Questions and answers
Including the ones about what Sentinel will not do.
Roughly half of what a serious buyer asks first is about limits: does this certify us, does it guarantee our insurance, does it replace the auditor, and what happens to our data if we leave. Those answers are here in the same plain words we would use on a call, next to the commercial ones.
- From
- $99/mo
- Essentials, USD
- Free trial
- 14 days
- No card required
- At the end
- No auto charge
- No automatic conversion
- Data stored
- Canada
- Supabase ca-central-1
Self-service signup opens shortly — we will set you up in the meantime
The product
What it is, and who it is built for.
Start here if you arrived from an advertisement and want to know whether this is even the right category of thing.
What is Sentinel?
Sentinel is where a growing business keeps its cybersecurity governance and readiness programme, in one place instead of six. The requirements you have to meet and how they map to frameworks. The controls that satisfy them, each with a named owner and a plain description of how it works in your organisation. An evidence library where every item carries a status and an expiry date. Assessments, a risk register, tracked actions, a cyber-insurance readiness workspace, an audit engagement workspace, executive and board reporting, a Sentinel Score derived from the register underneath, and AI assistance scoped to your own tenant. It is in production today and its prices are on this website.
Who is it for?
Organisations whose security obligations are arriving faster than their security staff. The person accountable is usually a founder, an IT lead, or an operations or finance director rather than a CISO. Essentials is built for the first version of this: preparing for a first cyber-insurance renewal or a first customer security questionnaire. Full Platform is for when several of these run at once — running governance and insurance readiness together, with executive and board reporting.
What is Managed vCISO Lite?
Managed vCISO Lite is everything in Full Platform plus a named CyberWave advisor on a scheduled advisory cadence — $999 a month USD, 5 included users, and the advisor does not consume one of them. It is for an organisation with no internal security leadership that needs somebody accountable in the room for risk review, roadmap decisions and executive reporting. Managed vCISO goes deeper, scoped in a statement of work from $2,499 a month. Both are advisory engagements, and neither carries a trial — a cadence is not something you can sample.
ReadinessSentinel interface, reproduced
76/ 100
Expected
Good · September 2026
Reasonable maturity for most SMB/mid-market organisations.
Score composition
9 weighted categories- Policies18%87
- Evidence Ready18%79
- Risk Mgmt14%73
- Compliance10%67
- Vendor Risk10%74
+ 4 more categories
12-month trend
AprSep
Needs attention
This weekExpired
18
evidence items
Missing
17
evidence items
Unowned
4
controls
The first screen after sign-in. Everything else on this page describes what sits behind it.
Trial and billing
The six questions people ask before they enter anything.
Every figure in these answers is read from the same place the pricing page reads it, so the two cannot disagree with each other.
How does the free trial work?
14-day free trial. No credit card required. No automatic charge. It runs on Essentials or Full Platform — the two subscription plans. 14 days is deliberately enough to do something real: put one framework or one renewal questionnaire in scope, load the evidence you already have somewhere, and find out what is genuinely missing rather than clicking through an empty workspace. The advisory plans do not carry a trial.
Is a credit card required to start?
No. There is no billing step in the way of starting, which also means there is nothing sitting on file waiting to be charged if you forget the trial exists. You are not entering card details to look at software.
Will I be charged automatically when the trial ends?
No. No automatic charge and no automatic conversion to a paid plan. We could not charge you at the end of a trial even if we wanted to, because we never took a payment method to start it. Moving to a paid subscription is a decision you make and act on.
What happens to my workspace when the trial ends?
When the trial ends, carrying on means choosing a paid subscription; nothing converts or is charged on its own. Your data is not deleted because a trial ended. Nothing is invoiced, and nobody chases you through a renewal cycle you did not agree to. If you decide against it, you can leave the workspace alone.
How do seats work?
Seats are named people, not concurrent logins. Essentials includes 2 users, Full Platform includes 5, and Managed vCISO Lite includes 5. Beyond that an additional user is $19 a month USD, with five- and ten-user packs if you are adding a team. Control owners need their own login: a shared account is the first thing an auditor or an underwriter picks apart, because it means no change can be attributed to anyone.
Can I cancel?
Yes. A monthly subscription is billed for the month; an annual subscription is billed for the year you bought. Tell us before the next renewal date and it stops — there is no multi-year commitment attached to the published price. support@cyberwave.ca reaches a person, and the Terms of Service are the governing text. Advisory engagements follow the notice period in their statement of work.
Stated once, everywhere
14-day free trial. No credit card required. No automatic charge. On Essentials or Full Platform.
Insurance, compliance and audit
Where the honest answer is no.
This is the section a category full of overclaiming makes necessary. Every answer here is the same one you would get from us in a meeting with your broker or your auditor in the room.
Can Sentinel help with cyber insurance?
Yes — it is one of the two problems Sentinel was designed around. There is a readiness workspace for the renewal: the questions underwriters and brokers actually ask, the evidence behind each answer drawn from your own control register, and the gaps worth closing before the submission goes in. Full Platform adds broker and underwriter evidence packages. Where you want a reviewed, broker-ready package assembled for you, the Cyber Insurance Submission Pack is a $499 one-time service scoped against your workspace and your renewal date.
Does CyberWave guarantee coverage, a lower premium or a paid claim?
