Security & Data Practices

Last Updated: April 18, 2026

1. Data Flow Architecture

SentraCheck processes documents through a stateless, ephemeral pipeline designed to minimize data exposure:

1.1 Document Upload Flow

1. User uploads document via browser (HTTPS/TLS 1.3)
2. Document received in memory at API gateway
3. Session token or API key validated against auth service (SSO logins additionally verify a short-lived JWT from the identity provider, then issue a standard session token)
4. Document streamed to ephemeral processing container
5. Analysis performed entirely in memory
6. Results returned to user
7. Processing container terminated; memory zeroed

1.2 Data at Rest

SentraCheck stores the minimum data necessary to operate the service. What is stored persistently:

• Account data: User profiles, organization info, billing records
• Scan findings: Issue metadata (type, severity, page location) stored encrypted — document content is never stored
• PII / ADA scan uploads: True zero data retention by default — the uploaded file is deleted the instant the scan completes. If the customer opts in when starting the scan, the file is retained for a bounded 24-hour window to allow downloading a redacted copy, then permanently deleted regardless
• PDF conversion uploads: Retained until deleted by the customer (the original PDF remains available for download alongside the converted HTML output, e.g. via the SentraCheck Viewer)
• Converted HTML: PDF conversion output stored and accessible via viewer URL until deleted by the user
• Audit logs: Authentication events, API access logs (no document content)

2. Data Retention Schedule

Data Type	Retention Period	Storage Location
PII / ADA Scan Uploads	Zero retention — deleted the instant the scan completes (24-hour extension only if the customer opts in for redaction download)	Encrypted file storage (US), scan-duration only
PDF Conversion Uploads	Until deleted by customer	Encrypted file storage (US)
Document Content / Raw Text	Never stored	Used in-memory for analysis only
Scan Findings (issue type, severity, location)	Duration of account	Encrypted database (US) — no document content stored
Converted HTML Output	Until deleted by user	Encrypted file storage (US)
Account Data	Duration + 30 days	Encrypted database (US)
Authentication Logs	90 days	Encrypted log storage (US)
API Access Logs	90 days	Encrypted log storage (US)
Aggregate Usage Stats	2 years	Analytics database (US)
Billing Records	7 years	Financial systems (US)

3. Hosting Infrastructure

3.1 Primary Infrastructure

Component	Provider	Location	Certifications
Application Servers	AWS	US-West-1 (California)	SOC 2, ISO 27001
Database	AWS RDS	US-West-1 (California)	SOC 2, ISO 27001
CDN / DDoS Protection	Cloudflare	Global Edge	SOC 2, ISO 27001
DNS	Cloudflare	Global	DNSSEC enabled

3.2 Data Residency

All persistent data is stored exclusively in the United States, specifically AWS US-West-1 (N. California) region. Data does not leave the United States. Document processing occurs in US-based infrastructure. No customer data is transferred to or processed in other jurisdictions.

4. Encryption Standards

Layer	Method	Key Management
Data in Transit (customer-facing)	TLS 1.3 (minimum TLS 1.2)	Auto-rotated certificates (Let's Encrypt / AWS ACM)
Data in Transit (internal OCR server link)	Unencrypted transport, network-restricted to the primary application server only (AWS security group)	N/A — TLS upgrade for this internal link is a planned improvement
Data at Rest (Database)	AES-256	AWS KMS
Data at Rest (Backups)	AES-256	AWS KMS
Data at Rest (Logs)	AES-256	AWS KMS
Password Storage	bcrypt (cost factor 12)	Per-user salt, adaptive hashing
Session Tokens	Cryptographic tokens	Database-backed with secure random generation

4.1 TLS Configuration

• Minimum protocol: TLS 1.2 (TLS 1.3 preferred)
• Cipher suites: ECDHE+AESGCM, ECDHE+CHACHA20
• HSTS enabled with 1-year max-age
• Certificate transparency logging enabled
• OCSP stapling enabled

