FAQ

Quick answers to the questions customers ask most. Each answer links to the page with the full detail - start here, then follow the link if you need more.

Getting started & accounts

Do I need to install anything to use Sencai?

No - the platform application at app.sencai.space runs entirely in your browser; you sign up, sign in, and manage everything from there. The one thing you might install separately is the fleet agent, a small binary for servers you want Sencai to monitor and manage directly. See Create your account and Fleet agent.

How do I create an account?

Sign up at app.sencai.space/auth/register with your name, email address, and a password, then verify your email before your first sign-in. You can also sign up using your existing Google or Microsoft account instead. See Create your account.

Can my organization use enterprise SSO instead of passwords?

Yes - an organization Owner or Admin can configure Microsoft Entra ID or Google Workspace single sign-on so members sign in with their corporate identity instead of a Sencai-specific password. This is set up per organization by an administrator, not by individual members. See SSO.

Should I turn on two-factor authentication?

We recommend it, especially if your organization manages production infrastructure. Once you enable it from your profile’s security settings, every future sign-in asks for a 6-digit code from your authenticator app in addition to your password. See Account security.

What happens if I lose access to my authenticator app?

Turning two-factor authentication off yourself requires a valid code from the same device, so there’s no self-service reset if you’ve genuinely lost it. Contact support to regain access to your account.

Organizations & access

What’s the difference between an organization and my personal account?

Instances, fleet agents, billing, and most settings belong to an organization - your team’s shared workspace - not to you as an individual. Separately, your own personal account has its own plan governing your AI-assisted features, and nothing else - it doesn’t limit how many organizations you can own, or how many members a paid organization can have. A still-free organization is capped at one user regardless of anyone’s personal plan - see Organizations & teams and Seats & personal plans.

What roles can members have, and what can each one do?

Organizations have five roles, from most to least privileged: Owner, Admin, Member, Auditor, Viewer. Owner and Admin can manage members and most settings, Member has standard working access, Auditor is read-only access scoped to audit and compliance data, and Viewer is general read-only access. See Roles & permissions.

How do I invite someone to my organization?

An Owner or Admin invites a new member by email from the organization’s member settings. The invitation has to be accepted before that person counts as a member - a pending, unaccepted invitation grants no access on its own. See Organizations & teams.

Can I manage infrastructure for more than one customer organization?

Yes, through a cross-tenant relationship between organizations - each with its own scoped access and audit trail, rather than one shared set of credentials passed around between customers. This is typically arranged with your account team. See Agency.

Cloud accounts & providers

Which cloud providers does Sencai support today?

Sencai natively integrates with a broad set of providers, including AWS, Microsoft Azure, Google Cloud, Hetzner, DigitalOcean, Scaleway, OVHcloud, UpCloud, Oracle Cloud (OCI), Vultr, and Linode (Akamai), with IBM Cloud support in progress. Not every provider necessarily appears in the credential form on every screen that manages cloud accounts - check the provider picker in the app. See Connect a cloud provider.

Can Sencai provision infrastructure without my own cloud account?

Yes. By default, resources run on a Sencai account - an account Sencai owns at the provider and bills to you at the provider’s price plus a 2% fee, after you consent to the terms and within your organization’s spend cap. See Sencai accounts. Connecting your own provider account (bring your own cloud) remains fully supported as the advanced option. Separately, the fleet agent doesn’t need any cloud account - it works on servers you already have, cloud or not. See Connect a cloud provider.

What permissions does Sencai need on my cloud account?

It depends on what you want Sencai to do: read-only access is enough for discovery and monitoring, while provisioning and managing resources needs write access too. Wherever your provider supports scoped or read-only tokens, start with one of those rather than an account-wide admin credential. See Credential permissions.

Is my cloud credential stored securely?

Credentials are encrypted at rest and are never displayed in full again once saved - including to Sencai staff. A credential belongs to exactly one organization and is never shared across organizations, even if you’re a member of more than one. See Connect a cloud provider.

Can Sencai import infrastructure I already have running?

Yes - a discovery scan against a connected cloud account finds existing resources so you can bring them under Sencai’s management instead of recreating them from scratch. See Import existing infrastructure.

Fleet agent

Does the fleet agent work on servers that aren’t in the cloud?

