Who we are
Sentrint is operated by Gourab Dasgupta, a sole proprietor based in Kolkata, West Bengal, India. For the personal data you give us about yourself, we act as the Data Fiduciary and you are the Data Principal. Where your code contains personal data about other people, you are the Data Fiduciary and we simply process it on your instructions to run the scan.
What we access
When you sign in with GitHub, we request read-only access to the repository you choose to scan. We never request write access, and we never read repositories you haven't selected.
How we handle your code
- Your source is fetched into an ephemeral, isolated environment only for the duration of a scan.
- It is deleted the moment the scan finishes. We do not retain, back up, or train any model on your repository.
- We keep only scan output: findings (rule, file path, line, severity), your security score, and the commit SHA scanned, so you can see your history.
- For critical and high findings only, we also keep a short code excerpt, about ten lines either side of the finding, because that is what builds your fix prompt after the scan files are gone. We never keep an excerpt for a leaked credential or for a lockfile, and excerpts are deleted along with the scan.
One exception you should know about: checking whether a leaked key is still live
When we find something that looks like a credential in your code, we check whether it actually still works. A revoked key is a very different emergency from a live one, and we don't want to make you panic-rotate a key that was already dead.
The only way to know is to ask the service that issued it. So for a suspected credential, our scanner sends that candidate credential value to the provider it appears to belong to, such as AWS, Stripe or GitHub, purely to ask "is this still valid?" We do not send your code, and we never store the credential value itself. If it comes back live, we mark it critical; if not, it stays informational.
We're calling this out plainly because it is the one place where something from your repository is sent to a company that isn't in our provider list below. This check runs on every scan, including scans on the free plan, and it cannot be switched off. If you would rather it never happened, don't scan a repository whose secrets you are not willing to have verified. Either way, treat any credential that has been committed to git as compromised and rotate it.
Account data we store
From your GitHub profile we store your GitHub ID, username, email and avatar URL, used to identify your account and send essential account communication. Nothing more. We never store your GitHub password; access tokens are held encrypted, solely to operate the Service.
We may also maintain access logs, audit logs, authentication logs and other security records to operate, secure and improve the Service, investigate fraud, abuse or security incidents, comply with applicable law, and enforce our Terms of Service.
Why we process your data & your consent
By signing in and accepting our Terms, you give your free, specific, informed and unambiguous consent (Section 6, DPDP Act) for us to process your personal data to: create and secure your account; run scans and produce reports; take payment; provide support; and keep the Service secure.
You can withdraw that consent at any time. Today the route is deleting your account in Settings, or writing to our Grievance Officer below if you want something narrower withdrawn. Withdrawing does not undo processing already carried out lawfully. Alongside consent, we may process personal data where it is reasonably necessary to provide and secure the Service, comply with applicable law, prevent fraud or abuse, protect our rights, or enforce our Terms of Service.
Who we share data with
We share the minimum necessary data with a small set of service providers. Most are described here by category; your data export in Settings names every one of them.
- GitHub: sign-in and repository access.
- An AI processing provider: to generate fix suggestions and explanations from relevant code snippets and findings, routed only to zero-retention endpoints and not used to train third-party models.
- A payment processor and merchant of record: to take payment. They are the legal seller of record and issue your invoice. We never see or store your full card details.
- An error-monitoring provider: diagnostic logs, with personal identifiers disabled.
- A cloud hosting and infrastructure provider: to run and store the Service.
- PostHog, our product-analytics provider: which pages and actions you use, and sampled session recordings with every typed input masked, so we can see where the product is confusing. No email, username or raw IP address. This runs only on signed-in pages. We deliberately do not track anyone on the marketing, legal or signed-out pages.
We do not sell, rent, license or otherwise monetise your personal data. We do not use it for behavioural advertising, cross-context behavioural advertising, cross-site tracking or any similar advertising or marketing purpose. The product analytics described above exist so we can see how the app itself is used, and nothing more.
