# Sinterly

> Sinterly is the Security ETL Engine by Kademos Labs: a hosted platform that
> ingests security scanner findings and threat models, normalises and
> deduplicates them into one finding model, scores them with an explainable
> five-component formula (exploitability, reachability, business context,
> cost of delay, remediation effort), and routes prioritised work to
> dashboards and Jira. Tagline: "Transform every finding into clarity,
> priority, and action."

## What it does

- Ingests: SARIF 2.1.0 files (verified with Semgrep and Trivy; recognises
  Grype, ZAP, Gitleaks, Checkov and CodeQL output), CSV scanner exports,
  Open Threat Model (OTM) 0.2.0 files from IriusRisk or pytm, and pull
  connectors for GitHub Code Scanning, Snyk and SonarCloud. A per-tenant
  ingest API token lets CI post scanner output directly.
- Transforms: normalisation to one finding model, three-tier deduplication
  (automatic only at full-criteria confidence; humans confirm the rest),
  exploitability/reachability verification.
- Prioritises: one score from five weighted components; every score shows
  its inputs and the weights used at calculation time; weights are tunable
  per tenant with full version history.
- Loads: role-aware dashboards (AppSec Lead, executive trajectory view,
  developer work view) and Jira ticket sync with human-confirmed status
  changes.
- Enforces: a CI gate on a short explicit policy (CISA KEV listed, or
  Sinterly-verified exploitable on a public-facing tier A/B target), never
  on a severity threshold. Advisory by default, so wiring it in cannot
  break a build until a customer deliberately switches to blocking.
- Records decisions: accepting a risk requires a written reason and an
  expiry of at most one year; acceptances reopen automatically when they
  lapse; the decision history is append-only in the database.
- Reports honestly: an override rate (of everything the policy says must be
  fixed, what share a human has waved through) and whether each exception
  has a named owner, a reason and an expiry.
- Checks threat models against reality: where a model declares a control
  implemented and no code evidence is linked, or records a threat as
  exposed while declaring a control for it, Sinterly reports the
  discrepancy. It only ever reports what the model itself asserts.
- States the backlog in engineer-days and sprints of capacity, and in
  money only where the customer has supplied their own rates.

## What it deliberately does not do

- It never reads or modifies source code. Uploads contain scanner output
  only; connector tokens are scoped to scanner findings (a fine-grained
  GitHub token with code-scanning read cannot read repository contents).
- No auto-remediation. Findings carry a suggested fix as guidance; Sinterly
  never opens fix PRs or changes code.
- No invented economics. Sinterly does not know what exposure costs a given
  business and will not estimate it; currency figures appear only where the
  customer has supplied a rate, and missing inputs are named.
- No unverified gating. The gate acts on Sinterly's own verified verdict,
  never on a scanner's unevidenced label, and never on reachability, which
  cannot be verified without source access.

## Security posture (mechanisms, not adjectives)

- Row-level tenant isolation enforced by PostgreSQL policies on every table.
- Append-only audit log protected by a database immutability trigger.
- Integration credentials encrypted app-side with AES-256-GCM before
  storage; key held outside the database provider; no read-back API.
- Mandatory multi-factor authentication; API requires MFA-completed sessions.
- ASVS 5.0 self-assessment: L2 core chapters, L1 elsewhere. Not SOC 2
  certified yet (stated openly; planned when procurement requires it).

## Who it is for

Security and engineering teams who already run scanners (SAST, SCA,
secrets, containers, DAST) and need one prioritised, explainable backlog
instead of several incompatible report formats.

## How to try it

Request a trial at https://sinterly.com/#trial. A real person provisions
your tenant and walks you through your first ingestion; after that the
product is self-serve (upload SARIF/CSV/OTM through the dashboard; findings
are scored and ranked in seconds). Free during the trial period.

## Links

- Product: https://sinterly.com
- Documentation: https://sinterly.com/docs/
- Quickstart: https://sinterly.com/docs/quickstart.html
- Key concepts: https://sinterly.com/docs/concepts.html
- Integrations and roadmap: https://sinterly.com/docs/integrations.html
- File imports: https://sinterly.com/docs/ingesting.html
- Threat models: https://sinterly.com/docs/threat-models.html
- Ingest API: https://sinterly.com/docs/api.html
- Priority scoring: https://sinterly.com/docs/scoring.html
- Deduplication: https://sinterly.com/docs/deduplication.html
- Risk decisions: https://sinterly.com/docs/decisions.html
- The CI gate: https://sinterly.com/docs/ci-gate.html
- Jira and ticketing: https://sinterly.com/docs/jira.html
- Roles and views: https://sinterly.com/docs/roles.html
- Security architecture: https://sinterly.com/docs/security.html
- Troubleshooting: https://sinterly.com/docs/troubleshooting.html
- Dashboard (customers): https://app.sinterly.com