Blueprint Sentinel Engine™
AI-driven data integration for technology and data leaders. The same pipeline handles one-time migration, continuous harmonization across sources, and deduplication within or across systems.
Read it the way we built it: honestly.
Every quantified figure (detection rates, latency, accuracy over time) is a design target, the operating envelope the system is built to reach. Targets are replaced with measured figures during a pilot on the client's own data.
01
Design targets
Performance numbers describe the envelope we build toward, not a deployment we are quoting.
02
Illustrative examples
Alert examples use hypothetical figures to show how Sentinel reasons, not real cases.
03
Sourced benchmarks
Any industry statistic carries its source (e.g. ACFE) rather than standing unattributed.
Anomaly detection against a learned, contextual baseline.
THE OLD WAY
One line for everyone.
“Alert if spend > €10,000.”
A single line for every hour, team, and person. It fires on routine variation and misses real problems that stay under the line.
SENTINEL
Normal, in context.
Normal by time, day, season, role, person.
Sentinel learns what normal looks like and flags departures from it, for a human to review and act on.
Why year three is more valuable than year one. Generic AI products say "gets smarter over time" as marketing. We can describe the mechanism operationally.
/ REASON 01
Thresholds don't fit.
Context decides what is normal. One number can't encode time, role, season, or peer group.
/ REASON 02
Humans don't scale.
Thousands of events daily across hundreds of entities. Only a fraction can be reviewed by hand.
/ REASON 03
Anomalies are complex.
Combinations, slow drifts, seasonal deviations, and peer outliers, not simple breaches.
Six architectural commitments.
01 | DAYS 1-2
Ingest
Connect, ingest history, validate quality.
02 | DAYS 3-7
Discover
Find daily, weekly, seasonal patterns.
03 | DAYS 7-14
Baseline
Connect, ingest history, validate quality.
04 | DAYS 14-21
Label
Mark known anomalies to tune detection.
05 | DAYS 14-21
Validate
Measure precision and recall, tune with client.
06 | DAYS 28+
Operate
Monitor live, continuous learning.
A contextual baseline per metric, not a single global number.
Time of day
Energy at 2am vs 2pm
Day of week
Volume Mon vs Sun
Week of month
Spend spikes at month-end
Month of year
December vs July
Entity type
Executive vs junior spend
Trend
A company growing 20% YoY
External events
Black Friday, a heatwave
Peer group
Same role, compared together
Beyond standard deviation.
±2σ / ±3σ bands work only when data is roughly bell-shaped. Spend, invoices, and energy are typically skewed, fat-tailed, or multi modal. So Sentinel selects a method per metric.
METHOD 1
Robust / quantile bounds.
For skewed, heavy-tailed metrics, percentiles beat mean ± σ.
METHOD 2
Seasonal-trend decomposition.
STL-style. December is judged against December.
METHOD 3
Peer / cohort baselines.
Compare an entity against others in the same role.
METHOD 4
ML detectors.
Isolation forest, density methods, for combinatorial patterns.
Why year three is more valuable than year one. Generic AI products say "gets smarter over time" as marketing. We can describe the mechanism operationally.
Normal
Expected variation. No action.
Usually €200–400/day, today €350.
Watch
Unusual, not necessarily a problem. Logged for review.
Today €550.
Alert
A significant departure for that metric and context. Immediate notice.
Today €2,500.
The split depends on the distribution and the agreed sensitivity, not always raw σ.
Two views, run together.
AGAINST ITS OWN HISTORY
A break from its own normal.
Each entity is judged against its own learned pattern, catching a sudden break from how it normally behaves.
AGAINST ITS PEERS
A quiet, persistent outlier.
And against others in the same role, catching an entity that sits inside its own range but is 3× the peer norm.
Both run together, which is how Sentinel catches the outlier a personal-history check alone would miss.
What the human reviewer actually sees.
DOMAIN 01
Financial & spend
→ Corporate cards — pattern, merchant, timing, geography → Supplier payments — amounts, new vendors, price drift → Subscriptions & expenses — renewals, duplicates, policy
DOMAIN 02
Equipment health
→ Lifecycle & maintenance-interval drift → Throughput, error-rate, calibration drift → Sensor signatures — vibration, temperature, pressure
DOMAIN 03
Energy & facilities
→ Consumption — spikes, after-hours, seasonal → Efficiency — HVAC, production-to-energy ratios → Demand — peak load, demand-charge exposure
DOMAIN 04
Workforce
→ Aggregate signals — absence, overtime, retention risk → Surfaced to HR for human judgement → Within legal & co-determination framework
A contextual baseline per metric, not a single global number.
Point
A single value far from expected.
Contextual
A normal value in the wrong context.
Collective
A set of related abnormal events.
Trend
Gradual drift from baseline.
Seasonal
Deviation from a seasonal pattern.
Peer
An outlier vs a comparison group.
How Sentinel reasons.
