Perfex Sentinel — Security, 2FA, Firewall & Audit Log for Perfex CRM

Protect sign-ins, manage live sessions, inspect changes and monitor your Perfex installation in one module. Perfex Sentinel combines two-factor authentication, a firewall with a seven-day learning period, virtual patches, a tamper-evident audit log, 21 hardening checks, security alerts and an optional AI analyst. Recovery links, a file switch, safe mode and CLI recovery help administrators restore access.

Know who signs in. See what changes. Keep unwanted traffic out.

Your Perfex CRM contains client records, invoices, projects and staff access. Perfex Sentinel brings sign-in protection, session controls, a firewall, audit evidence and security monitoring into the CRM you already use.

Start with seven days of firewall learning. Review the decisions against your real traffic, save your recovery link and configure the rules before enforcement begins. Keep Monitor mode selected if you need more time.

Sign-in protection and two-factor authentication

• Tracks staff and customer-portal sign-ins, devices, addresses and country estimates.
• Progressive delays and lockouts by account, address and network, plus password-spray detection.
• Authenticator-app TOTP codes with locally generated QR setup, email fallback, one-use recovery codes and remembered devices.
• Require two-step verification for administrators, selected staff roles or portal contacts, with a configurable number of grace sign-ins.
• Password length, character mix and reuse controls, plus an optional breached-password check.
• New-device or new-country sign-in notifications.

Live sessions and temporary access

• Inspect staff and portal sessions by browser, device, address, country and activity.
• Revoke one session, other sessions or everyone with the appropriate permission.
• Set idle timeout, maximum duration, concurrent-session limits and remember-me policy.
• Staff account end dates with warnings and last-administrator protection.

A firewall built for Perfex

• Early request filtering with a compiled rules file and seven-day learning period.
• Allow/block lists, country rules, admin-area restrictions, attack signatures and rate limits per area.
• Temporary automatic blocks, trusted proxies and Cloudflare support.
• Request guards for CVE-2026-7783, CVE-2026-7782 and the Sentinel CSRF-bypass reference PSN-2026-001.
• Test a Request and Top Offenders to review rules before enforcing them.
• Included local DB-IP Lite country data with attribution and license.

Virtual patches cover specific patterns and checks. Keep Perfex and its modules updated.

A tamper-evident audit log

Review supported changes to settings, staff, roles, permissions, modules, email templates, custom fields, deletions, exports and API-token activity. Sensitive values are excluded from change details. Filter and export events, check the seal chain and retain seal-head copies outside the CRM.

21 hardening checks with clear guidance

A security score shows failed checks, warnings and evidence. Supported one-click fixes include backups and undo. Create a trusted file baseline, inspect changed core files, scan uploads and quarantine suspicious files. Nginx rules are provided for the server operator.

Alerts where your team works

Send alerts by email, Slack, Microsoft Teams and Telegram. Route by category and severity, choose immediate or digest delivery, set quiet hours and hourly limits, and snooze noisy event types. A weekly security report summarizes activity and findings.

Optional AI explanations

Local rules detect unusual activity and group incidents without an AI provider. Enable AI for incident explanations, weekly narratives, permission review and natural-language log filtering. Use an available Perfex AI Staff provider or configure your own OpenAI, Anthropic, Gemini or OpenAI-compatible connection.

AI is disabled by default. Configure a daily token limit and pseudonymization before enabling it. Provider charges are separate. AI suggestions are advisory and do not automatically change staff permissions.

Recovery built in

Save a one-time recovery link outside the CRM. If a firewall rule blocks your address, that link allows it temporarily. You can also create the DISABLE file, set PSN_SAFE_MODE or use the CLI unlock command through your hosting access.

Fits your existing installation

• No Perfex core files changed; Sentinel uses its own tables and standard module hooks.
• Separate staff permissions for viewing and managing security features.
• Light and dark module themes and nine included languages.
• Optional Brain Pro security dashboard with nine widgets and five read-only security tools for AI Staff.
• Background work runs through Perfex cron, with no daemon required.
• Supported separate-database SaaS tenants; shared-database tenant setups are excluded.

What is included

The installable Sentinel module ZIP, offline HTML documentation, changelog and third-party license notices. Perfex CRM itself, hosting and AI-provider subscriptions are not included.

Product overview · Documentation