The Sino Control Hub
Enroll, configure and audit your company's Sino vaults from a hub you host yourself, on your own server or in your own cloud. The hub never sees a vault key, a file name or a file. Sino runs no server and never sees your hub.
In development. The Control Hub and shared folders are built and now being tested on real devices and clouds. They are not in a release yet: the apps on the Downloads page do not include them. To try them early, write to support@sinosecure.app.
How it works
The hub is a control plane, never a data plane. It enrolls devices, signs policy, relays commands, collects audit events and hands out short-lived storage access. Files go straight from each device to your storage, encrypted, and never pass through the hub.
Your hub
One container with a web console for your admins. It holds public keys, the device list, policy and audit events. It cannot open anything.
Your people's apps
The same Sino apps for Android and Windows. A vault becomes managed only when it enrolls with your hub. Each device checks every policy and command against your organisation's own keys.
Your storage
AWS S3, Backblaze B2, Cloudflare R2 or Azure Blob Storage that you own. Each device gets access for a few hours to its own vault only, never your account's key.
What your admins can do
Enroll devices
Send a person a single-use link or QR code. Their app shows your organisation's name and exactly what you can do before they agree. A second device joins the same vault through Sino's device transfer.
Set policy
Auto-lock, biometric unlock, failed unlocks before a wipe, devices per vault, minimum app version, locking a device that has not reached the hub for a while, and whether personal clouds are allowed. Every policy is signed, and devices refuse anything unsigned or older.
Audit to your SIEM
Unlocks, failed unlocks, deletes, exports, shares, syncs, wipes and every admin action, signed and chained on each device so gaps show. Sent as OCSF to Microsoft Sentinel (parsers, rules and a workbook included), Splunk, syslog or a signed webhook. File ids only, never names, unless you choose otherwise and your people are told.
Recover a vault
When someone leaves or loses access, a quorum of admins (2 of 3 by default) bring their organisation kits together in the Sino app to recover the vault, for a successor or for the same person on a new device. One kit alone opens nothing.
Approve what matters
Remote wipe, cloud wipe, recovery, unenrolling and lowering privacy all need approvers' passkeys, and the devices check those signatures themselves. A cooling-off delay, always on for a company with a single admin, gives any admin time to cancel.
Lock, revoke or wipe a device
Lock a lost device at its next check-in, stop giving it storage access, or wipe it with approval. A remote wipe removes Sino from that device only; the encrypted copy in your storage stays.
Sign in your way
Admins sign in to the console with a passkey, or with Microsoft Entra ID, Google Workspace or any SAML 2.0 provider (Okta, AD FS and others). Entra ID can add and remove people through SCIM. Company sign-in never unlocks a vault: the vault password stays the key.
Automate it
The console uses only the hub's public REST API, described in OpenAPI, so anything it does, your own tools can do with a scoped API key. An API key can only ask for a destructive action; people still approve it.
What each party can and cannot do
| Who | Can | Cannot |
|---|---|---|
| Someone who breaks into your hub | Read audit details and the device list, push ordinary policy, delete encrypted files with the stored storage key | Decrypt anything, recover a vault, wipe or unenroll a device without approvals, lower privacy, add a member to a shared folder, or replace the hub's keys |
| One admin acting alone | Read the audit log, change ordinary policy | Wipe, recover or unenroll |
| Enough admins together | Recover a managed vault, or a shared folder whose owners left | Recover a personal vault that never enrolled |
| An admin who has left | Nothing alone: one kit opens nothing | Use their old kit after the kits are renewed |
| Sino | Nothing: we run no server and hold none of your keys | See or change your hub, policy or data |
What changes for your people
A managed vault belongs to the company, and the app says so before anyone enrolls.
- Admins together can recover a managed vault and read its audit events. A personal vault keeps Sino's usual promise: nobody but you can ever open it.
- Only a new, empty vault can enroll, so personal files never end up in a company vault. Keep a personal vault apart: in your phone's personal profile while the work vault is in the work profile, or under another Windows account.
- The decoy vault and legacy beneficiaries are off in a managed vault: company data should not pass to personal beneficiaries, and company recovery takes their place.
- The panic wipe still works. It removes the vault from that device only; the company's copy stays in its storage.
Run it anywhere
One container image, with SQLite or Postgres. It needs nothing else: queues and timers run inside the hub. Guides cover each option, and the goal is a fresh server to the first enrolled device within an hour.
Losing the hub never loses data: files and recovery copies live in your storage, and the kits stay with your admins. Rebuild the hub, sign its new certificate with the kits, and devices reconnect at their next check-in, without enrolling again.
Your data, even without Sino
The open-source Sino Open SDK can recover a managed vault, or read a shared folder, from a copy of your storage and your admins' kits, with no Sino app and no hub. If Sino ever disappears, your company keeps its files.
Interested?
Business use of Sino needs a business subscription, priced in tiers by the size of your organisation (Terms of Service, section 13). Prices come with the release. Tell us about your team and we will let you know when the Control Hub is ready to try.