If you're outside India
Sentrint is run from India, so Indian law, principally the DPDP Act, is the law we answer to. You are welcome to use it from anywhere, and we don't run a second-class version of privacy for people whose country doesn't force our hand:
- The rights on this page are for everyone. Access, correction, erasure and grievance work the same whether you're in Bengaluru, Berlin or Boston, and most are buttons in Settings rather than requests you have to make.
- If you're in the EU, UK or another region with its own data law (GDPR and its relatives), write to our Grievance Officer below with what you want and we'll do it. We are being straight with you rather than posting a compliance badge: we have not appointed an EU representative and we are not claiming a formal GDPR certification. What we can promise is that the substance, meaning your access, correction and deletion, is honoured.
- Your data leaves India, because our providers are global (see the list above). Under Indian law we rely on Section 16 of the DPDP Act and apply reasonable safeguards, and we will not transfer data to a country the Indian government restricts.
- You choose the currency you pay in. Rupee and dollar prices are separate price points rather than a live conversion, so we bill you in whichever one you select. Your card issuer may add its own charges on top.
Cookies
We use a single, signed session cookie to keep you logged in. No third-party advertising or tracking cookies. Our analytics service keeps a small identifier in your browser's local storage, not a cookie, and only on signed-in pages.
Data retention & deletion
We keep your account data and scan output while your account is active. When you delete your account, we delete or anonymise your records within a reasonable period (targeted at 30 days), except where the law requires us to keep something. Your repository is never retained after a scan. It is cloned into an isolated job and deleted when that job exits. There is one exception, and it is worth stating precisely: where a scan finds a critical or high severity issue in your own code, we save a short excerpt of that code, up to ten lines either side of the line concerned, so that the fix guidance for that finding can be rebuilt later without asking you to hand the file over again. No excerpt is ever taken from a finding that exposed a secret. Excerpts are deleted automatically after 30 days, and you can erase the ones we hold at any time from Settings. Export anything you want to keep before deleting.
How we protect your data
We apply reasonable security safeguards: encrypted tokens, sandboxed scanning, and access controls. No method of transmission or storage is ever completely secure, but we work to keep the data we hold to a minimum.
If something goes wrong
In the event of a personal data breach, we will notify the Data Protection Board of India and affected users in the manner and within the timelines required by the DPDP Act and its rules.
Your rights
As a Data Principal under the DPDP Act, you can:
- Access a summary of the personal data we hold about you;
- Correct, complete or update it;
- Erase it (by deleting your account);
- Nominate another person to exercise your rights if you die or become incapacitated; and
- Raise a grievance with us (see below).
These are buttons, not promises. In Settings you can:
- Download everything we hold as a JSON file, under Privacy & data: profile, every scan and finding, usage, payments, support messages, and the named list of companies your data passes through. No request, no waiting on us.
- Correct the address we reach you at, under Account, which matters if GitHub keeps your email private.
- Delete your account, under Danger zone, which erases your data and immediately cancels any subscription. We retain invoices, payment records and related financial information for the period required by applicable tax, accounting and legal obligations.
- Sign out of every device at once, under Security.
Nomination, and anything else above, goes through the Grievance Officer below.
Children
Sentrint is not directed at children. You must be at least 18 to use it, and we do not knowingly create accounts for, or process the data of, anyone under 18.
Name: Gourab Dasgupta
Email: [email protected]
Based in: Kolkata, West Bengal, India
We reply to complaints within 2-3 business days and aim to resolve them within 30 days.
If we don't resolve your grievance to your satisfaction, you have the right to complain to the Data Protection Board of India under the DPDP Act.
Legal disclosures
We may disclose your personal data where required by applicable law, court order or a lawful request from a governmental, regulatory or law enforcement authority, or where reasonably necessary to enforce our Terms of Service, investigate fraud or security incidents, or protect the rights, safety or security of Sentrint, our users or others.
Changes to this Privacy Policy
We may amend or update this Privacy Policy from time to time to reflect changes in our Service, applicable law, regulatory requirements or business practices. The updated version will be published on this page together with its effective date and supersedes all prior versions. Where required by applicable law, we will give you additional notice or obtain your consent before any material change takes effect. Continuing to use the Service after the effective date of a revised Privacy Policy means you accept it.