Privacy Policy

For your account, billing, support, and the security of our own platform, we are the controller. For the personal data that happens to exist inside the systems you connect — database rows, repository contents, deployment configuration — you are the controller and we act as your processor under our Data Processing Addendum.

Contact for privacy matters: [email protected]. Postal: ZerwOne Network LLC, Privacy Office, United States.

• Account data — email, name, hashed password or OAuth identifier, workspace and role membership, authentication sessions.
• Onboarding data — role, company, primary goal, and any compliance frameworks you tell us you are working toward. Used to tailor the product; you can skip these fields.
• Operational data — projects, connected resources, check runs, findings, evidence records, proposed fixes, approvals, and an append-only audit log of agent tool calls.
• Integration data — encrypted OAuth tokens and installation identifiers for GitHub, Supabase, and Vercel, plus the metadata each integration returns.
• Billing data — plan, subscription status, invoices, and Stripe customer identifier. We never receive or store your full card number.
• Support and contact data — the messages you send us and the email address you send them from.
• Device and usage data — IP address, user agent, pages viewed, and approximate location derived from IP. Product analytics and error monitoring are collected only with your consent.
• Cookies — see the Cookie Policy. No advertising or cross-site tracking cookies.

This is the part that matters most for a security product, so here is exactly what happens.

• Database connection strings submitted for a one-off check are held for the active session and are not written to Sentrail's application database or logs. Persisted OAuth connections use encrypted provider credentials as described below.
• Stored provider credentials — OAuth access and refresh tokens — are encrypted at rest using envelope encryption with a key separate from the database, and are decrypted only in memory when a run needs them.
• Repository contents are fetched into an ephemeral, network-restricted analysis container that is destroyed when the run finishes. We do not keep a mirror of your repository.
• What we retain from a scan is the result, not the source: findings, the evidence for each finding (file path, line range, rule identifier, timestamps), and short redacted excerpts needed to explain the issue.
• Query results sampled during a database check are used to evaluate the check and are not stored beyond the evidence record for that finding.
• Secrets, tokens, passwords, and connection strings are redacted before anything is logged, stored as evidence, sent to an error monitoring service, or included in a model prompt.

LLM inference: redacted code excerpts, schema and configuration metadata, and finding text are sent to a model provider to triage findings and draft fixes. We use endpoints under the provider terms and configuration identified in our current subprocessor disclosures. Sentrail does not train its own models on customer data.

• To provide, operate, and maintain the Service, including running checks and drafting fixes you approve.
• To authenticate you, enforce plan entitlements and quotas, and prevent fraud or abuse.
• To secure and audit the Service, including investigating suspected unauthorized scanning.
• To bill you and keep the financial records the law requires.
• To answer your support requests and send operationally important notices.
• With your consent, to understand product usage and diagnose errors so we can improve.
• To comply with legal obligations and enforce our Terms.

• We do not sell personal information, and we do not share it for cross-context behavioural advertising.
• We do not use your code, findings, or data to train models.
• We do not use your data to build a threat-intelligence product or publish anything about your systems.
• We do not act on findings in your systems without your approval.

We share data with the subprocessors listed at sentrail.dev/subprocessors, each under a data protection agreement and only to the extent needed to deliver the Service. We also disclose information where required by law or valid legal process, or to protect rights, safety, and the security of the Service — narrowly, and with notice to you unless prohibited. If we are involved in a merger, acquisition, or asset sale, we will give notice before your information becomes subject to a different policy.

We operate primarily from the United States. If you use the Service from outside the U.S., your information is transferred there and to the regions where our subprocessors operate. For transfers of personal data from the EEA, UK, or Switzerland we rely on the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, as set out in our DPA, and we assess each transfer where required.

We maintain the technical and organisational measures listed in Annex II of our DPA: TLS in transit, encryption at rest, envelope-encrypted provider tokens, row-level security and role-based access control, ephemeral isolated scanner containers, secret redaction, human approval gates for production-changing actions, append-only audit logs, and dependency and secret scanning in continuous integration.

No system is perfectly secure and we cannot guarantee absolute security. To report a vulnerability in Sentrail, see our responsible disclosure policy.

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to processing of your personal information, to data portability, to withdraw consent, and to lodge a complaint with your supervisory authority. If you are in California, you may also request disclosure of the categories collected and shared, request deletion or correction, and opt out of sale or sharing — we do not sell or share personal information, so there is nothing to opt out of. We will not discriminate against you for exercising a right.

Email [email protected]. We verify requests against your account and respond within the statutory period (30 days under GDPR, 45 days under the CCPA, extendable where permitted). An authorised agent may submit a request with written proof of authority. For personal data inside a system you connected, contact the customer that controls it; if that is you, use your own tooling or ask us for processor assistance.

To change cookie and analytics consent: open cookie preferences.

The Service is for business use and is not directed to children under 16. We do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.

We will post any revised policy here with a new effective date and version. For material changes we will give reasonable advance notice by email or in-product before they take effect. Previous versions are available on request.