// security & compliance
Security you can verify, claims you can trust
A transparent look at the controls built into ServerEngine and how they map to ISO/IEC 27001 and the SOC 2 Trust Services Criteria — assessed by us, stated honestly.
// what this page is
This is a self-assessment published by ServerEngine, the maker of ServerEngine. It documents the security measures we ship and how we believe they align with ISO/IEC 27001 and SOC 2 criteria. It is nota third-party certification or auditor's attestation — where that distinction matters for your procurement, treat this page as vendor-provided documentation and talk to us about your specific requirements.
// posture
Security principles
Local-first by design
ServerEngine runs entirely on your infrastructure. There is no ServerEngine cloud backend processing your server data — credentials, scripts, jobs, and logs never leave your machine.
Zero secrets in scripts
Credentials are injected at execution time and discarded afterwards. The script text you save, share, or commit to version control never contains a password.
Minimal data collection
The only data ServerEngine receives is what license activation requires. File contents, settings, and credentials are never accessed or transmitted.
Tamper-evident automation
Script signing and integrity checking make every change to your automation visible — and on Enterprise, unsigned or modified scripts are rejected before they run.
// controls
Our security measures, mapped
Each measure below ships in the product today. The references indicate the ISO/IEC 27001:2022 Annex A controls and SOC 2 Trust Services Criteria we assess it against.
Encrypted credential storage
The Credentials Store keeps every username and password encrypted at rest and local to your machine. Nothing is synced to any cloud service, and decryption happens only for the duration of a job.
Runtime secret injection
Scripts reference credentials by FQDN token instead of plaintext values. ServerEngine substitutes the real values at execution time and discards them afterwards — zero hardcoded secrets.
Script signing & integrity checking
Every script carries a signature state — Signed, Not Signed, or Modified. Changed scripts surface a diff for operator review and re-signing. Enterprise environments can enforce signed-only execution.
Locked-down control API
The REST API serves HTTPS on 127.0.0.1 only and is never exposed to the network. Every request is encrypted and requires a Bearer token, which can be regenerated at any time with one click.
Standard encrypted transports
Remote execution uses the platforms' native remoting: WinRM (HTTP 5985 / HTTPS 5986) for Windows and SSH for Linux — no proprietary agents or custom protocols on your servers.
Auditable operations
Every job keeps its full console output, schedules and jobs are queryable via the API, and the engine log can be tailed at any time — a complete record of what ran, where, and when.
Minimal license telemetry
License activation collects only license, hostname/domain, OS, and CPU details. ServerEngine does not access or transmit your files, settings, or credentials to ServerEngine — see the privacy policy.
Bring-your-own AI keys
S.E.N.T.R.I uses your own provider keys (Claude, OpenRouter) or runs fully local via Ollama. AI traffic goes directly from your machine to your chosen provider — never through ServerEngine.
// frameworks
Assessment status
ISO/IEC 27001:2022
Self-assessed alignmentWe have reviewed ServerEngine's product architecture and ServerEngine's operating practices against the ISO/IEC 27001:2022 Annex A controls and assess our measures as aligned with the referenced controls listed below.
ServerEngine is not ISO 27001 certified. Certification requires an audit by an accredited certification body, which has not been performed.
SOC 2 Type I
Self-assessed alignmentWe have mapped our controls to the AICPA Trust Services Criteria (Security, Confidentiality, Processing Integrity, Privacy) and assess their design as consistent with the criteria relevant to a local-first desktop product.
No independent SOC 2 examination has been performed. A SOC 2 Type I report can only be issued by a licensed CPA firm; this page is not such a report.
Scope & methodology
This assessment covers the ServerEngine desktop application and its automation service as shipped via the Microsoft Store, plus ServerEngine's handling of license-activation data. Because ServerEngine is local-first software, the operating environment — your workstations, servers, and network — remains under your control and inside your own compliance scope. The mapping was produced by an internal review of the product source and operating practices against ISO/IEC 27001:2022 Annex A and the AICPA Trust Services Criteria. Last reviewed: July 2026.
// disclosure
Found a security issue?
We take reports seriously and respond quickly. Reach us through the contact options and we'll work with you on a coordinated disclosure.
Give your IT department the competitive advantage
The unified Remote Manager is free for up to 25 devices — upgrade whenever automation should take over.