Privacy Policy

Summary

Sentinel Shield monitors Laravel applications for signs of compromise. To do that, the agent you install sends us information about files and database rows that matched a threat pattern. We do not receive a copy of your codebase or your database.

What the agent sends us

Each scan transmits:

• Server metadata — hostname, server IP address, PHP version, Laravel version, and agent version.
• Scan metrics — number of files scanned, scan duration, which detectors ran, and start and end times.
• Threat records — for each finding: the file path, the detector that flagged it, a severity and category, a description, and a CVSS score.
• Matched excerpts — the portion of the file or database value that matched a threat pattern. For database findings this is capped at 100 characters and includes the table name, column name, and row identifier.
• Response events — when a file is quarantined or restored, or maintenance mode is toggled, including the file path, its SHA-256 hash, and its size.

Matched excerpts are the one field that can contain your own content. A pattern that fires on a legitimate file will send the matching fragment of that file. If that is unacceptable for your application, run sentinel:scan --no-response without dashboard credentials configured, and the agent reports nothing to us.

What we never receive

• Full file contents, or any file that did not match a pattern.
• Your database, beyond the capped excerpts described above.
• Your environment file, credentials, or API keys for other services.
• Your application's end-user data, unless it happens to sit in a database column you explicitly configured for scanning and it matches a threat pattern.

Account information

When you register we store your name, email address, username, and password hash. If you subscribe to a paid plan, payment is processed by Stripe; we store the resulting subscription record but never see or store your card number.

How long we keep it

Scan history is retained for the window included in your plan — 7 days on Scout, 30 days on Guardian, and 90 days on Fortress. Account activity logs are retained for 90 days. Account records are kept until you delete your account.

Who we share it with

We do not sell your data. We share it only with the providers required to run the service: Stripe for payments, our hosting provider for infrastructure, and our email provider for transactional messages and alerts. If you configure a webhook or Slack alert, threat details are sent to the destination you specify.

Your choices

• Export everything we hold about you from Settings → Export.
• Delete your account from Settings → Account Deletion. Deletion is permanent once the grace period ends.
• Revoke a site's API key at any time to stop that server reporting.
• Adjust what we email you from Settings → Notifications.

Contact

Questions about this policy, or a request relating to your data, can go to [email protected].