Privacy Policy
Last updated: 15 September 2026
This policy explains what the Nexa Sentry platform (“the Service”) collects, why, how long it is kept, and what you can ask us to do with it. It covers both the website and the monitoring console.
1. Who is responsible
The data controller is Nexa Sentry Inc., 1414 Prairie Creek Trail, Joliet, Illinois 60431, United States, with an office at 242 Queen Street South, Kitchener, Ontario, Canada. For any privacy request, write to [email protected].
[Insert company registration number, and the name and address of any EU/UK representative or Data Protection Officer, if one is required.]
2. What we collect
Account data
When you register, or when an administrator creates an account for you, we store your full name, work email address, company, job title, a password (stored only as a bcrypt hash, never in readable form), and your role. If you enable two-factor authentication we also store a TOTP secret and single-use backup codes.
Enquiry data
If you submit the enquiry form, we store the name, work email, company, fleet size and message you entered, so that we can reply. The form asks for your agreement before it will submit, and it is not ticked for you.
Monitoring data from your own machines
This is the substance of the Service. Where you install a Nexa Sentry agent on a machine you control, that agent reports to the collector, and we store:
- Machine identity: hostname, local IP address, MAC address, operating system, and a machine fingerprint used to bind the agent’s enrolment token to one device.
- Resource telemetry: CPU, memory and disk use, load averages, uptime, and process counts.
- Running processes, including command names, and listening network sockets.
- Security posture: firewall state, ASLR/NX settings, AppArmor/SELinux status, and pending or security package updates.
- Security events: failed SSH logins, alerts raised by rules, and vulnerability findings.
This data can describe the activity of people using those machines. You are responsible for having a lawful basis to monitor them and for telling them you do.
Security and audit logs
We record authentication events (sign-in success and failure, lockouts, one-time-code use, password changes, MFA changes, and account administration) and SSH gateway sessions, together with the source IP address. These exist so that account compromise can be detected and investigated.
Billing data
Subscription status, plan and invoice history. Card numbers are never sent to or stored on our servers — payment details are handled by our payment processors.
3. Why we may use it, and on what basis
| Purpose | Basis (UK/EU GDPR) |
|---|---|
| Providing the monitoring service you asked for | Performance of a contract |
| Replying to an enquiry you submitted | Consent, which you may withdraw |
| Keeping accounts secure; audit logging; rate limiting | Legitimate interests, and legal obligation where one applies |
| Taking payment and keeping financial records | Contract, and legal obligation |
| Sending service and alert email you configured | Contract |
We do not sell personal data, and we do not use it for advertising or profiling.
4. Who else processes it
These are the third parties the Service can transmit data to:
| Recipient | What reaches them | When |
|---|---|---|
| Stripe, and SafePay | Payment and subscription details | When you pay |
| Email address and profile, for sign-in | Only if you use Google sign-in | |
| Google Fonts | Your IP address, when your browser fetches the page fonts | Every page load |
| OpenRouter | Your chat messages and a snapshot of the fleet data in scope for your account | Only when you use the AI assistant or the in-terminal AI helper |
| Your own email, Slack, Jira or webhook endpoints | Alert contents you configured | Only where you set up that integration |
The AI assistant is worth reading twice: when you use it, your question and a summary of the hosts you can see are sent to a third-party model provider. Do not paste secrets into it.
5. International transfers
Our infrastructure and several of the processors above are located in the United States. If you are in the UK, the EEA or another region with transfer restrictions, your data will be transferred there.
[Insert the safeguard relied upon for those transfers — Standard Contractual Clauses, the EU-US Data Privacy Framework, or an adequacy decision — and where a copy can be obtained.]
6. How long we keep it
- Account data — for as long as the account exists, then deleted on request.
- Telemetry and alerts — [insert your retention period].
- Authentication and SSH audit logs — pruned automatically on a defined retention schedule set by the operator.
- Billing records — for as long as tax and accounting law requires.
- Enquiries — deleted once the enquiry is closed, or on request.
7. Your rights
Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, restrict or object to its use, take it elsewhere in a portable form, and withdraw consent. Residents of California and other US states with privacy statutes may also have the right to know what is collected and to opt out of sale or sharing — we do neither. To exercise any of these, email [email protected]. We will respond within the period the applicable law requires.
If you are in the UK or EEA and are unhappy with our response, you may complain to your national data protection authority.
8. Security
Passwords are hashed with bcrypt. Sessions are signed and can be revoked centrally. Sign-in is rate limited per IP address and accounts lock after repeated failures. Two-factor authentication is available and can be enforced. Access to fleet data is scoped by role. No system is perfectly secure, and we do not claim otherwise.
[Insert your breach notification commitment and the timeframe you undertake to meet.]
9. Children
The Service is a business tool and is not directed at, or intended for, anyone under 16. We do not knowingly collect their data.
10. Changes
If this policy changes materially, we will update the date at the top and, where the change affects you, tell account holders by email.