Yes - the fleet agent runs on bare metal, on-premise machines, and cloud VMs alike, including ones Sencai didn’t provision. It doesn’t require a connected cloud account at all. See Fleet agent.

What operating systems and architectures does the agent support?

Linux, on amd64 or arm64. See Install & enroll an agent.

What does the fleet agent actually do once installed?

Depending on which capabilities your organization grants it: software inventory, patch status, CIS-style security scanning, and running pre-approved runbooks. A newly enrolled agent starts with monitoring only - an admin grants any further capability you want. See Fleet agent.

Can I isolate a server if I think it’s compromised?

Yes, where fleet command dispatch is enabled for your environment - quarantine drops a server’s outbound network traffic at the OS level from within the app, without you needing to touch the server directly. Where dispatch is not enabled, both isolating and releasing fail outright rather than queueing. Releasing also requires the appropriate organization role. See Quarantine.

Security & compliance

Is every action in Sencai logged?

Yes - cloud provisioning, fleet agent actions (including runbook runs), browser terminal sessions, and organization membership changes are all recorded in an append-only audit trail, including which user performed the action. See Audit log.

Does Sencai help with NIS2 or similar compliance requirements?

Yes - Sencai tracks compliance controls and CIS hardening scores, and can compile evidence relevant to frameworks like NIS2 from data it already collects about your environment. See NIS2.

Does Sencai scan for leaked secrets and known vulnerabilities?

Yes. Leaked credentials detected in the Git repositories you manage through Sencai are surfaced as secret findings. Known CVEs are tracked for container images from two sources: every image pushed to your organization’s registry is scanned automatically on push (and tagged images are rescanned about weekly), and the images your cloud instances run are scanned separately. Both have their own resolution workflow. Scanning of running instances has to be turned on for your environment before anything appears, and an image that has not been scanned is shown as not scanned - don’t read an empty screen as confirmation that nothing is there. Registry images are also signed, so you can prove which image you deployed - see Image signing and verification. See Vulnerabilities and Secret findings.

Data & privacy

Where is Sencai built and hosted?

Sencai is built in the EU. For where your specific platform data is hosted, see the data residency page on the main site; for infrastructure running on your own connected cloud account, that’s the region(s) you chose when provisioning it. See Regions & data residency.

What data does Sencai collect about my infrastructure?

Whatever a feature you’re using is explicitly designed to read - for example, inventory metadata, monitoring metrics, and audit records - not the contents of your servers or databases beyond what that feature needs. See Privacy & agreements for the specifics that apply to your organization.

Can I get a copy of my data, or have it deleted?

Yes - see Privacy for how to request an export of your data or the deletion of your account and associated data.

Billing & plans

What happens when my trial ends?

Today there are two, and they end separately. Your own account gets a 14-day personal trial the moment it’s created - including an account provisioned through SCIM - on a trial personal-plan tier that isn’t tied to any organization; on day 14 it converts automatically to the Free personal plan (you’re never suspended). Separately, a new organization starts its own 14-day trial the moment it’s created. If nobody has put the organization on a paid plan by day 14, creating or changing cloud instances and editing organization settings are blocked until it is - sending invitations is not currently blocked by it. Nothing is ever deleted either way.

We’re moving away from organizations themselves having a trial to end, and from the account-wide personal trial above, but that rollout hasn’t shipped yet: the decided direction is for a new organization to simply be on the free configuration (one user, five managed resources) until an Owner chooses a paid plan, with a one-time Plus-tier seat lasting 14 days for you personally instead, granted once in the first organization you create or join - when it ends, your seat would drop to Free (free organization) or continue as a paid Plus seat billed to the organization (paid organization). See Billing overview and Seats & personal plans.

What’s the difference between an organization plan and a personal plan?

They’re independent billing axes that both land on the organization’s invoice once it’s paid. Your organization’s plan sets what the company pays - its managed resources, how much of running them is automated, and the people who need access beyond the included allowance - but not what it can do, because every paid organization runs the whole platform. Each member’s own personal plan / seat (Free, Plus, Max, Pro) covers how much AI is included for that person; a paid organization pays for its members’ seats itself. Being introduced: outside Sencai’s own development environment the seat isn’t invoiced yet, and your AI allowance still comes from your own personal plan, not from the seat. No personal plan limits how many organizations anyone can own or how many members an organization may have. See Billing & plans and Seats & personal plans.

