Sentinel

Sentinel is your security guard. It watches your license checks for leaked or shared keys, attacks and customers who are locked out, patrols the web for leaked copies of your products, and tells you what to do about each with a one-click fix. On Standard it fixes what it safely can by itself, and you can undo anything it did.

Sentinel is on the Lite and Standard plans. Automatic fixes and the web patrol are on Standard.

Turn it on

Open Sentinel in the sidebar and switch it on. That's all: Sentinel runs by itself from then on, around the clock. There's nothing to schedule or tune. Switch it off any time.

What it looks for

Finding	What it means	Recommended fix
License looks shared or leaked	One license used from many places or machines at once	Suspend the license (or revoke it)
A machine is guessing license keys	One machine trying keys that don't exist	Block the machine for 7 days
A long-time customer is being refused	A license that worked is now refused by a rule or a limit	Let the customer through, free a machine slot or an IP address
A rule blocks long-time customers	One of your blacklist rules refuses customers who worked before	Delete the rule
A customer's license expired and their app keeps checking	They probably want to renew	Contact them
A key is being passed around	One license keeps moving from machine to machine	Suspend the license
A machine collects keys	One computer uses many different customers' licenses or trials	Block the machine for 7 days
A machine floods your checks	One computer sends far more checks than an app normally does	Block the machine for 7 days
A revoked key is still in circulation	A key you revoked or suspended is still tried from new places	Block the machine trying it most
A busy customer's license ends this week	A long-standing customer who uses your app daily, about to expire	Remind them to renew
A key is used from places too far apart	One license checks in from two places no one could travel between in that time	Suspend the license
A key was posted in your Discord	Someone shared a license key in your Discord server	Give the customer a new key
One license runs on many different devices	A license's installs report different operating systems, platforms, versions or countries at the same time (product analytics)	Suspend the license
A license unlocks a product it wasn't sold for	A build of one of your products reports with a license of another one: that product's license check doesn't check the product	Fix that product's license check, then suspend the license
A refunded license is still in use	The order was refunded, but its license still works	Revoke the license (or suspend it)
An API key is misused	One of your API keys is used in a way your app wouldn't	Check where it's used, then replace it
A license was never activated	A customer got a key but never started your app	Contact them
A customer needs more seats	A customer keeps hitting their machine limit	Offer them more seats
Something in your setup needs a look	A setting that leaves licenses or your account less protected than they could be	Fix the setting
A team member signed in from somewhere new	A sign-in to your team that doesn't look like the member's usual ones	Sign the member out
Many failed sign-ins on a team account	Someone keeps trying passwords on one of your team's accounts	Sign the member out
A copy of your product is offered online	A page offers your files without permission (web patrol)	Copy a takedown notice

Sentinel rules out common false alarms, such as a customer who travels or reinstalls, before it reports anything.

The two device findings come from product analytics: they need your licensed app to report it (the SDK does by default) and never look at anything but the operating system family, platform, version and country an install reports.

Watching your Discord for posted keys needs the Discord integration. SunLicense switches it on for your server when it's available.

Act on a finding

Each finding shows the evidence and one button: the recommended fix. Other actions offers the alternatives. Fixes run as you, with your role's permissions.

• Dismiss if it isn't a problem. Don't flag again makes Sentinel ignore that license, machine, rule or page from now on.
• Give the customer a new key replaces a leaked key: the license and its machines stay, the old key stops working at once and the customer gets the new one by email. Sign the member out ends a team member's sessions so they have to sign in again. Neither can be undone, so Sentinel never does them by itself.
• Everything you or Sentinel did is under Handled, with Undo. Undo can also mean "don't flag this again" or "don't do this automatically again".
• What it did lists what Sentinel found and did. Don't do again lists your rules; remove one to change your mind.

Members who may see Sentinel get an email when it finds something of medium or high severity (turn it off under Sentinel's Settings tab).

Automatic fixes (Standard)

On Standard, Sentinel fixes things itself when it's sure, but only with actions that can be undone exactly:

• suspend a shared or leaked license,
• block a machine that guesses or collects keys, or floods your checks, for 7 days,
• let a locked-out customer's own machine through a blacklist rule.

It never revokes, deletes, frees machines, gives out new keys, signs members out or emails your customers on its own. Its changes show on the license as made by Sentinel, and you get the same email.

Leaked copies on the web (Standard)

On Standard, Sentinel also patrols the internet for copies of your products. It never downloads files from those sites, and it only reports pages it's sure about.

To find out who leaked a copy, upload the file under Whose copy is this?: if it came from SunLicense's product downloads, its mark names the license and customer.

Privacy

Sentinel runs on our servers. To double-check what it finds, it sends the details of a possible problem (license ids and masked keys, customer emails, countries, machine fingerprints, counts) to Google's Gemini API, our subprocessor, the same way SunLicense AI works; the web patrol searches through the same API with your product names. Sentinel doesn't count towards your SunLicense AI messages.

Its activity is kept 90 days, handled findings 180 days; findings waiting for you stay until you act. Everything is deleted with your organization.