Sentinel/Black Llama
Check my code →

Legal

Privacy Policy.

We read your code once, keep the answers encrypted, and keep as little as we can. This is what we collect, who else touches it, and how to get it deleted.

01

Who we are

Sentinel by Black Llama is operated by Black Llama. This policy covers the Sentinel website and web application.

  • Questions about this policy or your data: team@gigahertzcompany.com. A person replies within one business day.
02

What we collect

Only what the service needs to run, bill you and prove your results.

  • Account: your work email address, and the company name you give us.
  • Code: the zip or repository you ask us to scan. It is read once in a sealed sandbox with the network denied, and deleted when the scan ends. We do not keep a copy.
  • Findings: what the scan derives from your code (rule, file path, line, severity, control mapping, redacted evidence). Secrets are cut to a short prefix, and detailed results are stored encrypted to your organization’s key.
  • Billing: handled by Stripe. We receive the plan, status and a customer reference, not your card number.
  • Usage: sign-in events, audit-log entries (who opened which result, and when) and standard server logs.
03

The data inventory

The same table you can read on our Security page.

Your source codeNoRead in the sandbox for minutes, then shredded.
Redacted findings metadataYesRule id, file, line, severity, control mapping. Secrets cut to a prefix.
Sealed result blobYes, encryptedOpens only with your organization’s key, and every open is logged.
Access ledgerYesWho read what and when. Append-only.
Badge recordsYes, publicOrganization name, tier, period, expiry, rules hash.
Account and billing contactsYesNames and work emails you give us.
Cloud credentialsNot after the scanRead-only, created by you, used for the run.
04

How we use it

  • To run scans, produce reports, issue and verify badges, and keep your history.
  • To send transactional email: sign-in links, scan results, receipts and billing notices, and reminders you can switch off in Settings.
  • To secure the service, investigate abuse and meet legal obligations.
  • We do not sell your data, do not use your code or findings to train models, and do not show advertising.
05

Who else touches it

Our subprocessors, and what each does.

VercelApplication hosting and deliveryServes the website and the web application.
Vercel SandboxScan isolationRuns each scan in a disposable microVM with the network denied.
NeonDatabaseStores findings metadata, sealed blobs, the access ledger and badge records.
ResendTransactional emailDelivers sign-in links, scan results and billing notices to the addresses you give us.
StripePaymentsTakes payment and issues receipts. Card details never reach Sentinel.
GitHubCode source (optional)Only if you connect it: we read the repositories you pick, read-only, for the scan.
06

Retention

  • Source code and archives: deleted at the end of each scan. If a scan fails, the upload is deleted too.
  • Findings metadata and sealed results: kept while your account is active so your history and tier stay provable, until you ask us to delete them.
  • Badge records: public by design (organization name, tier, period, expiry) and kept so a buyer can verify them later.
  • Access ledger and audit log: kept, because a log you can delete is not a log.
  • Account and billing records: kept while your account is active and as long as the law requires for tax and accounting after that.
07

Your rights

Wherever you live, you can ask us to do any of these.

  • Access a copy of the personal data we hold about you.
  • Correct it, or delete it. Deleting an organization’s results is done by destroying its encryption key (crypto-shredding).
  • Export your reports and findings.
  • Object to or restrict a use, and withdraw consent where we rely on it.
  • Email team@gigahertzcompany.com from the address on the account. We reply within one business day and complete requests within the time the law allows. If you are not satisfied, you may complain to your local data-protection authority.
08

Security

  • A fresh sandbox per scan, results encrypted before they leave it, every read logged, TLS with HSTS in transit. The full description is on the Security page.
  • If we learn of a breach affecting your data, we will tell you without undue delay.
09

Changes and contact

  • We will post changes here and, for material changes, email account owners before they take effect.
  • Contact: team@gigahertzcompany.com.

Draft v1 — under review by counsel; last updated October 13, 2026