What happens if I use more AI than my plan includes?

Nothing switches off. AI is measured in credits, and the allowance is monthly whether you pay monthly or annually. Go past it and you keep working, billed at the same rate the allowance itself is measured at - there is no separate, higher overage price. Every paid plan includes AI; they differ in how much is included, never in what AI is allowed to do. Each account also carries a monthly safety ceiling, set by default at 4× the included allowance, and AI pauses for the rest of the month once it is reached. Metering is being switched on: until it is, nothing above your included allowance is charged. See Personal plans for the allowances, and sencai.space/pricing for what a credit is worth.

What do I get for free?

One user, one organization, five managed resources and 30 hosted CI minutes a month, at no cost and with no time limit. A free organization has no AI and no automation. RoPA records for GDPR Article 30 stay switched off until it moves to a paid plan; the audit log and the Auditor role that reads it are meant to as well, though that restriction isn’t switched on everywhere yet, so a free organization can currently still read and export its audit log in places where it isn’t. API keys and AI agents work the same as on a paid organization. The first thing you pay for is your sixth managed resource, or your second user - see Organization plans for exactly what each of those two limits does and doesn’t tell you - an API key hitting one gets the same error message a browser session does. The CI minutes work differently: nothing is refused, and new CI jobs wait once fewer than 5 of the 30 are left - see CI minutes. You may own only one free organization at a time - a second one needs a paid plan. See Organization plans.

What happens if a payment fails?

Your organization doesn’t lose access immediately - it enters a grace period first, then becomes read-only if the issue isn’t resolved. As a last resort, on day 21, your cloud instances on a Sencai-managed account are torn down: permanently deleted at the provider, with the data on them lost and no way to undo it. Resources in your own connected cloud accounts are never deleted this way. Resolving payment at any point before that restores everything to normal right away. See Payment, invoices and failed payments.

Can someone else pay for my personal plan?

Yes. In a paid organization, the organization already pays for every member’s seat by default - nobody there is asked for a card personally. Being introduced: outside Sencai’s own development environment the seat isn’t invoiced yet, and your AI allowance still comes from your own personal plan, not from the seat. On top of that, another person can sponsor a higher personal plan for you from their profile, or an organization can sponsor one specifically, which is how a company gives a colleague more AI than their seat already includes. If someone else pays for your plan, the overage is billed to them and they can set you a lower ceiling. See Seats & personal plans.

API & integrations

Can I use Sencai’s API instead of the web app?

Yes - create a personal access token from your organization’s API settings and call the API directly. See API tokens.

Can an AI agent act on my organization’s behalf?

Read access is the most mature path today. Write access is possible but is off by default at two independent levels - the token itself needs read/write scope, and an organization Owner has to separately turn on AI-agent write access - so a leaked or over-broadly-scoped token alone can’t do anything on its own. See AI agents and API tokens.

Does Sencai support webhooks?

Yes - you can register a webhook endpoint to be notified when events happen in your organization, such as provisioning completing or an incident being raised. See Webhooks.

Troubleshooting

I can’t sign in - what should I check first?

Confirm you’re using the right email and password (or the SSO option your organization set up), that you’ve verified your email address, and that your two-factor code hasn’t expired. See Troubleshooting for a fuller breakdown by symptom.

My invitation link isn’t working.

An invitation only grants access once it’s accepted, and it can be resent or revoked by an Owner or Admin - ask them to check its current status. See Troubleshooting.

How do I get help?

Use the support option in your organization’s settings, or see Support - response times depend on the service level agreed in your contract.

Where can I find the technical/architecture side of Sencai?

This site covers how to use the platform. Sencai’s internal engineering documentation is a separate, non-public site.

Why is this documentation only in English right now?

The main sencai.space marketing site supports multiple languages; this documentation site will follow once there’s reviewed content to publish in another language.

What’s next

• Getting started - accounts, sign-in, and the first things to do
• Troubleshooting - symptom-by-symptom fixes
• Glossary - every term used across this site
• Support - how to reach a human