No. CyberWave helps you prepare for underwriting and security questions, organise evidence, identify possible gaps and plan remediation. CyberWave is not an insurer or an insurance broker, does not bind coverage, does not interpret policy coverage as legal advice, and does not guarantee coverage, premium reduction, claim payment or insurer acceptance. You remain responsible for complete and truthful representations to your insurer or broker.
Does Sentinel make my organisation compliant?
No, and no software can. Compliance is a state your organisation is actually in: controls operating, evidence supporting them, decisions recorded, people doing the work. What Sentinel does is make that state visible, maintained and defensible — one place where a requirement knows which controls answer it, a control knows who owns it, and a piece of evidence knows when it stops being true. It closes the gap between what you believe is in place and what you can show. It does not close the gap for you.
Does CyberWave certify us against ISO/IEC 27001?
No. Certification is issued by an accredited certification body after an audit, and CyberWave is not one and does not act as one. What Sentinel provides is a readiness mapping: the standard’s requirements as records, the controls in your organisation that address them, the evidence attached, and an honest view of what is not ready yet. The same is true of SOC 2 — the report comes from a licensed audit firm, not from us.
Does Sentinel replace our auditor, our broker or our lawyer?
No. It organises the work those people ask you for and gives you somewhere defensible to keep it, which usually shortens their questions considerably. Certification decisions, audit opinions, coverage decisions and legal advice all stay with the parties qualified and accountable for providing them.
A vendor that tells you it will make you compliant is selling you something software cannot be. Compliance is a state your organisation is in; a platform can only make that state visible, maintained and possible to prove.
Why the answers above are phrased that way
Data, AI and security
Where your data sits, and what touches it.
Four answers a procurement review needs in writing. The residency facts are the same on every plan, and the AI answer deliberately stops where verified fact stops.
How is my data protected?
Each organisation is a separate tenant, and separation is enforced by row-level security in Postgres rather than by application code remembering to filter — a query that forgets its tenant condition returns nothing instead of returning somebody else’s rows. Inside a workspace, authorisation is role-based: being able to sign in is not the same as being able to change a control owner or export a board report. Authentication runs through Supabase Auth, public authentication endpoints are rate limited with durable counters, significant changes are logged with who made them and when, and traffic is encrypted in transit.
Where is my data stored?
Your workspace data is stored in Supabase in Canada, region ca-central-1. Application compute runs on Vercel in the United States, and AI requests go to Anthropic in the United States. That is the whole map, on every plan. If a cross-border transfer has to be documented for your own governance, those are the three facts to document, and the subprocessor list is the page to cite.
Does CyberWave use my data to train AI models?
CyberWave operates no pipeline that uses customer content to train or fine-tune models. Customer content is sent to the AI provider only to fulfil the specific request you made — there is no background process that harvests your register, your evidence or your assessments for any other purpose. What the provider itself may and may not do with the content of a request is a contractual term, and it belongs in writing rather than in a sentence on a marketing page: read it in the AI Features Notice and the Data Processing Addendum. If those do not yet say what your procurement process needs them to say, ask us before you rely on them.
What happens to my data if I leave?
Plan the handover before your end date rather than after it: whatever you need out — reports, the register, the evidence you uploaded — should come out while the workspace is still active. What happens to data after a subscription terminates is set out in the Terms of Service and the Data Processing Addendum, so it is a term you can read and hold us to rather than a decision made case by case. If your own retention policy needs a specific commitment in writing, ask for it before you sign, not on your last day.
The whole map
- Workspace data
- Supabase, Canada (ca-central-1)
- Application compute
- Vercel, United States
- AI requests
- Anthropic, United States
Starting and support
Getting in, and getting hold of us.
What the route in looks like today, where support goes, and where the documents that actually govern the relationship live.
Do I have to talk to sales before I can start?
Not to find out what it costs — every published price is on the pricing page, and so are the seat add-ons. These are the published prices. Self-service signup is opening shortly — contact us and we will set your workspace up directly, on the same terms.
How do I get support?
support@cyberwave.ca reaches a person at CyberWave, and so does the contact page with Support selected. We aim to reply within one business day; enquiries arriving over a weekend are picked up on the next business day. Include the workspace you are writing about and what you were doing when the problem appeared. What CyberWave does not run is a 24/7 security operations centre or an emergency incident response line — if you are dealing with a live incident, use your incident response provider and your insurer’s notification process first.
Where are the Terms, the Privacy Policy and the DPA?
All of them are in the legal centre, alongside the Cookie Notice, the subprocessor list, the Acceptable Use Policy, the AI Features Notice and the cyber insurance disclaimer. They are linked from the footer of every page, not held back until you are mid-signup. Read the Terms, the DPA and the AI Features Notice before you commit to anything — they are the documents that govern, and this page is not one of them.
Not answered here
Then it is probably specific to your situation, which is the useful kind of question. Send it with the deadline attached and you will get a written answer rather than a calendar invitation.
The questions that matter are about your deadline.
Everything above is general. What plan you need, which framework to put in scope first and whether your renewal is close enough to worry about are specific — and specific questions get better answers.
Book a walkthrough
Self-service signup opens shortly — we will set you up in the meantime
- Published pricing — no quote-on-request tier
- No credit card required for the trial
- No automatic charge when a trial ends
- Tenant-isolated architecture, data stored in Canada
- Clear data-processing terms
- No compliance guarantee — human judgement still required