Summary
SentraLens is a multi-tenant security platform. Every piece of data — assets, findings, scans, phishing campaigns, AI enrichment output — is strictly scoped to the tenant that owns it. We never mix tenant data for analytics, model training or marketing.
Data We Collect
- Account data — name, work email, role, hashed authentication credentials, multi-factor authentication secrets. Used to authenticate you and route notifications.
- Asset data — domains, subdomains, IP addresses, open ports, detected technologies, and OSINT such as employee email addresses harvested from public sources. Used to run scans you authorise.
- Scan results — findings, evidence snippets, CVE references, screenshots where applicable. Used to surface and prioritise security issues.
- Scan credentials — if you supply SSH keys, Windows credentials or API tokens for authenticated internal scans, they are encrypted at rest with a per-deployment Fernet envelope key. They are decrypted only in-memory at scan execution time and never logged.
- Phishing campaign data — campaign templates, target employee lists, click/open/report metrics. Used exclusively to deliver the phishing simulation you configured.
- Audit log data — who did what, when, from which IP, with which result. Retained for compliance and incident investigation.
How We Use This Data
Collected data is used solely to deliver the SentraLens service to your tenant: running scans, surfacing findings, generating reports, sending notifications, and producing compliance evidence. We do not use your data for targeted advertising and we do not sell it to any third party.
AI Processing
The optional AI module (internally code-named “Genie”) processes finding metadata to generate human-readable explanations and remediation guidance. Prompts and responses stay inside your tenant boundary and are never used to train third-party models. A four-layer guardrail pipeline — input sanitisation, policy filter, output review, and audit logging — gates every AI invocation. This is documented separately under our ISO 42001 readiness programme.
When the AI module is enabled on your tenant, your tenant administrator can disable it entirely from Settings → AI Configuration at any time.
Data Sharing & Sub-processors
We share data only with sub-processors strictly required to operate the platform: infrastructure hosting, transactional email delivery, OIDC identity providers, and (when enabled) third-party large-language-model providers for AI enrichment. A current list of sub-processors is maintained in our trust centre and is available to tenant admins on request at [email protected].
Your Rights (GDPR and comparable regimes)
If you are a resident of the European Economic Area, the United Kingdom, the UAE, or any jurisdiction with comparable data-protection law, you have the right to:
- access the personal data we hold about you,
- correct inaccuracies in your personal data,
- request deletion of your personal data where retention is not legally required,
- export your data in a machine-readable format,
- withdraw consent where processing relies on consent,
- lodge a complaint with your local data-protection authority.
To exercise any of these rights, write to [email protected]. We honour verified requests within 30 days unless retention is legally required or the request is manifestly unfounded.
Retention
Scan evidence and findings are retained according to the retention policy configured for your tenant under Settings → General. The default is 12 months. Audit logs are retained for a minimum of 12 months to meet ISO 27001 and SOC 2 requirements. Tenant data is purged within 30 days of contract termination unless a longer retention has been agreed.
Breach Notification
In the unlikely event of a confirmed security breach affecting your tenant data, we will notify the tenant administrator within 72 hours of confirmation. The notification will include a written summary of scope, impact, data categories affected, and remediation steps already taken or planned.
Transfers Outside Your Region
Where data must be transferred outside your region to deliver the service (for example to a sub-processor), we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.
Cookies & Tracking
The SentraLens application uses strictly necessary cookies for session management and multi-factor authentication. We do not use third-party analytics or advertising cookies inside the authenticated product. The public marketing site (lens.sentrashield.com) may use privacy-preserving analytics to measure page performance.
Contact the Data Protection Officer
For any privacy-related question or concern, contact [email protected]. We aim to respond within two business days.