Legal
Privacy policy
What we collect, why we collect it, who processes it, and what never leaves your environment.
Who we are
In these policies, “Sentrasec”, “we” and “us” mean Sentrasec. You can reach us at legal@sentrasec.ai or through the contact page.
What we collect
- Account data: name, work email, organisation and sign-in information, used to run your account.
- Enquiries: the email, phone number, company and message you send through the contact form, used to reply to you.
- Payment data: payments are handled by Razorpay. We receive the payment and order references, the amount, and the contact details you enter at checkout. We never receive or store card numbers, UPI PINs or bank credentials.
- Scan data: the code, dependency manifests, URLs and results needed to run the scans you ask for, and the findings, triage decisions and plans they produce.
- Usage and logs: operational logs and page analytics used to keep the service running, secure and fast.
Your source code
In self-hosted deployments, scanning runs on your infrastructure and your source code is not sent to us. On the hosted service, code you submit is processed to run the scan you requested and is not kept longer than that requires. Findings are stored in the workspace they belong to.
How we use it
We use your data to provide and secure the service, process payments, reply to you, and meet legal obligations. We do not sell personal data, and we do not use your code to train AI models.
Who processes it
We use service providers to run Sentrasec: Razorpay for payments, Resend for email, and hosting and monitoring providers for the website and app. Each processes data only on our instructions.
Cookies and analytics
The website uses privacy-friendly analytics and performance monitoring to understand traffic and fix problems. The app uses cookies needed to keep you signed in. We do not use advertising cookies.
How long we keep it
Account and workspace data is kept while your account is active and deleted after you close it, except where the law requires us to keep records such as invoices and payment references.
Your rights
You can ask for a copy of your personal data, ask us to correct or delete it, or object to how we use it. Write to privacy@sentrasec.ai and we will respond within 30 days.
Security
Data is encrypted in transit, access is limited to people who need it, and secrets found by scans are stored as fingerprints, not as the secret itself.
Credentials you connect to Sentrasec, such as source-control tokens, cloud keys, integration tokens, webhook URLs and DAST login details, are encrypted at rest with AES-256-GCM before they are written to our database. Each value is bound to its workspace, so it cannot be read in another workspace. The encryption key is held separately in our hosting environment, not in the database. We decrypt a credential only to use it on your behalf, and we support rotating the encryption key.
Changes
We will update this page if our practices change. The date at the top shows the latest version.