Sentova

What it is

Sentova is cross-device active protection: installable desktop (Wails) and mobile apps that block malicious traffic, detect spyware and ransomware, and score a device's hardening posture. It is backed by a single Go service — a go.work four-module monolith — and ships a privileged Windows service (serviced.exe).

The architecture

Protection is organised into five modules — network_filter, ioc_scan, posture, behavior_monitor, and ransomware_guard — across six platform targets. The decision logic and the enforcement path (verified directives driven through kill / quarantine / network-filter ports by a shared enforcer, with a bounded at-most-once replay guard and an autonomous canary → correlate → kill/quarantine loop) are implemented in Go and unit-tested with fake ports.

Highlights

• On Windows, live enforcement uses WFP filtering, ETW telemetry, and a TerminateProcess kill primitive — all elevation-gated.
• Client/service communication is an authenticated named-pipe round-trip with an integrity-gated mutating path.
• At-rest secrets are sealed with DPAPI and the data directory is ACL-hardened.

A tracker matrix keeps the docs honest about exactly which module ships real enforcement on which platform, so the product never claims more than it does.