SentinelMesh Ltd ("SentinelMesh", "we", "us", or "our"), a company incorporated under the laws of England and Wales (Company Registration Number: 14892763), is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy describes our practices concerning the collection, use, disclosure, and protection of information when you use our AI operating system platform and related services (collectively, the "Services").
We understand that trust is fundamental to our relationship with customers who entrust us with their AI infrastructure and data. This policy has been designed to provide complete transparency about our data practices while maintaining the highest standards of data protection required by global regulations including the General Data Protection Regulation (GDPR), the Health Insurance Portability and Accountability Act (HIPAA), and the California Consumer Privacy Act (CCPA).
Zero PII Leaks Guarantee: SentinelMesh maintains a verified zero personally identifiable information (PII) leak record in production environments. This commitment is independently audited quarterly by third-party security firms and forms the foundation of our security architecture.
When you create a SentinelMesh account, we collect information necessary to provide our Services and maintain security. This includes your full name, business email address, company name, phone number (for enterprise customers requiring priority support), and billing address. We also collect authentication credentials, specifically your account password (which is cryptographically hashed using bcrypt with a minimum of 12 rounds before storage) and any API keys you generate through our platform. These API keys are stored as SHA-256 hashes with only the first eight characters stored in plaintext for identification purposes.
For customers requiring billing capabilities, we collect payment method information including credit card details, billing addresses, and tax identification numbers where applicable. All payment processing is handled through Stripe, our PCI DSS Level 1 compliant payment processor. We do not store complete credit card numbers on our servers—only the last four digits for identification purposes and the expiration date for renewal notifications.
To provide our intelligent routing capabilities, cost optimization, and platform improvements, we automatically collect comprehensive usage data from your interactions with our Services. This includes the full text of prompts you submit to our API, the responses generated by language models, the specific model selections made by our routing engine, and the reasoning behind those routing decisions. We track detailed performance metrics including response latency measured in milliseconds, error rates with complete error messages for debugging, cache hit rates for optimization analysis, and token usage broken down by prompt tokens, completion tokens, and cached tokens.
Cost attribution data is collected with precision to the ten-thousandth of a dollar ($0.0001), including the cost per request, cumulative costs per user, team-level cost aggregations, and project-based cost allocations. Technical logs automatically captured include IP addresses (which may be considered personal data under GDPR), user agent strings identifying your browser or API client, timestamps accurate to the millisecond for all operations, session identifiers for tracking related requests, and request/response headers excluding any authentication tokens.
For customers utilizing our Progressive LLM Independence features, we collect and process request-response pairs specifically for knowledge distillation purposes. These pairs consist of your original prompts paired with responses from external language models, which are used to train custom models specific to your organization. We also collect quality ratings when provided, either through explicit feedback mechanisms or implicit signals such as regeneration requests or edit actions taken on generated content.
Performance data collected for training optimization includes accuracy metrics calculated against held-out validation sets, cost efficiency comparisons between external models and your trained models, and latency characteristics of different model routing strategies. This training data is isolated per tenant—your data never contributes to training for other customers' models, and other customers' data never influences your models. All training data can be deleted upon request, subject to any legal retention requirements.
Under GDPR, we process personal data only when we have a valid legal basis. For EU residents, our primary legal bases are contractual necessity (processing required to provide the Services you've requested), legitimate interests (improving our Services, preventing fraud, and ensuring security), legal obligations (complying with applicable laws and regulations), and consent where explicitly obtained for specific processing activities such as marketing communications.
We use collected information for several purposes essential to service delivery. Service provision includes processing API requests through our intelligent routing system, training custom models through knowledge distillation when this feature is enabled, implementing semantic caching to reduce costs, maintaining user preferences and session context across interactions, and providing authentication and access control. Platform improvement activities encompass enhancing routing algorithm accuracy, improving caching effectiveness, detecting and resolving bugs or performance issues, developing new features based on usage patterns, and conducting internal analytics to understand service quality.
Security and compliance measures require us to detect and prevent fraudulent activity, abuse, or security threats, maintain comprehensive audit logs for compliance requirements, monitor for potential PII leaks or policy violations, and enforce our Terms of Service and Acceptable Use Policy. We also use your information for necessary communications including service updates and security alerts, responses to support requests, transactional notifications such as billing confirmations, and when you've opted in, product announcements and feature updates.
