# Sinterly

> Sinterly is the Security ETL Engine by Kademos Labs: a hosted platform that
> ingests security scanner findings and threat models, normalises and
> deduplicates them into one finding model, scores them with an explainable
> five-component formula (exploitability, reachability, business context,
> cost of delay, remediation effort), and routes prioritised work to
> dashboards and Jira. Tagline: "Transform every finding into clarity,
> priority, and action."

## What it does

- Ingests: SARIF 2.1.0 files (verified with Semgrep and Trivy; recognises
  Grype, ZAP, Gitleaks, Checkov and CodeQL output), CSV scanner exports,
  Open Threat Model (OTM) 0.2.0 files from IriusRisk or pytm, and a direct
  pull connector for GitHub Code Scanning.
- Transforms: normalisation to one finding model, three-tier deduplication
  (automatic only at full-criteria confidence; humans confirm the rest),
  exploitability/reachability verification.
- Prioritises: one score from five weighted components; every score shows
  its inputs and the weights used at calculation time; weights are tunable
  per tenant with full version history.
- Loads: role-aware dashboards (AppSec Lead, executive trajectory view,
  developer work view) and Jira ticket sync with human-confirmed status
  changes.

## What it deliberately does not do

- It never reads or modifies source code. Uploads contain scanner output
  only; connector tokens are scoped to scanner findings (a fine-grained
  GitHub token with code-scanning read cannot read repository contents).
- No auto-remediation. Findings carry a suggested fix as guidance; Sinterly
  never opens fix PRs or changes code.

## Security posture (mechanisms, not adjectives)

- Row-level tenant isolation enforced by PostgreSQL policies on every table.
- Append-only audit log protected by a database immutability trigger.
- Integration credentials encrypted app-side with AES-256-GCM before
  storage; key held outside the database provider; no read-back API.
- Mandatory multi-factor authentication; API requires MFA-completed sessions.
- ASVS 5.0 self-assessment: L2 core chapters, L1 elsewhere. Not SOC 2
  certified yet (stated openly; planned when procurement requires it).

## Who it is for

Security and engineering teams who already run scanners (SAST, SCA,
secrets, containers, DAST) and need one prioritised, explainable backlog
instead of several incompatible report formats.

## How to try it

Request a trial at https://sinterly.com/#trial — a real person provisions
your tenant and walks you through your first ingestion; after that the
product is self-serve (upload SARIF/CSV/OTM through the dashboard; findings
are scored and ranked in seconds). Free during the trial period.

## Links

- Product: https://sinterly.com
- Documentation: https://sinterly.com/docs/
- Security architecture: https://sinterly.com/docs/security.html
- Dashboard (customers): https://app.sinterly.com