Skip to content

Get Community Edition (On-Premises)

The Community Edition is the free edition, with no expiry date, of the on-premises product. Run SentriKat on your own servers: your vulnerability data, scan results and full software inventory stay on your infrastructure (what does leave is listed in the box below). No credit card, no time limit.

What leaves the installation

  • Community Edition: does not send the license check-in. It takes part in knowledge-base synchronization (last item).
  • Licensed installations (Professional): check in with our license server every 12 hours. The check-in carries counters (agents, products, organizations, API keys), versions, knowledge-base state and timestamps, a data-quality status and the outcome of the last offline bundle import. The activation request carries only the activation code, the installation ID and the application version. The check-in never carries product lists, hosts or CVEs.
  • Air-gapped installations: send nothing.
  • Knowledge-base synchronization (every edition that is not air-gapped, every 12 hours): sends up to 500 CPE mappings your installation has learned (on by default; off with SENTRIKAT_KB_SHARE_MAPPINGS=false), sends the vendor and product names of up to 200 programs it could not identify and whose name has a CVE history, each with an install count (on by default; off with the switch in the interface or SENTRIKAT_MAPPING_CONTRIBUTIONS=false), and downloads the community and curated mappings. SENTRIKAT_KB_SYNC_ENABLED=false turns off the mappings and the download, not the software names. Each request carries the installation ID, the edition and, with a license, the first 64 characters of the license key. It never carries hosts, users, addresses or scan results.

Every field is listed on What SentriKat sends home. See also the Privacy Policy.

For a more general walkthrough (updates, custom certificates, storage, troubleshooting), continue from Docker Deployment afterwards.

What you get

Community Edition Professional
Price Free EUR 4,999/yr
Users 3 Unlimited
Organizations 1 Unlimited
Products 100 Unlimited
Agents (Windows, Linux, macOS) 10 10 + agent packs
Basic dashboard included included
Daily exploited-vulnerability sync included included
Exploit probability scoring included included
Container scanning included included
Two-factor authentication (TOTP) included included
Backup export and restore included included
All vulnerability intelligence sources not included included
NIS2 and BOD 22-01 reports not included included
SIEM/Syslog integration not included included
Jira, GitHub, GitLab integration not included included
Multi-tenant + White-Label not included included
LDAP/AD/SAML SSO not included included
Air-gapped deployment not included included
Scheduled backups and standard-format exports not included included

The numbers above are the values served by https://api.sentrikat.com/api/v1/public/config/plans, the same source that powers the pricing page.

Quick install (Docker Compose)

The fastest path, from a clean Linux host with Docker installed.

First, get the release bundle: log into the Customer Portal (free account, email one-time code, no credit card), open Downloads, and download the latest sentrikat-<version>.tar.gz. Then:

# 1. Extract the bundle and load the bundled Docker image
tar -xzf sentrikat-*.tar.gz -C /opt/
mv /opt/sentrikat-* /opt/sentrikat
cd /opt/sentrikat
docker load -i sentrikat-image-*.tar.gz

# 2. First-boot configuration
cp .env.example .env
${EDITOR:-vi} .env
# minimum (each one is documented in .env.example):
#   SECRET_KEY=$(openssl rand -hex 32)
#   ENCRYPTION_KEY=<Fernet key: generation command in .env.example>
#   DB_PASSWORD=<32+ random chars>

# 3. Start the stack
docker compose up -d

# 4. Wait for health
docker compose ps
# expect every service in "Up (healthy)"

Database migrations run automatically when the application boots. There is no manual migration step.

First run

On 1.4.0-beta and later, open https://<your-host>/ (or whichever hostname you point at the host): http:// sends you there, and until you put your own certificate in the certs folder the browser warns that the certificate is not trusted (that is the self-signed certificate created at the first start). On 1.3.0-beta and earlier, open http://<your-host>. On first run SentriKat greets you with the setup wizard: create your admin account, name your organization, seed the product catalog. The first exploited-vulnerability catalogue sync starts automatically.

After the wizard, activate your license. Request your free Community Edition license on the sign-up form at sentrikat.com, which opens with On-Premises (Community) already selected: it arrives by email, and the email carries your license key and an activation code (SK-XXXX-XXXX-XXXX-XXXX). Open Settings → License in SentriKat, enter the activation code in the Activate Online box and click Activate Online. SentriKat starts ingesting CVE intelligence on the next scheduler tick.

The same activation code is shown in the Customer Portal, which can also issue a new one if the code has expired (it is valid for 90 days) or you lost the email. The Community Edition is limited to 10 agents, 3 users, 1 organization and 100 products.

Air-gapped host?

Online activation reaches the licensing service (see the firewall note in Licensing). Air-gapped operation (offline activation and the offline bundle) is part of Professional. See Licensing: offline activation.

Next steps

  • Install your first agent. Follow the Windows, Linux, or macOS agent guide.
  • Connect a data source. How SentriKat decides explains how the feeds are read and how to check they are answering.
  • Read the dashboard. Reading the Dashboard explains the KPI tiles and the "What changed since yesterday?" panel.

When you're ready for more

Community Edition does not expire: you never have to upgrade.

If you outgrow its limits, Professional lifts the user, organization and product limits and adds all vulnerability intelligence sources, the NIS2 and BOD 22-01 reports, SIEM/Syslog integration, Jira, GitHub and GitLab integration, multi-tenant and white-label, LDAP/AD/SAML SSO, air-gapped deployment, and scheduled backups. The DORA, PCI-DSS, ISO 27001 and SOC 2 reports are the Compliance Pack, a paid add-on that Professional does not include on its own. Write to [email protected] or buy Professional at the Customer Portal.

Troubleshooting

docker compose up exits complaining about a missing SECRET_KEY, ENCRYPTION_KEY, or DB_PASSWORD

Production-mode safety check fired. You didn't change the defaults in .env. Re-edit .env to set the required variables. See Configuration.

Agents can't reach the API

On 1.4.0-beta and later, agents use the https:// address: port 80 only redirects, and port 5000 answers only on the server itself. Set the agent's server address to https://<your-host>. With the self-signed certificate, give the agent ./certs/fullchain.pem: --ca-cert /path/to/fullchain.pem on Linux and macOS, -CaCertPath C:\path\to\fullchain.pem on Windows.

On 1.3.0-beta and earlier, the default deploy serves HTTP. The 2026 agent installer refuses plain HTTP unless -AllowHttp is passed. Either pass that flag for lab use, or front the stack with TLS following the TLS Setup runbook (Let's Encrypt, internal CA, or self-signed paths covered).

License key not accepted

Check that the host can reach license.sentrikat.com, api.sentrikat.com and portal.sentrikat.com over HTTPS: the licensing service validates and signs the activation. Air-gapped installs (Professional) use the offline activation flow documented in Licensing & Activation.

Reference