We share data with carefully selected service providers who assist in operating our platform. These providers are bound by data processing agreements that meet GDPR requirements and are subject to regular security audits. Our cloud infrastructure is hosted on Amazon Web Services (AWS) and Google Cloud Platform, where all data is encrypted at rest using AES-256 encryption and in transit using TLS 1.3. Payment processing is handled exclusively by Stripe Inc., which maintains PCI DSS Level 1 compliance. We use Datadog for aggregated system monitoring and performance metrics, ensuring that no personally identifiable information is transmitted—only anonymized usage statistics and system health metrics. Customer communication and support utilize SendGrid for transactional emails and Intercom for support ticket management, with both services processing only contact information necessary for their function.
When our routing system selects external language models to process your requests, we necessarily transmit your prompts and context to the selected provider. This transmission occurs over encrypted connections and includes query prompts and any context you've provided within the message. Importantly, we do not share personally identifiable information with language model providers unless such information is explicitly included in your prompts—our system does not augment your requests with user identification data. Each external provider's data processing is governed by their respective data processing agreements, which we maintain with OpenAI, Anthropic, and Google.
You retain control over which external providers can process your data through configuration options in your dashboard. We support provider restrictions for compliance purposes, allowing customers operating under strict data residency requirements to limit processing to specific vendors or geographic regions. Provider usage is fully auditable through our logging system, with every routing decision recorded including the rationale for provider selection.
We may disclose personal information when required by law or to protect our legitimate interests. This includes compliance with valid legal obligations such as court orders, subpoenas, or statutory requirements, cooperation with law enforcement in investigating criminal activity while following proper legal procedures, protection of our rights, property, or safety and that of our users and the public, enforcement of our Terms of Service or investigation of potential violations, and defense against legal claims or disputes. We will notify affected users of such disclosures when legally permitted and practically possible, providing reasonable advance notice to allow users to seek protective orders or otherwise contest the disclosure.
We maintain different retention periods for different categories of data based on legal requirements, operational needs, and your rights. Account information including profile data, authentication credentials, and billing details is retained for the duration of your active account plus ninety (90) days following account closure to facilitate any necessary account recovery or billing reconciliation. API access logs containing request metadata (excluding full prompt and response content) are retained for thirty (30) days for standard customers and ninety (90) days for enterprise customers who have purchased extended logging.
Training data collected for Progressive LLM Independence, including request-response pairs used for knowledge distillation, is retained until you explicitly delete your trained models or close your account. Billing records are retained for seven (7) years as required by UK tax law and international accounting standards. Security audit logs, including authentication attempts, API key usage, and security events, are retained for a minimum of one (1) year to support security investigations and compliance audits.
You may request earlier deletion of data not subject to legal retention requirements by contacting our Data Protection Officer. We will process deletion requests within thirty (30) days for standard requests and within seventy-two (72) hours for urgent requests involving data breaches or security concerns.
You possess comprehensive rights regarding your personal data under GDPR, CCPA, and other applicable privacy regulations. The right of access permits you to request and receive a complete copy of all personal data we hold about you, delivered in a structured, machine-readable format (JSON or CSV) within thirty (30) days of your request. The right to rectification allows you to correct any inaccurate or incomplete personal data through your account dashboard or by contacting our support team. The right to erasure, also known as the "right to be forgotten," enables you to request deletion of your personal data, which we will process within thirty (30) days subject to any legal retention obligations.
You have the right to data portability, meaning you can export your data in machine-readable formats including API logs, usage analytics, trained model weights, and configuration settings. The right to object permits you to object to processing based on legitimate interests, including for direct marketing purposes, automated decision-making, or profiling. The right to restriction allows you to request temporary suspension of processing while we resolve disputes about accuracy or processing legality.
You may also withdraw consent at any time for processing activities that rely on your consent as the legal basis, though this will not affect the lawfulness of processing before withdrawal. To exercise any of these rights, contact our Data Protection Officer at [email protected] with your request. We will verify your identity before processing rights requests and respond within thirty (30) days, or sixty (60) days for complex requests with notification of the extension.
We implement comprehensive technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. All data is encrypted both in transit and at rest. Transit encryption utilizes TLS 1.3 with forward secrecy enabled for all API communications and inter-service communications. At-rest encryption employs AES-256 encryption for all stored data, with hardware security modules (HSMs) used for encryption key management and regular key rotation following NIST guidelines.
Access controls are rigorously enforced through role-based access control (RBAC) for all internal systems, mandatory multi-factor authentication (MFA) for all employee accounts, least-privilege principles ensuring users and systems have only necessary permissions, and regular access reviews conducted quarterly with immediate revocation of unnecessary permissions. Our infrastructure security includes network segmentation isolating production from development environments, Web Application Firewall (WAF) protection against common attack vectors, intrusion detection and prevention systems (IDS/IPS) with 24/7 monitoring, and regular vulnerability scanning and penetration testing conducted by independent security firms.
