SPI pillar: security and compliance
Security and compliance across your SaaS portfolio
Security and compliance is one of the four pillars of SaaS Portfolio Intelligence (SPI). When you run several apps for customers, the risks are spread across databases, packages and AI providers — and each one changes without warning.
SaaS Sentinel brings those risks into one list per app, keeps them honest with an audit trail, and lets you accept known risks without losing sight of new ones.
What SaaS Sentinel checks
Database advisories
Supabase security and performance advisories and Postgres version updates are surfaced per project, with severity and the objects affected.
Dependency vulnerabilities
Each app's lockfile is read from its linked GitHub repository and checked daily against the OSV vulnerability database. Moderate findings mark an app as Warning; high and critical as Critical.
Risk register
Accept a known risk with a reason and review date instead of being warned forever. It reopens if new objects are exposed, severity rises or the review date passes.
AI model retirement
A weekly scan lists the AI models each app calls, shows Active, Deprecated or Retired status, days until shutdown and a suggested replacement, and warns at 90, 30, 14 and 7 days.
Audited changes
Every change to a finding or alert needs a comment and is recorded with who made it and when. Closing a finding is recorded as closed, never as proof of a fix.
Exports
Open and closed findings can be exported to CSV or PDF for customer reviews and compliance evidence.
Questions
- Where do dependency findings come from?
- From the lockfile in each app's linked GitHub repository and branch. SaaS Sentinel checks the versions actually installed, so a finding clears after that lockfile resolves to a fixed version and the next scan runs.
- Does accepting a risk hide it for good?
- No. An accepted risk stays closed only while the same or fewer objects are affected at no higher severity, and only until its review date.
- Which AI providers are tracked?
- OpenAI retirement dates are read automatically from its Models API. Dates for other providers are maintained by administrators, and AI use from providers that are not yet tracked is flagged to administrators.
- Does security affect an app's health status?
- Yes. Open warning and critical advisories and dependency findings count towards each app's health in Monitoring, Overview and the app pages.