For startups, engineering teams and agencies
Privacy evidence from thecode you already ship.
Buyers, security reviews and your own users want to know where personal data goes. Sentinel answers from the code: a sealed scan, findings grouped by privacy risk, a monthly streak, and results sealed to your key. It is pre-SOC 2 readiness work, so the history helps when you start an audit, but it does not replace one.
Sound familiar?
The problem, plainly.
Every review asks where personal data goes
You know roughly. Nobody has checked the logs, the analytics calls and the AI prompts line by line.
Your compliance platform runs the checklist
It asks whether you have a policy. It doesn’t read your code for personal data.
Your code in someone else’s cloud
Most scanners keep a copy. You don’t know who can read it.
Taint-traced and cross-checked across tools; disputed findings are labelled, never hidden.
A fresh microVM per scan, no network, source shredded after, results sealed to your key, every read logged.
The same rules on every project and every handoff, with a dated badge your buyers and clients can check.
How a scan goes
Four steps, the way you’ll actually do it.
Scope the code
Pick the repos, set the schedule, and name who can open results. Your org key is generated for you.
Month one: baseline and Bronze
The first scans give you findings grouped by privacy risk, each with a fix. Fix, re-scan, earn Bronze.
Months two to four: stay clean
Regressions are flagged before they cost you a tier. Silver, Gold, then Platinum, each on a dated page buyers can open.
Hand it on
Show the badge in security reviews and client handoffs. When you start SOC 2, the history is ready for your auditor to sample.
Sample findings
What a first scan tends to turn up.
Each row names the rule that finds it. What we check →
Illustrative month-one result for a seed-stage B2B codebase.
The plan that fits
Ten scans a month covers most teams. Bronze in month one, Platinum in four.
Recommended
Bronze to Platinum in four months.
per month · 6-month term
- 10 scans a month across your repos, cloud and site
- Bronze in month one, then Silver, Gold, Platinum
- Live badge on your site that updates with your status
- Evidence binder at Platinum, for when you start a SOC 2 audit
- Continuous checks: regressions flagged before they cost you a tier
$299 × 6 = $1,794
60 scans, about $29.90 each, four months to Platinum plus two to hold it.
Other plans: Bronze Scan $499, Sentinel for Programs $250. Compare all →
Privacy-Ready badges describe automated code scans for the stated period and scope. Not an audit, attestation or SOC 2 report; SOC 2 reports come only from licensed CPA firms.
Questions
Asked by software teams.
Will a buyer accept the badge instead of a SOC 2 report?
Treat it as evidence, not a substitute. It tells a reviewer a dated scan history exists and gives them a page to check. A SOC 2 report can only come from a licensed CPA firm, and we say so on every badge.
How do you handle false positives?
By showing how sure we are. Corroborated, single-source and disputed are different labels, the tool behind each finding is named, and the newest privacy rules are marked Beta while we tune them.
Who can read our results?
Your org key opens them, through the vault, and every open is written to the ledger first. The scan machine can write but never read.
We are an agency. Who is the badge issued to?
The organization the scan was run for. Agree up front whether that is you or the client; either way the verify page names it.
Can we export evidence to Vanta or Drata?
Not yet. Evidence export is Planned, not built. Today you can share the report and the badge’s verify page.