Owner: The owner and sole operator (Alpha Covenant Holdings LLC, a Pennsylvania limited liability company, entity 0016032097). Version 2026-10-04. This document describes controls actually in place; where a control is absent it says so. Other policies: Information Security Policy · Access Control Policy · Change Management Policy.
Class A — security: suspected unauthorized access, secret exposure, data exfiltration, or a vulnerability being exploited. Class B — integrity: a receipt or held file found to misstate what the source printed (wrong key mapping, parse error, stale copy served as current). Class C — availability: the platform or a scheduled job down beyond Sentinel's self-heal, or an official source unreadable for more than one scheduled cycle.
Sentinel every 15 minutes; the daily self-audit hash recompute; the continuous accuracy re-check; weekly dependency scans; webhook and email delivery failures logged per job; and reports from customers or the public through the corrections desk.
Within 24 hours of detection: rotate the affected secret, revoke affected sessions and keys, preserve logs, write the incident record. Within 72 hours: notify affected customers by email with what was accessed, when, and what changed. If the law of a customer's state requires a different timeline or a regulator notice, that timeline controls.
The wrong receipts are withdrawn (never silently edited), a public correction ticket is opened at /corrections with the cause, and the affected receipts are rebuilt; the withdrawal and the rebuild both carry the ticket number. Example on record: the 2026-09 CMS CCN key correction, 181 receipts withdrawn and rebuilt.
Sentinel restarts or re-queues what it can and records the finding. A source that did not answer prints as did not answer on every receipt built during the outage — nothing stands in for it — and the Sentinel record at /audit shows the silence; the receipt itself is the customer communication. If the platform is down more than 60 minutes the status is written to /audit when it returns and to any customer who asks.
The owner is incident commander, responder and communicator. There is no second responder; if the owner is unreachable, Sentinel's self-heal is the only response until the owner returns. This is a known single point of failure.
Every incident is written to the public audit record with time, class, cause, action and what changed in the platform afterwards. The plan is reviewed after each Class A or B incident and at least annually.
Class B has been exercised for real (CCN correction). Class C is exercised by Sentinel daily. Class A has not been exercised; a tabletop (secret-rotation drill) is scheduled before the first bank or hospital questionnaire is answered.
Last reviewed 2026-10-04.
Evidence surfaces: /audit · /trust · software bill of materials · registry freshness.