5. AI & Machine Learning Usage

5.1 AI Components

Component	Purpose	Processing	Data Sent Externally
PII Detection Engine	Identify personal information patterns	Anthropic Claude API	Document text; page images for scanned content
Name Recognition	Identify human names in context	Anthropic Claude API	Document text; page images for scanned content
PDF to HTML Conversion	Convert PDF pages to structured accessible HTML	Anthropic Claude API	Document text; page images for scanned content and alt-text generation
OCR Processing	Extract text from images/scans	Dedicated self-hosted OCR server (same AWS US-West-1 region), with Claude vision fallback	None from the OCR server; page images when vision fallback is used

5.2 What We Don't Do

• We do not send original document files externally — only extracted text for analysis
• We do not use customer documents to train or fine-tune AI models
• We do not store AI inference results beyond the immediate response
• We do not use AI for automated decision-making that affects users

5.3 Third-Party AI Provider

SentraCheck uses Anthropic's Claude API for PII detection, text analysis, and PDF-to-HTML conversion. Key details:

• What is sent: Extracted text content only (not original files, images, or metadata)
• What is NOT sent: Original document files, user account information, or file names
• Data retention: Anthropic's enterprise data retention policies apply (see Anthropic Privacy Policy)
• Model training: Customer data is not used to train Anthropic's models under our enterprise agreement

5.4 Self-Hosted Components

The following components run entirely on our infrastructure with no external API calls:

• OCR Processing: Text extraction from images and scanned documents, on a dedicated self-hosted server in the same AWS US-West-1 region
• ADA Accessibility Checking: WCAG validation rules
• Compliance Rule Engine: Pattern matching for regulatory requirements

Customer documents are never used for model training or improvement.

6. Logging & Audit Trail

6.1 What We Log

Event Type	Data Captured	Retention
Authentication	User ID, timestamp, IP, success/failure, user agent	90 days
API Requests	Endpoint, user ID, timestamp, response code, latency	90 days
Document Scans	User ID, timestamp, page count, processing time (NO content)	90 days
Admin Actions	Admin ID, action type, target, timestamp	2 years
Security Events	Event type, source IP, details, timestamp	1 year

6.2 What We Don't Log

• Document content or file contents
• The actual PII values found (only flagged — type, location, severity — stored encrypted in findings)
• User passwords (hashed only, never logged)

6.3 Log Access

• Logs are encrypted at rest (AES-256)
• Access restricted to authorized security personnel
• All log access is itself logged
• Logs available for customer audit upon request (for their own data)

7. Access Controls

7.1 Employee Access

• Principle of least privilege: Employees only have access required for their role
• MFA available: Multi-factor authentication supported for employee accounts
• Access reviews: Quarterly review of all access permissions
• Separation of duties: Production access separated from development
• Background checks: Required for all employees with system access

7.2 Customer Access

• Email/password authentication with optional MFA
• Configurable session timeout
• Concurrent session limits
• Role-based access within organizations (Admin, User, Read-only)

8. Incident Response

SentraCheck maintains a documented incident response plan:

• Detection: Automated system-health monitoring (24/7, CloudWatch-backed) plus comprehensive security-event logging
• Response: On-call security team with 15-minute response SLA
• Notification: Customer notification within 72 hours of confirmed breach
• Recovery: Documented recovery procedures with regular testing

9. Compliance & Certifications

Standard	Status	Notes
CCPA / CPRA	Compliant	Configurable retention, no cross-customer data sharing
NIST 800-122	Aligned	Documented controls
NIST 800-171	Not currently pursued	No formal control mapping at this time
Section 508	Conformant	VPAT 2.5 available
WCAG 2.1 Level AA	Conformant	Self-assessed; third-party audit Q3 2026
AWS SOC 2	Inherited	Via hosting provider (AWS US-West-1)
SOC 2 Type II (own)	Planned 2027	Roadmap item
FedRAMP	Path planned	Enterprise tier, late 2026
GDPR	Not currently pursued	SentraCheck serves US public-sector customers; no formal GDPR program at this time

10. Security Contact

For security-related inquiries, vulnerability reports, or to request documentation for audits:

Email: security@sentracheck.com
Response SLA: 24 hours for security inquiries
Vulnerability Reports: Acknowledged within 24 hours, triaged within 72 hours