Built to be reviewed.
Documented to be approved.
Everything an enterprise security, legal, or procurement team needs to assess Sentinel — in one place. We are in open beta and we are honest about what that means: real DPA, real sub-processor list, real vulnerability disclosure policy, and an explicit statement of what compliance attestations we do not yet hold.
Data we process & why
Network metadata (IP, ASN, proxy/VPN signals) and device telemetry (browser fingerprint, tampering, behavioural signals) processed under GDPR Art. 6(1)(f) legitimate interest. IP addresses are personal data; raw lookup IPs are retained 7 days then reduced to a one-way hash. Full detail in the Privacy Policy.
Privacy Policy →Who we share data with
Network-intelligence and device-intelligence providers (named to customers under DPA), Cloudflare (CDN), Railway (host), Turso (DB), Resend (email), Upstash (rate-limit state), Amazon Web Services / S3 (encrypted backups), Google & GitHub (Sign-In only), Have I Been Pwned (k-anonymity password check). Fonts are self-hosted; no advertising or analytics providers. Dated change log with 30-day notice on the public list.
Sub-processor list →Report a vulnerability
Scope, response targets, safe-harbour commitments under UK CMA / US CFAA / EU Cybercrime Directive. Bounty stance and contact methods documented. RFC 9116 /.well-known/security.txt served.
Click-through & MSA
Standard click-through Terms cover most usage. MSA available for procurement that can't accept click-through. DPA aligned to UK/EU GDPR Art. 28 with Standard Contractual Clauses — self-serve at /dpa, countersigned copy on request.
Terms of Service →Uptime & incidents
Best-effort 99.9% uptime target during beta. Real-time status and incident history. Enterprise plans include a contractual SLA with service credits — typical 99.95% with 24-hour incident response.
Status page →What we set in your browser
localStorage for the auth token only. No analytics cookies, no advertising or conversion tags, no retargeting pixels.
Security controls in place today
Honest snapshot. Some are standard, some go beyond what most beta-stage products do — we will not list ones we don't have.
| Control | Implementation |
|---|---|
| Authentication | Email + bcrypt-hashed password, Google OAuth (RS256 JWKS verified), TOTP 2FA, a reviewable list of active sessions with per-device revocation, account lockout on repeated failures. |
| API key generation | crypto.randomBytes; key prefix sk_live_; rotation supported via dashboard. |
| Password breach check | Have I Been Pwned k-anonymity (5-char SHA-1 prefix only) on signup and password reset. |
| Transport security | TLS 1.2+; HSTS preload; CORP same-origin; CSP with allowlists; X-Content-Type-Options nosniff; X-Frame-Options DENY; Permissions-Policy (camera/mic/geo/payment off). |
| Rate limiting | Per-API-key (1,000/hr) and per-source-IP (50,000/hr) caps on the evaluate endpoint. Exponential backoff on auth endpoints. |
| CSP violation reporting | Live /api/csp-report endpoint capturing browser-side policy breaches. |
| Account deletion | GDPR Art. 17 — self-service deletion via dashboard with password re-auth; personal data is deleted immediately, and residual copies in encrypted backups roll off within 60 days. |
| Session invalidation | Changing your password, resetting it, or an admin suspension immediately invalidates all existing sessions (token-epoch bump); key rotation and password change require re-authentication. |
| Encryption at rest | Turso (libSQL) managed encryption at rest. API keys are generated with crypto.randomBytes, shown to you in your dashboard, and can be rotated or revoked instantly if exposed. |
| Logging & retention | Raw lookup IPs retained 7 days then reduced to a one-way hash; account data deleted immediately on request, with encrypted-backup roll-off within 60 days. |
For procurement teams
Self-serve, no email required: the security whitepaper (PDF), the Data Processing Agreement (PDF), and the sub-processor list with dated change log. Everything else below is available on request from [email protected]:
| Document | Notes |
|---|---|
| Data Processing Agreement (DPA) | Self-serve — UK GDPR / EU GDPR Article 28 aligned, binds on acceptance with no signature required. Standard Contractual Clauses / UK IDTA for international transfers and a countersigned copy available on request. |
| Master Services Agreement (MSA) | For customers who can't accept the click-through Terms. |
| Security questionnaires (SIG-Lite, CAIQ, bespoke) | Completed for your review within 5 business days of request; complex ones can be co-walked on a video call. |
| Penetration testing status | No third-party penetration test has been commissioned yet — we say so rather than imply otherwise. A responsible-disclosure program is active (see security.txt); this row will be updated when a pen-test is completed. |
| Sub-processor change notice subscription | 30-day advance notice via email for any new sub-processor that processes customer data, with right to object. |