Android 6.0 or later. |
| Database | PostgreSQL with row-level security enforced in production since 2 October 2026. |
| Retention | Anomaly records 30 days. Security events have no scheduled deletion today; the job exists and is off. |
| Backups | Daily, with a weekly restore drill that has passed. Backups are on the same host; an off-host copy is not in place yet. |
| Certifications | None held. No SOC 2 report, no ISO 27001. |
How it differs from the editions next to it
Limits come from the edition ceiling in our product boundary. The full matrix compares all seven.
| Property | Small business (this page) | ServerGuard | Enterprise XDR | Personal |
|---|---|---|---|---|
| State today | Limited | Available | Limited | Not released |
| Devices | 5–250 | Servers you administer | Organisation | 1–3 |
| Runs today on | Web console, Linux servers, Android | Linux; macOS and Windows less tested | Web console, Linux server agent, Android | Android. Windows and macOS an unsigned pre-release is available. |
| Strongest action | Typed server actions by administrators; phone lock and locate | Firewall, service, process, reboot through audited commands | Supported server actions; wider endpoint and identity response unavailable | Quarantine and restore, both reversible |
| Who sets policy | Organisation administrators | Server administrators | Tenant administrators and analysts | You, on your own device |
| Device credential | Agent API key; phone device token | Agent API key | Agent API key; mTLS identity not built | Phone enrolment token; separate desktop credentials |
| Cloud reporting | Console-hosted at safeavio.com, one region | Console-hosted at safeavio.com, one region | Console-hosted at safeavio.com, one region | Off by default; opt-in, revocable |
| May never | Silently encrypt devices | Run an API-supplied command string through a shell | Borrow consumer account semantics | Bypass phone permissions or the screen lock |
Questions about Sentinel for Small Business
Q01Is our data separated from other organisations?
Yes, in the data-access layer: every read carries a tenant predicate and the build fails on an unscoped one. The production database (PostgreSQL) also enforces row-level security, so a query that forgets the tenant returns nothing.
Q02Can administrators read employees' personal content?
No. An SMB administrator sees posture, policy state and detections, not personal content, unless the person consented for that device.
Q03Can we manage Windows laptops?
Not yet. The Sentinel desktop app is only an unsigned pre-release. The Windows server agent exists but is less tested and not verified in production.
Q04Do you have SOC 2 or ISO 27001?
No. We hold no certifications and claim none. The trust center lists our posture as it is.
Q05What does it cost?
Plans and prices are on the pricing page, read live from our plans API.
Capabilities in this product
Each capability page lists the attack families it covers and how far our coverage register says it goes.
Password exposure checks, account sign-in safety and hacked-account help today; verified-address monitoring interfaces need a configured provider for results.
Wi-Fi and connection awareness on phones; port-scan visibility and firewall control on servers.
A risk score built from real device signals: root, screen lock, encryption, risky apps.
Known-malware scans, automatic protection and fake-app checks on the phone; ransomware warnings on servers.
One console for your servers, phones and alerts.
Create an account, add a server and enrol a phone. The parts marked available work today.