Local agent. Encrypted relay. Your browser.

Live power flow (solar, battery, grid, load), state of charge, battery cell and module voltages and temperature, inverter temperature, error and fault codes, charge/discharge schedule, EMS state, firmware version, and aggregate energy counters. Read from the inverter's standard local Modbus port over the LAN — the same registers the GivEnergy kit exposes on-site.

Yes, by default. The agent reads registers and writes nothing unless you request a change while the customer's permission covers it: a change window they opened on their own device during a call, or 48-hour access they granted you. The agent refuses any write outside both. If you never request a write, Sentinel never writes.

The agent shows a six-character code that the customer reads to you. Sentinel opens an encrypted outbound connection from the customer's LAN through a small UK Cloudflare relay to your browser dashboard — outbound TLS only, no inbound ports opened on the home router. Nothing listens for incoming connections, so there is nothing on the customer's router to open or forward.

There are two routes, and both start with the customer. On a call: you ask the customer to tap "Let your engineer change settings" in their Sentinel app. That opens a window on their device, for one hour, in which you can make changes; the agent refuses any write outside it, and the customer can close it sooner. Without a call: the customer grants you 48-hour access from the Sentinel app on their Mac or Windows PC, which covers changes as well as reads; they are approving the access rather than each individual change, it expires by itself, and revoking it takes effect immediately. Either way, before the command reaches the inverter it is written to a permanent, tamper-evident audit log — hash-chained and append-only, keyed to you (the signed-in engineer) and the system, and recording which consent route was used. If it can't be logged, the write is refused. Afterwards the agent reads the setting back and sends the result, which is added to the record when it arrives. That second entry is not guaranteed the way the first is: if it cannot be saved, the change has still been made.

The settings on Sentinel's allowlist, and no others: charge and discharge times and limits, battery settings and the battery-recovery tools, metering (CT and meter direction), the inverter clock and real-time control, backup (EPS) power, switching the inverter off and on or restarting it, and the grid and DNO settings — export and import limits, the output power cap, the grid code reset (which returns the inverter's own settings to that grid code's defaults), anti-islanding, and the grid-protection settings the installation was commissioned to (voltage and frequency trip limits and their delays, and the other protection trip levels). When you set one of the grid and DNO settings, the dashboard shows a grid-code warning and you type the new setting again before it is sent; the grid code reset asks you to type RESET. Restoring a setting to the value it had before your first change to it in the session asks only for an ordinary confirmation. The list is the same on a call and on 48-hour access. Sentinel refuses anything else: a setting not on the list; a setting that does not apply to that inverter model, or an address that is not the right one for it (some settings live elsewhere on three-phase inverters); a value outside the setting's checked range; a grid code other than the one the inverter already holds; and every write to a GivEnergy Gateway. Apps from before the Sentinel 1.2.0 app update also refuse every write to a GivEnergy EMS, and three settings they hold as read-only: the meter type, the second meter's direction and the battery capacity the inverter holds. From that update those three can be changed, and so can an EMS's own settings: whether it manages the site, its timed charge, discharge and export slots, and the site's export limit, which you type again before it is sent.

Only approved installers. Engineers sign in with their work email, secured by Cloudflare Access — there is no open signup. Ron approves each installer, so nobody can start a session without his approval. He can also disable an engineer from an admin console: that refuses them new sessions, stops their changes within about a minute, and cancels their 48-hour access. Every remote change is recorded against that engineer and the specific system.

The agent keeps reading over the LAN even if the connection to the relay drops, and resumes streaming to your dashboard automatically once it's back. No inverter data is lost while the link is down.

The local agent keeps reading the inverter over the LAN regardless. Your remote session and the browser dashboard need the customer's connection up, because the relay runs over the internet — but nothing depends on a GivEnergy cloud account.

Very little, and the privacy policy lists all of it. The inverter's identity, readings and fault codes pass through the relay, and a summary of the readings is kept for 48 hours, then removed from the live database automatically (the database's restore points, kept in case it has to be recovered, expire within 30 days). An engineer with 48-hour access uses that summary to see what happened while they were away, and any engineer who has worked on that system before can still read it after their access has ended, for as long as their own account is active. If the customer gives 48-hour access, the name they type to authorise it is stored with that access, and kept for up to 90 days after the access period ends, then deleted automatically. If the customer ends the access early, the 90 days run from the time the access would have ended. While it is kept, it shows in your list of past systems. No audio, no video, no tracking, and nothing else from the customer's network: besides the inverter's own network address, a search for an inverter reports only which addresses answered on the inverter's port. Sentinel is not affiliated with GivEnergy and sets no tracking cookies.