Keys and secrets

Secret	Where	If lost
Key file (sentinel.key)	data_dir or SENTINEL_KEYS_KEK	Policy signing key, MFA secrets and integration secrets cannot be decrypted: devices must re-enroll, admins need MFA reset, integrations must be re-entered. Encrypted sync data is not affected.
Evidence passphrase	people, never stored by Sentinel	Evidence sealed to that key can never be opened. Use Settings → Keys → Replace evidence key to create a new key for future evidence.
Setup token	data_dir/setup-token	Run sentinel init again before setup to create a new one.

Rotating the key file

Rotate it when someone with access leaves or the key may have been exposed:

1. Back up the database and the current key file.
2. Stop Sentinel on every node.
3. Run sentinel keys rotate-kek --config …. It re-encrypts every protected secret with a new key in one transaction, records the rotation in the audit log, moves the old key to sentinel.key.old-<timestamp> and puts the new key in place. If you use SENTINEL_KEYS_KEK, it prints the new value instead.
4. Copy the new key file to every node and start Sentinel. Keep the old key until no backup that needs it is retained.