Features by plan: Observe, Maintain, Fleet

What each plan includes.

Features by plan: Observe, Maintain and Fleet
Feature	Observe€14	Maintain€37	Fleet€29
See
Pending security updates and traces of attacks, checked every ten minutes	included	included	included
Exposure report: actively exploited vulnerabilities (CISA KEV), Ubuntu Security Notices and EPSS, hourly, with deadline, fix and notification	included	included	included
End of security updates for operating system and PHP	included	included	included
Monitoring: services, domains and containers every two minutes, certificates daily	included	included	included
Website check in the browser with a reference image	included	included	included
Detect changes to accounts, keys, scheduled jobs, services, ports and under /etc	included	included	included
Preserve evidence automatically	by button, not automatically	included	included
AI agent watch: AI services, agent tools and model keys per server, rule per server	included	included	included
Detect password guessing on SSH access and unknown keys	included	included	included
Act
Security updates, including at night and on weekends	not included	included	included
Install all updates, including new kernels, in the maintenance window	not included	included	included
Back up before updates, check the system state afterwards and roll back on errors	not included	included	included
Plant decoys with made-up keys, read access as a case file	not included	included	included
Temporarily block attackers, repeat offenders for longer	not included	included	included
Reboots according to your rule, on request only with approval	not included	included	included
Update WordPress plugins one at a time, roll back broken ones	not included	included	included
Prove
Investigator: the AI’s assessment of serious case files, without tools	included	included	included
Morning report from the AI in plain language	included	included	included
Report per maintenance run, with reasons	not included	included	included
Checksum-chained audit log, on request secured externally every day	included	included	included
For IT service providers
Customer access and a morning report across the whole fleet	not included	not included	included

Prices per server per month, net, plus VAT. Fleet from 25 servers with a 12-month term, from 100 servers €22, from 500 servers €4 per server with a 24-month term. All plans with cost calculator: Pricing.

Websites and applications

After the update, Sentinel checks your website. Not you.

Before and after every update and reboot, Sentinel opens the configured pages in its own browser and signs in where that is set up. It checks the status and the expected text and compares the image with the one from before.

Red means roll back.If something no longer runs as before after an update, Sentinel rolls back, checks again and reports after how many seconds the site was running again.
After reboots, too.Sentinel waits until services and sites are up, and notifies you if one is not running again afterwards.
The AI takes a look, too.On request, the AI looks at the screenshot and notes what is wrong.

Example of an application check before and after an update
Check	before	after
Page responds	ok	ok
Text “Add to cart”	ok	missing
Sign-in	ok	ok
Image as before	ok	different

AI“The ‘Add to cart’ button is missing on the product page.”

Red after the updateRolled back, site is running again

Example

Compared with built-in tools

Installing updates is only the beginning. Sentinel checks whether what ran before still runs afterwards.

Comparison: built-in tools (unattended-upgrades and fail2ban) versus Sentinel
Feature	unattended-upgrades + fail2ban	Sentinel
Install security updates automatically	yes	yes
Temporarily block repeated SSH sign-in attempts	yes	yes
Check the system before and after updates and roll back on errors	no	yes
Assess actively exploited vulnerabilities per server	no	yes
Detect changes to accounts, keys, scheduled jobs, services and ports, preserve evidence	no	yes
Find AI services, agents and stray model keys on the server, plant decoys	no	yes
Have serious incidents assessed by an AI that cannot execute anything	no	yes
Safeguard reboots with a system image or an approval	no	yes
Monitor all servers centrally	no	yes
Daily morning report and checksum-chained audit log	no	yes

fail2ban also protects web and mail sign-ins; Sentinel does not cover that area. The two run side by side.

Integrations

Fits what you already have.

Notifications

Email
Slack
Microsoft Teams
Google Chat
Telegram
Webhook

Rollback paths

Hetzner Cloud snapshot
LVM snapshot
Package state
Configuration
WordPress backup

Servers and services

Ubuntu
Debian
Docker
nginx
Caddy
Apache
PHP
WordPress

Security sources

CISA KEV
Ubuntu Security Notices
EPSS (FIRST)
Ubuntu Pro
Livepatch

AI and access

Claude by Anthropic
Two-factor sign-in
Roles and customer access
Ping anchor (healthchecks.io)

What works today and what does not

Sentinel currently creates snapshots of the whole machine only on Hetzner Cloud; other providers on request.

Sentinel recognizes Btrfs and ZFS, but does not create snapshots there yet.

Sentinel only monitors Rocky Linux, AlmaLinux and RHEL; it does not monitor Windows at all.

The application

67 actions, one screen.

Every action is predefined and vetted; nothing is typed. You see what is running at the very moment it runs, every step with its result.

A server in the lab, level “Full”, during maintenance. Connection details redacted.

Pilot program until 30 November 2026

All of it, six months free of charge.

For up to five of your servers on the Maintain plan, without payment details. Sentinel starts in read-only mode and only acts once you enable the server.

Request a pilot place

Prefer direct contact? +49 221 16834135 or write to us.

What Sentinel can do, plan by plan.