Privacy Policy

1. What we collect

Account data: name, email address, and authentication records when you create an account or are invited to a workspace.

Content you submit for scanning: source code, dependency manifests, configurations, container images, and target URLs you provide. This content is processed to produce findings; findings and scan metadata are stored in your workspace so you can review them.

Operational data: logs and metrics needed to run the Service securely. Our logging practice is to exclude personal data and scanned content from logs and telemetry.

2. What we use it for

To provide the Service: run the scans you request, enrich findings with vulnerability intelligence, show results to your workspace, and secure and improve the platform. We do not sell personal data, and we do not use your code to train models.

3. Processors

We use a small set of infrastructure providers to operate the Service (cloud hosting, managed databases, email delivery, and — for optional finding-explanation features — AI enrichment providers). Each processes data only to provide their function to us. A named subprocessor list will be published on this page before general availability.

4. Retention and deletion

Scan results stay in your workspace until you delete them or your workspace. To request deletion of your account or personal data, email privacy@sentrasec.ai. Requests are currently fulfilled by our team rather than an automated workflow; we aim to complete them within 30 days and will confirm when done.

5. Your rights

Depending on your jurisdiction you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Exercise any of these via privacy@sentrasec.ai; we respond to every request.

6. Cookies

The Service uses strictly necessary cookies for login sessions. We do not use advertising or cross-site tracking cookies.

7. Security

Data is encrypted in transit; access to production systems is restricted and audited. Details of our security program, including independent verification as it lands, are published on our trust page. No system is perfectly secure; report suspected issues to security@sentrasec.ai.

Credentials you connect to the Service, such as source-control tokens, cloud keys, integration tokens, webhook URLs and DAST login details, are encrypted at rest with AES-256-GCM before they are written to our database. Each value is bound to its workspace, so it cannot be read in another workspace. The encryption key is held separately in our hosting environment, not in the database. We decrypt a credential only to use it on your behalf. We support rotating the encryption key.

8. Changes and contact

Material changes to this policy will be announced on this page with a new date. Contact for anything privacy-related: privacy@sentrasec.ai.