This policy explains what data SentinelTI (“we,” “us”) collects when you use the SentinelTI platform (the “Service”), how we use it, who we share it with, and the choices you have. By creating an account or otherwise using the Service, you agree to this policy.
1. Data we collect
- Account data — name, email address, password (hashed, never stored in plain text), organization/tenant name, and role.
- Threat intelligence data — indicators of compromise (IPs, domains, URLs, file hashes) you submit, import, or configure the Service to fetch on your behalf, plus enrichment results, ML scores, and analyst annotations (tags, notes) attached to them.
- Asset data — internal CIDR ranges or asset identifiers you register for correlation, at your own election.
- Configuration data — SIEM endpoints, webhook URLs, and API keys you configure for integrations. Secrets (SIEM tokens, API keys) are stored encrypted and are never included in audit logs or exports.
- Usage and audit data — authentication events, exports, and account changes, recorded for security and support purposes (see Section 4).
- Payment data — billing is handled by Paddle.com Market Ltd, which acts as Merchant of Record and is the seller of record for your purchase. We never see or store your card number; we receive only a customer/subscription identifier and billing status from Paddle.
- Technical data — IP address, browser user agent, and timestamps, collected automatically for security (e.g. audit trail, rate limiting) and reliability. The IP address and user agent recorded at sign-up, and at your most recent sign-in, are also stored on your account record itself so we can investigate fraudulent sign-ups and payment disputes. We keep only the single most recent sign-in — each one overwrites the last — not a history of every session.
2. How we use your data
- To operate the Service: fetching, scoring, enriching, and displaying threat intelligence for your tenant.
- To authenticate you and enforce role-based access and tenant isolation.
- To process payments and manage your subscription.
- To send transactional email (account verification, password reset, scheduled threat reports you opt into, invite emails).
- To maintain a security audit trail of who accessed or changed what, within your own tenant.
- To provide support, including AI-assisted support chat you initiate.
- To detect abuse, enforce plan limits, and keep the Service secure.
We do not sell your data. We do not use your threat intelligence data to train models shared across tenants beyond the aggregate, non-attributable statistics needed to operate our own scoring pipeline.
3. Third parties we share data with
To enrich indicators you submit or fetch, SentinelTI queries the following third-party threat intelligence and infrastructure providers. When enrichment runs, the relevant indicator (e.g. an IP, domain, or hash — never your account credentials or unrelated tenant data) is sent to:
AbuseIPDB, VirusTotal, GreyNoise, AlienVault OTX, URLhaus, MalwareBazaar, and the other public feeds and enrichment sources documented in your dashboard's Integrations page.
We also use the following infrastructure and service providers, each under their own privacy terms: Paddle (payments, as Merchant of Record), Resend (transactional email), Railway and MongoDB (application hosting and database), and Vercel (frontend hosting and analytics).
4. Data retention
- Security audit log entries are retained for 365 days.
- The sign-up and most-recent-sign-in IP address and user agent held on your account record are retained for the life of the account and deleted with it (Section 6). Older sign-in IPs are not kept.
- Alert history is retained for 90 days.
- Threat indicator retention depends on your plan's storage cap and risk tier; HIGH-risk indicators are retained up to 730 days by default before being eligible for pruning.
- Account data is retained for as long as your account is active, and for a reasonable period after cancellation to allow reactivation, unless you request earlier deletion (Section 6).
5. Security
Passwords are hashed, not stored in plain text. Data in transit is encrypted via TLS. Access to your tenant's data is enforced through role-based access control and re-verified on every request. Administrative actions and data exports are recorded in an append-only-style audit log scoped to your tenant. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
6. Your rights
You may request access to, correction of, export of, or deletion of your personal data and tenant data by contacting us (Section 9). We will respond within a reasonable timeframe. Deleting your account removes your account data; some records may be retained where we have a legal or security obligation to do so (e.g. billing records, security audit logs tied to fraud prevention).
7. Cookies
We use essential cookies/local storage to keep you signed in and remember your interface preferences (e.g. theme). We use privacy-respecting analytics to understand aggregate product usage; this does not track you across other websites.
8. Children's privacy
The Service is intended for business use by security professionals and is not directed at, or knowingly used by, individuals under 18.
9. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above, and where appropriate, by notifying account owners by email.