New Deterministic queryable ciphertext, scheduled compliance reports, and environment-aware licence enforcement. See what's included →
Alerting & audit evidence

Your database is being drained. Who tells you?

A service that normally decrypts 40 rows a second starts doing 5,000. Encryption alone doesn't notice — the key is valid, the queries are legal, the data walks out perfectly decrypted. Crypto Sentinel notices, and emails you inside a second. And every alert it raises is captured for the compliance report.

Detection window 1s Critical delivery next tick Digest window 15 min Channels email · webhook · logger
Part one — what lands in your inbox

Four things will email you. Nothing else will.

No noise budget to manage, no rule engine to configure. Every alert the package can raise is listed here, with the exact condition that raises it.

Alert Raised when Severity Reaches you
Abnormal decryption A metric series spikes past its learned baseline at 99% confidence, with at least 50 events in one interval. Each series — crypto.decrypt, entity:Customer — is judged against its own history. Critical
Warning
 Critical at 500+ events/interval, delivered on the next tick. Below that, warning. One alert per series per 5 minutes.
Unencrypted PII found The startup scan found a column holding data that passed a checksum-verified detector — Aadhaar (Verhoeff), card (Luhn), IBAN (mod-97) — or a property declared [SensitiveData] and left in plaintext. Critical One email per finding, ~5 seconds after the app boots.
Scan summary Everything the scan flagged below that bar: ML-classified matches and column names scoring 0.8+. Warning One digest, batched into the 15-minute window.
License expiry A valid license has 14 days or fewer remaining, or a supplied key failed validation. Warning Once, 15 seconds after startup.
[shop/prod] Critical: Abnormal decryption activity on 'entity:Customer'
From
Crypto Sentinel <security@yourapp.example>
To
dpo@yourapp.example, oncall@yourapp.example
Sent
23 Jul 2026, 03:14:08 UTC — 1.2s after detection
Crypto Sentinel — Alert
2026-07-23 03:14:07Z → 2026-07-23 03:14:08Z · 1 alert(s)
CRITICALAnomalyDetected · 2026-07-23 03:14:07Z
Abnormal decryption activity on 'entity:Customer'
5,120 events in one 1s interval (SSA spike detected). This rate is far outside the learned baseline and may indicate bulk data extraction through the application.
Source: entity:Customer
series entity:Customer
eventsInInterval 5120
intervalSeconds 1
reason SSA spike detected
pValue 0.000004
droppedTelemetryEvents 0
Sent by EntityFrameworkCore.Crypto.DataEncryption.ML · configure recipients and digest window in AddDataEncryptionML()
The pValue is the model's own confidence — evidence for the incident report, not a number you have to tune.
Part two — how it gets there

One second from spike to inbox, and it survives your mail server having a bad day.

Detection, batching and delivery are separate stages with separate guarantees. These are the real defaults — every number is a setting you can change.

STAGE 01
Observe
Every decrypt and row materialization is counted into a bounded, lock-free buffer. Drop-on-full, so telemetry can never slow a query.
~tens of ns per event
STAGE 02
Detect
Counts are bucketed per interval and scored by an SSA spike model trained on that series' own history. A hard rate limit can alert before the model is warm.
1s interval · 99% confidence
STAGE 03
Batch
Critical alerts skip the queue entirely. Warnings group by kind and source, so twenty findings on one table arrive as one email.
Critical: next tick · else 15 min
STAGE 04
Deliver
Each channel retries independently, then dead-letters with the full error. Pending digests flush on shutdown, so a deploy never eats an alert.
retry 1s → 5s → 30s
Every tier

Your logger

Always on, and the last line of defence — an alert is never invisible, even when every remote channel is down. Critical maps to LogError.

Team

Email, via your SMTP

Your server, your credentials, your relay. Nothing routes through vendor infrastructure and no alert content ever leaves your network.

Team

Signed webhook

Stable JSON to Slack, PagerDuty or your SIEM, with an X-RLML-Signature HMAC header so the receiver can verify it was really you.

Enterprise

Anything you write

Implement one interface and register it. The dispatcher gives your channel the same retry, batching and dead-lettering as the built-ins.

The webhook payload

POST /hooks/crypto-sentinel   X-RLML-Signature: sha256=9f2c…
{
  "deliveryId": "3f2b8c1e-…", "isDigest": false,
  "maxSeverity": "Critical",
  "windowStartUtc": "2026-07-23T03:14:07Z",
  "alerts": [{
    "kind": "AnomalyDetected", "severity": "Critical",
    "source": "entity:Customer",
    "title": "Abnormal decryption activity on 'entity:Customer'",
    "data": { "eventsInInterval": "5120", "pValue": "0.000004" }
  }]
}

Know the moment it's abused.

Encryption is the easy half; noticing misuse in real time is the half that saves you. And when you need to prove it was in place, that report is already written too.

Talk to sales Install from NuGet