Privacy Notice

Sentinel Privacy Notice

Version: 2026-10b Effective: 22 October 2026 Last updated: 22 October 2026 (log controls and shorter retention, sections 3 and 6)

This notice explains what personal information Sentinel collects, why, who else sees it, how long we keep it, and what you can do about it. It goes with our Terms of Service at https://www.isdevopro.com/terms.

1. Who is responsible

Israel Oseghale, trading as IsDevOps Pro, in Nigeria ("we", "us"). You can contact us about anything in this notice at info@isdevopro.com.

We are not yet a registered company. When we become one, it will take over as the responsible party, and we will tell you first.

We handle personal information under the Nigeria Data Protection Act 2023.

2. Two roles

Information about you as a user of Sentinel (your name, email, sign-in, billing and support history). We decide why and how it is used, so we are the controller.

Information inside the data you send us to monitor (for example names, email addresses or IP addresses that your applications write to their logs). You decide why it is used, and we handle it for you, so we are the processor and you are the controller. If you are a customer, you are responsible for having a proper basis to send it to us. Please send only what you need.

3. What we collect

When you sign up or are invited

your name, work email address, and the name of your organisation;

your password, which we store only as a one-way hash, and, if you turn on two-factor sign-in, the secret for it, stored encrypted;

which terms version you accepted, and when.

When you use the portal

sign-in records, security and audit records (for example sign-in attempts, password and two-factor changes, who changed what), including the IP address and device information of the request;

one cookie that keeps you signed in (see section 8);

support requests and the replies, and notes our team adds about your incidents.

When you pay

the amount, currency, period covered and status of each invoice, and the payment reference. Your card or bank details go to our payment provider, Paystack, and we never see or store them.

What you connect for monitoring

addresses of websites and APIs you ask us to check, and the results (up or down, response time, status code);

from servers where you install the agent: CPU, memory and disk figures, the list of running containers and processes, open network ports, summaries of web requests (including visitor IP addresses, paths and status codes) and container logs. Logs can contain private details, so the agent removes passwords, tokens, keys, card numbers and similar secrets from each line before it leaves your server (and email addresses are shortened), and we remove them again when we store a line. You can switch log collection off for any server in the portal, which also deletes what we hold for it, or start the agent with the no-logs option so that logs never leave the server. Every few hours it also reports the server's security hygiene: how many software updates are waiting, whether a restart is needed, whether automatic updates are on, whether SSH allows password or root logins, whether a firewall is active, how many failed SSH logins there were in the last day, and, on Ubuntu and Debian servers, the list of installed software packages with their versions. It also reads the version of server software such as PHP, Node.js, Python, nginx, Apache, OpenSSL, Redis and Ruby, by asking each program for its version number. Twice a day it looks in the usual application folders on the server, and inside running containers, for lock files (such as composer.lock, package-lock.json, requirements.txt, Gemfile.lock and go.mod) and sends only the names and versions of the frameworks and libraries they list, with the folder each project is in (for example /var/www/shop) and the container name. It does not send the lock files themselves, your source code, or any other file. Only the newest report is kept. The agent only reads these; it never changes anything;

from cloud accounts you connect: the names, settings and health of your resources and, on plans that include it, your cost data. Access is read-only. For keyless AWS access we store only the role identifier. For other access we store the read-only credential you give us, encrypted;

alert addresses you choose, such as a Slack, Teams, Discord or webhook address (stored encrypted) and a Telegram chat you link to your organisation.

On our website

we count visits with Plausible, a privacy-focused analytics service that does not use cookies and does not track you across sites.

4. Why we use it

Emails about your service (invoices, alerts, trial and renewal notices) To tell you things you need to know Contract with you

We do not sell personal information. We do not use customer data to train AI models, and we do not use your data for advertising.

5. Who else sees it

We use these providers to run Sentinel. Each receives only what it needs for its job.

Provider What it does What it receives

Oracle Cloud Infrastructure (South Africa, Johannesburg) Hosts Sentinel and its backups All data described above, stored on its servers

Paystack Takes payments Your name, email, amount and payment details you enter with them

Resend Sends our emails Your email address and the content of emails we send you

Telegram Delivers alerts to a Telegram chat you link The alert text sent to that chat

Slack, Microsoft Teams, Discord or your own webhook Deliver alerts to an address you choose The alert text sent to that address

Groq Writes the plain-language AI explanation of an alert, when an alert is raised or someone asks for one The alert text and related technical details for that alert

OSV.dev (run by Google) Tells us which installed software versions, and which framework and library versions in your apps, have known security flaws, on plans that include the vulnerability check The names and versions of software packages installed on your Ubuntu or Debian servers, and of the frameworks and libraries your apps use. Nothing that identifies you, the server or your project folders

Netlify Serves the web app Normal web request details, such as IP address

Plausible Counts website visits Anonymous visit counts

We may also share information when the law requires it, to protect people or our systems, or with a successor if Sentinel moves to a registered company (see our Terms).

Outside Nigeria. Our hosting is in South Africa, and several of these providers operate elsewhere. That means personal information is processed outside Nigeria. We choose providers that protect it, and we ask for the safeguards the law expects.

6. How long we keep it

Container logs: about 7 days. Web request summaries, open-port records and process records: about 14 days.

Container measurements: about 30 days. Server measurements, uptime check results and backup check results: about 90 days. Older records are deleted automatically.

Account details, alert history, reports, support messages and audit records: while you have an account, and after a trial ends or a subscription lapses, so you can come back. We do not delete them automatically. You can ask us at any time to delete them, and we will do so within 30 days.

Invoices and payment records: 6 years, because tax and accounting rules require it.

Backups are copies of our database: daily copies are kept for about a week and monthly copies for up to 12 months, then overwritten. Deleted data can therefore remain in a backup for up to 12 months. It is not restored to the live service.

If you ask us to close your account sooner, we delete what we are not required to keep.

7. How we protect it

Each organisation sees only its own data. Passwords are hashed, and stored credentials, cloud and alert secrets are encrypted. Connections use HTTPS. Access to our systems is limited and logged, and we keep backups. No system is perfectly secure. If a breach affects your information, we will tell you without undue delay, and the regulator and affected people within 72 hours where the law requires.

8. Cookies

The web app uses one cookie that keeps you signed in. It is needed for sign-in to work, so we do not ask for consent for it. The website uses no advertising or tracking cookies.

9. Your rights

You can ask us to:

tell you what we hold about you, and give you a copy;

correct anything that is wrong;

delete your information, where we are not required to keep it;

stop or limit using it, or object to a particular use;

give you your data in a common format;

withdraw consent, where we rely on it.

Write to info@isdevopro.com. We will answer within 30 days. We may need to check it is really you. If you are not happy with our answer, you can complain to the Nigeria Data Protection Commission. If your information is in a customer's monitored data, please contact that customer, who is responsible for it. We will help them answer you.

10. Children

Sentinel is for organisations and is not meant for anyone under 18. We do not knowingly collect information from children.

11. Changes

If we change this notice in a way that matters, we will email account owners and show a notice in the portal at least 30 days before it applies. The date at the top shows the current version.