Trust
We read your code.Then we forget it.
For a privacy company, this page is the product. This is how Sentinel is built: what runs where, what is encrypted, what is logged, what we keep, and who else touches it.
Last reviewed 2026-10-13. We update this page whenever the way we handle your code changes.
How it’s built
Four promises, and the mechanism behind each.
Isolation
Every scan gets its own machine, and the machine has no way out.
- A fresh Firecracker microVM per scan, started on Vercel Sandbox with a deny-all network policy and no persistence.
- Archive extraction is guarded against zip-slip, symlink escapes, executable bits, runaway file counts, oversize files and compression bombs.
- Code is parsed, never executed. No install scripts, no build, no tests.
- If a scan ever runs without the sandbox, for example a local development runner, the report says so on its face.
Encryption
Results are sealed to your organization’s public key before they leave the machine.
- Anything derived from your code is encrypted inside the sandbox to your org’s public key.
- The scan machine and the coordinator hold write access only. The web application is the only part that can read, and only through the vault.
- Secrets are redacted to a short prefix before findings metadata is stored.
- Transport uses TLS with HSTS, and the site ships the same security headers Sentinel checks for.
The ledger
Every read of your results is written down first.
- Opening a sealed result calls the vault, which writes a signed, tamper-evident ledger entry before decrypting. No log, no decrypt.
- Your admins and your auditor can see who read what, and when.
- Badge issuance is audit-logged, and the badge number is minted only by the owner role.
- The public verification pages read a narrow, security-definer lookup, never your organization’s tables.
Retention
We keep the answer, not the question.
- Source and archive: overwritten and deleted inside the machine at the end of the scan; the upload is destroyed from storage.
- Findings metadata (rule, file path, line, severity, mapping): kept so your history and your tier stay provable.
- Sealed results: kept encrypted to your key, until you ask us to crypto-shred them.
- Ledger entries: kept, because a log you can delete is not a log.
What data we hold
An honest inventory.
Subprocessors
Who else touches it, and why.
Responsible disclosure
Found something? Tell us.
Email team@gigahertzcompany.com with what you found and how to reproduce it. We read every report, reply to every report, and credit researchers who want credit. Please test only your own accounts and do not access or modify other customers’ data.
Sentinel scans only what its owner has authorized. Scans of live sites require domain-ownership proof and a signed authorization from the company that controls the hostnames; a program or agency that pays for scans cannot consent for someone else.