Sentinel Cloud
Privacy, Security & Terms
Last updated September 24, 2026. These policies describe how the hosted Sentinel Cloud service handles your data, how the platform protects itself, and the conditions under which it is provided. They mirror what the product actually does — the retention, redaction, and signing behavior below is enforced in code, not on a promise page.
Privacy policy
What we collect+
Account identity via GitHub OAuth, PR metadata (repo, branch, title), scan findings with evidence snippets, kill chains, reports, audit log entries, and billing/usage records.
What we never store+
Full repository contents, raw source files, or secret values. Secrets are matched and rendered as [REDACTED] in outputs; API tokens are stored as SHA-256 digests only.
Cloud retention+
Scan metadata is retained per plan (ENTERPRISE: 365 days). A cron purge removes unpinned scans and audit logs past each plan's retention; soft-deleted scans are purged after 30 days. Pinned scans are kept.
Offline ground-truth pipeline+
A separate SQLite store keeps a 14-day temporary buffer of scan results, human feedback, and PR outcomes for calibration. It stores only snippet hashes and repo hashes — no PII, no tokens, no file contents. Export runs before every purge, so history is preserved in the exported JSON.
Deletion+
Deleting your account removes your scans and data. Retention purge is fail-closed: if the purge query fails, it surfaces an alert instead of silently skipping.
Third parties+
GitHub (OAuth and pull-request webhooks), PayPal (subscriptions), Vercel and Railway (hosting), Supabase (Postgres + auth). We do not sell or share personal data for advertising.
Security policy
Report integrity
Reports are signed with HMAC-SHA256; every audit entry chains into a SHA-256 tamper-evident log.
Evidence encryption
Evidence snippets are encrypted with AES-256-GCM before persistence.
Access model
Cloud is a hosted multi-tenant service. Tenant isolation is enforced at the API boundary; admin access requires a read-only Postgres role plus signed tokens.
Secrets handling
Secret values are never persisted in plaintext; they are matched in-memory, redacted, and stored as digests only.
Fail-closed operations
Retention purge and downgrade enforcement fail closed: an error surfaces an alert rather than silently skipping the action.
Responsible disclosure
If you believe you found a vulnerability, contact the maintainer directly. Do not open a public issue for exploit details.
Limits
No product can claim absolute security. The detection engine is deterministic, scores what code can do from a diff, and does not predict post-compromise behavior.
API keys, groups & RBAC access control
API Key ScopesRBAC
API keys provide scoped access across five distinct capabilities: "consumer" (full scanning and CLI/Oracle execution), "scan" (remote manifest analysis), "lookup" (threat intelligence queries), "contribute" (reputation telemetry), and "oracle" (WebAuthn merge gating authority).
Cryptographic Storage & Zero PlaintextRBAC
Raw API keys are generated as high-entropy cryptographically random strings displayed exactly once upon creation. Only their SHA-256 hash digests are persisted in the PostgreSQL vault. Stolen database dumps cannot recover functional credentials.
Expiration, Rotation & RevocationRBAC
All tokens enforce mandatory TTL options (30, 90, 180, or 365 days). Maintainers can perform immediate one-click revocations via the Settings panel, invalidating tokens across all active CLI and CI/CD pipelines instantaneously.
Group Roles & Granular Permissions (RBAC)RBAC
Organization groups implement strict Role-Based Access Control: OWNER (full administrative and billing governance), MAINTAINER (credential generation and repository binding), MEMBER (read/scan execution), and AUDITOR (read-only compliance reporting).
Tenant Isolation via Row-Level Security (RLS)RBAC
Every repository, scan report, finding, and activity event is isolated at the database engine level using Supabase PostgreSQL RLS policies tied to authenticated user and group IDs. No tenant can view or mutate another tenant's data.
Administrative View SafeguardsRBAC
Administrative capabilities (e.g., plan adjustments, audit log inspections) are cryptographically restricted to server-side environment identities using constant-time timing-safe string comparison. No client-side manipulation can elevate privileges.
Terms of service
Service+
Sentinel Cloud is a hosted security-analysis platform. You access it through your GitHub account via OAuth and, when enabled, the Sentinel Cloud GitHub App may receive pull-request events for repositories you install it on.
Acceptable use+
You may use the platform to scan repositories you own or are authorized to scan. You may not attempt to break tenant isolation, exfiltrate another tenant's data, probe the API for tokens or secrets, or use results to attack third parties.
Accounts+
You are responsible for the GitHub account you use and for what is deployed under it. Access tokens are your responsibility; revoke them from the settings page if they leak. Free and paid plans are described on the pricing page and enforced by the billing system.
Payments & billing+
Paid plans are billed through PayPal. Subscriptions are recurring until cancelled from the billing page. Downgrades and cancellations take effect as described in the product; failed payments trigger automatic plan enforcement rather than silent gaps.
Your data+
You retain ownership of the code you scan. The platform stores only scan metadata and evidence snippets (see the privacy policy), never full repository contents. It does not relicense or redistribute your repositories.
AI agents & automation+
The detection engine is deterministic software, not an AI agent; your code is evaluated against static rules and correlation algorithms. You are responsible for what your own agents, code and automation do with the results.
Availability+
The service is provided as-is, with best-effort availability (hosted on Vercel and Railway). There is no uptime SLA on the free tier; paid tiers receive the availability described in their plan.
Limitation of liability+
To the maximum extent permitted by law, the maintainer is not liable for indirect or consequential damages, including lost data, profits or security incidents resulting from your use or misuse of the platform.
Changes+
These terms may be updated to reflect new features or legal requirements. Material changes are announced through the product; continued use after a change constitutes acceptance.
Termination+
You may delete your account and data at any time. The maintainer may suspend accounts that violate these terms or abuse the platform.
Questions about data handling: contact the maintainer before signing up.
← Back to Cloud