Privacy Policy

Version 4.1 · Last updated: 20 May 2026 · Effective: 15 June 2026

1. Overview and controllers

This policy explains how SentinelForge Security, Inc. ("SentinelForge", "we", "us") handles personal data collected through our website (sentinelforge.example) and in our role as a service provider.

Data controller for website & marketing data: SentinelForge Security, Inc., 1201 Third Avenue, Suite 2200, Seattle, WA 98101, USA.

UK / EU representative: SentinelForge Security UK Ltd., 2 Portman Square, Marylebone, London W1H 6BG, United Kingdom. Contact: gdpr@sentinelforge.example.

Data Protection Officer (voluntary): Priya Nandakumar, reachable at dpo@sentinelforge.example.

Note on our two roles. For website visitors and prospects we act as a data controller. When we deliver an engagement and process personal data on behalf of a Client (see section 12), we act as a data processor — the Client is the controller and the applicable rules are set out in the DPA.

2. Information we collect

2.1 Information you provide

• Business contact details (name, company, work email, phone) submitted via forms
• Content of your messages and any attachments
• Information you provide during scoping calls (usually company-level, not personal)
• Employment application data and CVs (candidates only)
• Marketing preferences

2.2 Information collected automatically

• Server logs: IP address, browser and OS, referring URL, pages viewed, timestamps. Retained for 30 days.
• Analytics: aggregate page-view and event data. We use privacy-preserving analytics that do not require cookies (see Cookie Policy).
• Security telemetry: rate-limit metrics, WAF logs, error traces. Retained for 90 days.

2.3 Information from third parties

• Business enrichment: firmographic data (company size, industry) from Clearbit for corporate email addresses you submit.
• Public data: professional information from your public LinkedIn if you submit a work email.
• Background check providers (for personnel of Client engagements requiring cleared or vetted personnel).

3. How we use information

• To respond to your inquiry and manage the sales / scoping process
• To administer client engagements and support post-engagement re-testing
• To send you occasional business communications (only if you have opted in, or under legitimate-interests soft opt-in for existing business relationships)
• To operate, secure, and improve our website
• To recruit and evaluate job applicants (with 12-month retention post-decision unless you consent to longer)
• To comply with our legal, regulatory, and audit obligations
• To defend our legal rights

We do not use personal data for automated decision-making with legal or similarly significant effects. We do not sell personal data.

4. Legal bases (GDPR / UK GDPR)

Purpose	Legal basis
Responding to your inquiry	Legitimate interests (business communication)
Performing an engagement contract	Contract (or legitimate interests for the pre-contract phase)
Marketing emails to prospects	Consent
Marketing to existing business clients (soft opt-in)	Legitimate interests
Recruiting	Legitimate interests, or consent for talent-pool retention
Security telemetry, fraud prevention	Legitimate interests
Legal, tax, audit records	Legal obligation

5. Sharing and sub-processors

We share personal data with:

• Sub-processors — third parties that process personal data on our behalf, listed in our sub-processor register. Each is bound by a DPA at least as protective as ours.
• Professional advisors — auditors, lawyers, insurers, under confidentiality.
• Regulators and law enforcement — where required by law, valid subpoena, or court order, and only after we have reviewed the request.
• Successor entity — in the event of a merger, acquisition, or sale of assets, subject to reasonable confidentiality safeguards.

We do not sell personal data and do not share it for cross-context behavioral advertising.

6. International transfers

We are based in the United States. Personal data collected through the website is processed in the US. For transfers of EEA, UK, or Swiss personal data to the US or other third countries, we rely on:

• the EU–US Data Privacy Framework (DPF), where applicable and where our sub-processor has certified;
• Standard Contractual Clauses (2021 EU SCCs, including the UK Addendum) with any transfer-impact assessment where required;
• your explicit consent, where relied on and permissible.

7. Retention

Data category	Retention
Website analytics (aggregate)	13 months
Server logs	30 days
Security telemetry	90 days
Sales / scoping communications	36 months from last interaction
Engagement records (invoices, SOWs)	7 years (tax / regulatory)
Engagement working data	90 days after Deliverable acceptance, then deletion
Candidate CV and interview notes	12 months from decision; longer only with consent

8. Security

We operate an ISO/IEC 27001 certified information security management system with SOC 2 Type II attestation. Controls include:

• TLS 1.2+ for all data in transit
• AES-256 encryption at rest for engagement data
• Hardware-key phishing-resistant MFA (WebAuthn) for all staff systems
• Role-based access, monthly access reviews, immediate deprovisioning on separation
• Endpoint EDR on every laptop
• Vendor security review before onboarding any sub-processor
• Annual third-party penetration test of our own environment
• Documented incident-response plan with 72-hour breach notification per GDPR Art. 33

9. Your rights

Where applicable law grants them, you have rights to access, correct, delete, restrict, port, and object to processing of your personal data, and to withdraw consent. Requests: email privacy@sentinelforge.example. We verify identity before responding and reply within 30 days (extendable to 60 for complex requests).

EEA/UK residents may complain to their local supervisory authority. For the UK: the Information Commissioner's Office (ico.org.uk).

10. California, Colorado, Virginia, and other US state rights

Residents of California, Colorado, Connecticut, Utah, Virginia, and other US states with comprehensive privacy laws have rights to know, access, correct, delete, port, opt out of "sale" and "sharing" for targeted advertising, and — for sensitive information — limit its use.

We do not sell personal data and do not process personal data for targeted advertising. We do not process the categories of sensitive personal information that trigger the CPRA opt-out.

Requests: privacy@sentinelforge.example. Authorized-agent submissions must include a signed permission from the consumer.

11. Children

Our services are directed at business users. We do not knowingly collect personal data from anyone under 18.

12. Client-provided personal data (Processor role)

When we perform security testing, we may process personal data contained in Client systems (accounts, log entries, records exposed by vulnerabilities). We act only on documented instructions from the Client and only for engagement purposes.

The rules governing this processing are in our Data Processing Addendum, which every applicable Client executes with us. Individuals whose personal data is processed this way should contact the Client (the controller) to exercise their rights.

13. Changes

We update this policy when our practices change. Material changes are communicated to registered accounts and clients by email at least 14 days before taking effect and are logged in a public change history.

14. How to contact us

Privacy: privacy@sentinelforge.example
Data Protection Officer: dpo@sentinelforge.example
UK/EU representative: gdpr@sentinelforge.example