SENTIX01Who we are
SENTIX is operated by SENTIX Security Private Limited, a company incorporated in India with its registered office in New Delhi ("SENTIX", "we", "us"). SENTIX is an AI security analyst: software that monitors servers, connects security events into investigations and explains them in plain language.
This policy covers the SENTIX platform, the SENTIX agent installed on servers, and our website sentix.in.
02Our role with your data
Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"):
- For data from your servers, you (our customer) decide what is monitored and why. You are the Data Fiduciary, and SENTIX processes that data on your behalf as a Data Processor, to provide the service and, unless you opt out, to improve our models with de-identified data, as set out in our agreement with you.
- For account and website data (for example, your name and business email when you sign up or contact us), SENTIX is the Data Fiduciary.
03Data we collect
From your servers, through the SENTIX agent
| Category | Examples |
|---|---|
| System health | Hostname, the agent's local IP address, CPU and memory use, disk usage, uptime |
| Security events | Triggered detection rules (such as an unexpected shell or a sensitive file read), process names and IDs, command-line arguments, file paths |
| Network activity | Source and destination IP addresses and ports of connections linked to a security event |
| Operating system users | The system account linked to an event, such as root or a named login |
We do not collect the contents of your databases or files, or your end customers' names, addresses, phone numbers or payment details.
Some technical data can relate to a person. A server login may match an employee's name, IP addresses can be linked to people, and a command typed on a server may contain text a person entered. We treat all such data as personal data and protect it accordingly.
From you directly
- Account data: name, business email, organisation name and the role of people who use the SENTIX dashboard.
- Enquiries: details you share when you contact us or request a pilot: name, role, work email, phone, company, website, industry, server count, operating systems, hosting, security concerns and any message you write. The pilot form is processed by Formspree; see section 9.
- Billing data (when billing starts): handled by a payment processor; see section 9.
04How we use data
- To detect, investigate and explain security threats on your servers, and to show you findings and reports.
- To carry out response actions that you have approved.
- To run, secure, maintain and improve the reliability of the service for you.
- To improve SENTIX's own detection models using de-identified data, as explained in section 5. You can opt out.
- To manage your account, provide support and send service and security notices.
- To meet legal obligations, including requests from authorities that we are required by law to follow.
We do not sell your data and do not use it for advertising.
05AI processing
SENTIX analyses events in two stages. First, our own rules engine runs on SENTIX servers and matches events to known attack patterns (MITRE ATT&CK). Second, for risk scoring and plain-language explanations, incident context is sent to our AI inference provider.
- Masking first: before any data leaves SENTIX servers for AI analysis, server IP addresses are replaced with placeholders, and sensitive paths and secrets are removed.
- No third-party training: our AI provider may not use your data to train its models.
- Short-lived processing: data sent to our AI provider is used only to produce that result.
Training SENTIX's own models
We are building our own AI models to detect attacks more accurately. To do this, we may use security events and investigation results from customer servers, under these rules:
- De-identified first: before data is used for training, we remove or replace hostnames, IP addresses, usernames, file paths, command arguments that may contain personal or secret information, and anything that identifies your organisation.
- Patterns, not your data: models learn attack patterns, such as the sequence of steps in a break-in. They are not designed to store or reveal any one customer's data, and no customer can see another customer's data through them.
- Used only for SENTIX: training data and models stay with SENTIX. We do not sell or share them.
- Your choice: you can opt out at any time by emailing us. After you opt out, new data from your servers is not used for training.
06Where data is stored
SENTIX runs on Google Cloud Platform. Our databases and processing servers are located in Google Cloud's United States (us-east1) region. This means data collected from your servers is transferred to and stored outside India.
Such transfers are permitted under the DPDP Act, except to countries the Government of India restricts. If that list changes, we will comply with it. Wherever your data is stored, it is protected as described in this policy.
07Retention and deletion
| Data | How long we keep it |
|---|---|
| Raw security events and health data | Up to 90 days |
| Investigation and compliance reports | Up to 1 year |
| Account data | While your account is active |
When you leave: your API keys are revoked immediately, so agents stop sending data. You can export your data before your account closes. After that, all servers, events and reports linked to your organisation are permanently deleted from our production systems. Copies in encrypted backups are overwritten in the normal backup cycle.
We may keep limited records longer only where the law requires it, such as invoices.
08How we protect data
- In transit: all connections use TLS 1.3 (HTTPS), and every agent must authenticate with a secure API key.
- At rest: databases, disks and backups are encrypted with AES-256.
- Separation: each customer's data is separated by an organisation ID, and no customer can see another's data.
- Limited access: only a small number of authorised engineers can access production systems, using multi-factor authentication and audited keys, and only when needed to run or fix the service.
- Monitoring: we monitor our own infrastructure around the clock with the same detection technology we provide to customers.
10Our website and cookies
- We do not use advertising cookies, Google Analytics or third-party marketing trackers.
- The SENTIX dashboard uses an essential sign-in token stored in your browser to keep you logged in.
- Our website remembers your light or dark theme choice in your browser. This stays on your device.
- Our website loads fonts from Google Fonts, which means your browser connects to Google's servers and shares your IP address with Google.
- If you email us or request a pilot, we use your details only to reply and discuss SENTIX with you. Pilot form submissions are sent to Formspree, a third-party form service, which stores them on our behalf and may process them outside India.
11If there is a security incident
If we confirm a security incident affecting your data, we will notify you without delay, and in any case within 24 hours of confirming it. We will tell you what happened, which data and systems were affected, what we have done, and what we recommend you do.
We will also support you in meeting your own reporting duties, including CERT-In's 6-hour reporting requirement and notifications to the Data Protection Board of India.
12Your rights
Under the DPDP Act, you can ask us to:
- Tell you what personal data we hold about you and how we use it.
- Correct, complete or update your data.
- Delete your data, where we no longer need it or you withdraw consent.
- Withdraw consent you have given, which does not affect processing already done.
- Name another person to exercise your rights if you die or become unable to.
If your request is about data from your employer's servers, we will work with your employer, as the Data Fiduciary, to respond. You can also complain to the Data Protection Board of India if you are not satisfied with our response.
13Children
SENTIX is a business service for organisations. It is not meant for children, and we do not knowingly collect personal data from anyone under 18.
14Changes to this policy
We may update this policy as SENTIX grows or the law changes. We will change the "Last updated" date, and for significant changes we will notify customers by email before they take effect.
15Contact and grievances
For privacy questions, requests or complaints, contact our Grievance Officer. We will acknowledge your request within 48 hours and aim to resolve it within 30 days.