FINANCE
Card combination
~€8,700 late-night spend, city off the travel schedule, new merchant category. No single fact is conclusive, the combination is. So it is flagged, not blocked.
FINANCE
Bearing drift
Vibration trending above baseline, error rate several times normal, matching prior bearing failures. Early: a maintenance window. Late: emergency repair plus downtime.
ENERGY
HVAC left running
A warehouse far above baseline 11pm–6am while unoccupied, starting after a maintenance visit. A next-morning fix, not months of quiet waste.
WORKFORCE
Team-level signal
Elevated Monday absences over several weeks across half a team. A collective signal, not an accusation, handled within governance.
A layered pipeline. Data flows down, learning feeds back up.
L1
Data ingestion
Streams, batch, APIs, file drops. Quality validation, schema detection.
L2
Baseline engine
Pattern discovery, statistical and ML modelling, seasonal decomposition, peer groups.
L3
Detection engine
Real-time scoring against baselines. Multi-dimensional, context-aware evaluation.
L4
Alert engine
Severity, grouping, routing, escalation, notification channels.
L5
Learning engine
Feedback, model updates, false-positive tuning, drift handling, self-monitoring.
L6
Dashboard & API
Monitoring UI, investigation tools, reporting, REST API for integration.
It surfaces and recommends. People decide and act.
WHY A HUMAN STAYS IN THE LOOP
No silent action
Sentinel surfaces and recommends; people decide and act. It takes no silent action on a vendor, an employee, or a budget. That keeps the alert stream trustworthy and keeps Sentinel usable in regulated, co-determined settings.
HOW FEEDBACK IS USED
Every verdict tunes it
- False positive → widen the baseline for that pattern - True positive → reinforce and seek similar patterns - Missed anomaly → tighten thresholds, add detection logic
Drift handling.
HANDLING DRIFT
The new normal, tracked.
- Gradual change → baselines adjust to a new normal - Step change → detect the break, reset deliberately - Seasonal → refresh seasonal patterns across the year - Self-monitoring → retrain when performance degrades
ACCUARCY OVER TIME
Lowest at cold start.
It improves as daily and weekly cycles are observed and analyst feedback accumulates. Reliable seasonal detection needs roughly a full annual cycle. We publish no fixed accuracy curve. The real number is measured per deployment.
An honest map of the landscape.
The landscape
→ Observability — Datadog, Splunk, Dynatrace → Data observability — Monte Carlo, Anomalo → Business-metric anomaly — Anodot → Domain tools — fraud platforms, CMMS
Differentiator
→ Cross-domain on one engine → Native to the Blueprint Suite → Human-in-the-loop by design
WHAT IT IS NOT
Not a replacement for purpose-built infra observability or a regulated-FS fraud platform; not a black box that acts on its own; and not, by itself, a compliance certification.
Sentinel detects. Insight explains. Report shows. Data keeps it trustworthy.
THIS PRODUCT
Sentinel
Detects the deviation and routes it, with context, to a human.
UPSTREAM
Data Engine
Clean, transformed data in. Detection is only as good as its inputs.
DOWNSTREAM
Insight Engine
When Sentinel flags an anomaly, Insight finds the root cause.
DOWNSTREAM
Report Engine
When Sentinel flags an anomaly, Insight finds the root cause.
The whole is worth more than a standalone detector. Sentinel detects → Insight explains → Report shows → Data keeps it all trustworthy.
It surfaces and recommends. People decide and act.
SECURITY & COMPLIANCE
Designed to support
Designed to support SOC 2, GDPR and, where applicable, HIPAA, with encryption in transit and at rest, role-based access, SSO, and audit logging. Certifications are pursued per deployment; current status is provided on request.
WORKFORCE GOVERNANCE
Aggregate-first, by default
Workforce use is aggregate-first, scoped to the employer's legal framework and, where applicable, agreed under co-determination (e.g. § 87 BetrVG) before deployment. No automated adverse decision about any individual.
Deployment & performance envelope.
Deployment
- Cloud (SaaS), dedicated, hybrid, on-prem - Kubernetes-native - Horizontally scalable
Connectivity
- Real-time — Kafka, Kinesis, Pub/Sub, MQTT - Batch — DBs, warehouses, files, APIs - Apps — ERP, HR, CMMS, BMS, SCADA, IoT
Target envelope
- High-throughput streaming ingestion - Seconds to alert on streaming paths - Batch cadence on batch sources - Built for large volumes, many entities
Prove it on your data.
A pilot against your own historical data, plus a short live period, with success metrics agreed up front. You see the real numbers before you commit.
DURATION
4 to 8 weeks on history, plus a short live period
METRICS
Recall, precision, alert volume, agreed up front
DECISION
Real numbers on your data, then you decide
“Their ability to combine strong engineering with clear product thinking made a real difference for our teams. Communication was smooth, delivery was consistent, and the results exceeded expectations.”
— Head of Engineering, Global Industrial Client
1/3 What are you building?