Continuous security monitoring encompasses 24/7 security operations center (SOC) monitoring, automated threat detection using machine learning algorithms, real-time alerting for suspicious activities, and a documented incident response plan with one-hour maximum response time for critical incidents. We maintain a responsible disclosure program encouraging security researchers to report vulnerabilities, with a bug bounty program rewarding valid security findings.
SentinelMesh operates globally with data centers strategically located across multiple regions. In Europe, we maintain facilities in London, United Kingdom and Frankfurt, Germany, both operating under GDPR jurisdiction. Our Americas presence includes data centers in Virginia, USA (US-East), Oregon, USA (US-West), and São Paulo, Brazil. In the Asia-Pacific region, we operate facilities in Singapore and Tokyo, Japan.
For customers subject to European data protection laws, we offer data residency guarantees ensuring all data remains within EU/EEA territories. When international transfers are necessary, we implement appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions where applicable for transfers to countries deemed to provide adequate protection, and additional technical measures such as encryption and pseudonymization to ensure data protection standards equivalent to those required under GDPR.
Enterprise customers may specify data residency requirements in their contracts, ensuring data processing occurs only in approved jurisdictions. We maintain detailed documentation of all international data transfers, available upon request for compliance auditing purposes.
SentinelMesh Services are not intended for use by individuals under the age of eighteen (18) years. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal data from a child under 18, we will take immediate steps to delete such information from our systems and terminate any associated account.
If you are a parent or legal guardian and believe your child has provided personal information to us, please contact our Data Protection Officer immediately at [email protected]. We will investigate and respond within forty-eight (48) hours, taking appropriate action including immediate data deletion if the report is substantiated.
We reserve the right to modify this Privacy Policy to reflect changes in our practices, legal requirements, or industry standards. Material changes will be communicated through multiple channels. We will send email notifications to the primary email address associated with your account at least thirty (30) days before changes take effect, display a prominent notification banner in your dashboard for at least thirty (30) days, update the "Last Modified" date at the top of this policy, and for enterprise customers, provide direct notification through your designated account manager.
Material changes are defined as those that reduce your rights or significantly alter how we process your data, expand the categories of data we collect, introduce new purposes for data processing, or modify data retention periods. We encourage you to review this policy periodically to stay informed about our privacy practices. Your continued use of our Services after changes take effect constitutes acceptance of the updated policy.
For all privacy-related inquiries, rights requests, or concerns, please contact our Data Protection Officer:
Email: [email protected]
Address: SentinelMesh Ltd, 123 Tech Boulevard, London EC2A 4PS, United Kingdom
Response Time: Within 48 hours for urgent matters, 5 business days for standard inquiries
For EU-specific data protection matters:
Email: [email protected]
For California Consumer Privacy Act requests:
Email: [email protected]
Phone: +1 (415) 555-0123 (toll-free for California residents)
If you are located in the European Economic Area and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection supervisory authority. For UK residents, this is the Information Commissioner's Office (ICO) at ico.org.uk.
SentinelMesh maintains active compliance with multiple international privacy and security frameworks. Under the General Data Protection Regulation (GDPR), we serve as a data controller for account information and usage analytics, and as a data processor when processing customer content on their behalf. Our compliance includes lawful bases for all processing activities, comprehensive Data Processing Agreements (DPAs) available to all customers, documented data protection impact assessments for high-risk processing, and annual external GDPR compliance audits by certified auditors.
For Health Insurance Portability and Accountability Act (HIPAA) compliance, we maintain Business Associate Agreements (BAAs) with healthcare customers, implement technical safeguards exceeding HIPAA Security Rule requirements, conduct regular HIPAA compliance training for all employees with system access, and maintain detailed audit trails of all access to protected health information (PHI). Our SOC 2 Type II certification covers security, availability, and confidentiality principles with annual audits conducted by independent CPA firms and reports available under NDA to enterprise customers.
ISO 27001 certification validates our Information Security Management System (ISMS) with annual surveillance audits and triennial recertification. Additional compliance frameworks include California Consumer Privacy Act (CCPA) compliance with support for consumer rights requests, Australian Privacy Principles (APP) compliance for Australian customers, and adherence to Singapore Personal Data Protection Act (PDPA) for Singapore operations.
Compliance documentation, including current certificates and audit reports, is available upon request to enterprise customers under appropriate confidentiality agreements. We maintain a dedicated compliance team monitoring regulatory developments and ensuring ongoing adherence to evolving requirements.
This Privacy Policy is provided in English. Translations may be available for convenience, but in the event of any conflict between the English version and a translated version, the English version shall govern and control. This policy constitutes a legally binding agreement between you and SentinelMesh Ltd.