1. Introduction & Scope
SentinelGateway ("Sentinel", "we", "us", or "our") operates a zero-trust AI API gateway and LLM router (the "Service") that proxies inference traffic between your applications and upstream large-language-model providers. This Privacy Policy explains what data the Service processes, how our architecture minimizes data exposure by design, and the rights you have in relation to your information.
This policy applies to the hosted SentinelGateway control plane (sentinelgateway.ai), the Command Center dashboard, and the gateway data plane that processes your API requests. By using the Service you agree to the practices described here.
2. Zero-Trust & Zero Data Retention Principle
The gateway is architected around a zero data retention default for inference payloads:
- In-memory processing only. Prompt and completion payloads stream through the gateway's memory space for routing, scrubbing, and metering. Raw inference payloads are never written to disk by the request path.
- Scrub-before-store. Where audit logging is enabled, only the PII-scrubbed representation of a request payload is persisted — never the raw input as received.
- Configurable audit logging. Persistent storage of scrubbed request/response payloads in your usage logs exists solely to power your Command Center observability and billing. If you do not want payload-level records, contact us to disable payload capture for your tenant; metadata-only logging (timestamps, token counts, model, latency, cost) remains.
- Prompt cache. Exact-match and semantic cache entries hold scrubbed prompt embeddings and their completions in Redis with a 24-hour TTL, scoped per tenant and per model. Cache entries expire automatically and are never shared across tenants.
Key takeawayRaw prompts transit memory and are discarded. The only payloads we ever persist are the PII-scrubbed copies shown to you in your own dashboard.
3. PII Masking & Redaction Architecture
Every request routed through the Service passes through our in-flight PII redaction engine before it is forwarded to an upstream provider, written to a cache, or recorded in an audit log. The engine operates entirely in-memory inside the gateway process — no payload is ever sent to a third-party scrubbing API.
The redaction engine detects and replaces the following categories with deterministic placeholders (e.g. [EMAIL_REDACTED]):
- US Social Security numbers — pattern-matched and replaced with
[SSN_REDACTED]. - Payment card numbers (PAN) — 13–19 digit sequences matching Visa, Mastercard, Amex, and Discover formats, replaced with
[CREDIT_CARD_REDACTED]. - Email addresses — replaced with
[EMAIL_REDACTED]. - API keys & secrets — OpenAI (
sk-…), GitHub tokens, Bearer credentials, and similar secret formats, replaced with[API_KEY_REDACTED].
Redaction is enabled by default for all tenants and all plan tiers. An authenticated client may explicitly opt out per-request with the X-Sentinel-PII-Masking: false header; such requests are flagged in your audit trail. Because redaction happens before caching and logging, scrubbed placeholders — not your sensitive values — are what persist anywhere in our systems.
4. Information We Collect
4.1 Account information
When you register we collect your name, company name, and email address. For paid plans, payment method details are collected and processed directly by Stripe, Inc.; we never see or store raw card numbers.
4.2 Request metadata
For each API call we record operational metadata: timestamp, model name, prompt/completion token counts, latency, HTTP status, computed cost, routing and fallback decisions, cache-hit status, PII-redaction flags, and your tenant's assigned subnet identifier. This metadata powers billing, quota enforcement, and your observability dashboard.
4.3 Scrubbed payloads (audit logging)
Where payload logging is active, we store the PII-scrubbed request messages and the corresponding completion text so you can inspect traces in the Command Center. These records are visible only to your tenant.
4.4 Technical data
IP addresses, browser type, and session identifiers, collected automatically to operate and secure the Service.
5. How We Use Information
- To create and manage your account and authenticate you to the Service.
- To route your inference requests to the upstream provider your model selection implies.
- To process payments, meter usage, and enforce plan-based token quotas.
- To operate, maintain, secure, and improve the Service.
- To send transactional emails (account confirmations, invoices, quota alerts).
- To comply with legal obligations and enforce our Terms of Service.
No model trainingWe do not use your prompt, completion, or embedding data to train, fine-tune, or improve any AI model — ours or anyone else's — and we do not sell your data to third parties.
6. Third-Party LLM Provider Disclosures
The Service routes your (PII-scrubbed) inference requests to the upstream provider associated with the model you request — currently OpenAI, Anthropic, Google (Gemini), and Groq. When a request is forwarded:
- The upstream provider processes the scrubbed payload under its own data-processing terms and API data-usage policies.
- Automatic failover may re-route a failed request to an equivalent model on a different provider; this is always disclosed in your audit trail via the fallback flag and original-model field.
- We transmit only the scrubbed messages and the parameters required to fulfil the request — never your account identity, email, or billing information.
Our payment processor (Stripe, Inc.) and hosting/database infrastructure providers act as subprocessors under data-processing agreements. We disclose data to law enforcement only when required by valid legal process.
7. Data Retention & Audit Logging
- Account information — retained for the life of your account and up to 90 days after deletion.
- Request metadata & scrubbed payloads (usage logs) — retained in your tenant's audit table to power the Command Center; enterprise tenants may configure shorter retention windows.
- Prompt cache entries — 24-hour TTL in Redis, then automatically evicted.
- Billing records — retained as required by applicable tax and accounting law.
8. Security Measures
- Encryption in transit — TLS 1.3 for all client-to-gateway and gateway-to-provider traffic.
- Encryption at rest — AES-256 for persistent stores holding account data and audit logs.
- Credential hygiene — API keys are stored as SHA-256 hashes; plaintext keys are shown once at issuance and never recoverable thereafter. Passwords are hashed with bcrypt (work factor 12). Sessions use a single HttpOnly, SameSite=Strict cookie.
- Tenant network isolation — every tenant is provisioned a dedicated /24 subnet identity; all requests are traced and attributable to that isolated segment.
- Abuse defenses — prompt-injection pattern blocking and secret scanning are applied in-flight on every request.
9. GDPR, CCPA & SOC 2 Commitments
GDPR. Where we act as a data processor on your behalf, we process personal data only on your documented instructions. A Data Processing Agreement (DPA) incorporating Standard Contractual Clauses is available to all customers upon request at legal@sentinelgateway.ai. We honor data-subject rights including access, rectification, erasure, restriction, portability, and objection.
CCPA. We do not sell or share personal information for cross-context behavioral advertising. California residents may exercise their rights to know, delete, correct, and non-discrimination by contacting us.
SOC 2 Type II. Our control environment — covering security, availability, and confidentiality trust criteria — is operated in alignment with SOC 2 Type II requirements. Audit reports are available under NDA to enterprise customers.
11. International Transfers
Your data may be processed in data centres located outside your country of residence. Where the GDPR applies, international transfers are safeguarded by Standard Contractual Clauses or an equivalent lawful transfer mechanism.
12. Your Rights & Erasure
Depending on your jurisdiction you may have the right to access, correct, export, or delete your personal data; to object to or restrict processing; and to withdraw consent. To exercise any of these rights — including the right to erasure of your account and associated audit records — contact support@sentinelgateway.ai. We respond to verified requests within 30 days.
13. Children's Privacy
The Service is not directed at children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will promptly delete it.
14. Changes to this Policy
We may update this Privacy Policy from time to time. Material changes will be announced by email to your registered address and by a prominent notice in the Command Center at least 14 days before taking effect. The "Last updated" badge at the top of this page reflects the most recent revision.
15. Contact
Privacy questions, DPA requests, and data-subject requests: legal@sentinelgateway.ai. General support: support@sentinelgateway.ai.