Skip to content

Privacy Policy

Last updated: 16 October 2026

This Privacy Policy explains what personal information Sentinel Connector (the "Service") collects, why we collect it, and the choices you have. The Service is a platform for monitoring Drupal sites for security issues, module updates and related operational signals.

1. Who we are

The Service is operated by TrueCMS Pty. Ltd. (ABN 63 133 456 005), PO Box 8007, Carrum Downs VIC 3201, Australia ("we", "us"). You can reach us about privacy at support@sentinelconnector.io.

If an organisation gave you access to the Service, that organisation decides which sites and people are added to its workspace. Questions about that information are best sent to the organisation first.

2. Information we collect

Account information

When you create an account or accept an invitation, we collect your email address and, if you provide it, your name. We store your password only as a hash, never in readable form. We also record your role, the organisations you belong to, when your account was created and changed, and when you last signed in.

Terms acceptance records

When you create an account, accept an invitation, or accept updated Terms when you sign in, we record which version of the Terms of Service you accepted, when, that you confirmed you are 18 or older, and at which of those steps you did so. We keep each acceptance as a separate record so that we can show what was agreed.

Invitations

When a member invites someone, we store the invited email address, the person who sent the invitation, the role offered, any message they wrote, and the status and expiry of the invitation.

Signing in with Google or GitHub

If you choose to sign in with Google or GitHub, we receive the identifier that the provider assigns to your account, and from Google your verified email address. We store that identifier and the times it was linked and last used. We do not receive your password for that provider, and we do not ask for access to your contacts, repositories or files.

Google user data

Sign-in with Google asks Google only for the openid and email scopes. From Google we receive your Google account identifier, your email address and whether Google has verified it. We do not request access to Gmail, Google Drive, your contacts, your calendar or any other Google service.

We use this information only to sign you in to the Service, to link your Google account to your Sentinel Connector account, and to tell you about sign-ins to your account. We do not use it for advertising, we do not sell it, and we do not use it to develop or train artificial intelligence or machine learning models. We do not share it with anyone, except service providers that host the Service for us and where the law requires it.

We store it in our database, which only staff who run the Service can reach. You can unlink Google from your account settings once your account has a password, after which we no longer accept that Google account for sign-in. When you delete your account, we stop accepting that Google account and release it so that it can be linked to a new account. The marked record is kept for 90 days after the account is closed and is then deleted, as set out in section 7.

Sentinel Connector's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Sign-in security records

For each successful sign-in we record the time, the sign-in method, your IP address and the name of your browser and operating system. We also keep a hash of a random value stored in a cookie so that we can recognise a browser you have used before. We use these records to email you when your account is used from a new browser or network.

Two-factor authentication

If you turn on two-factor authentication, we store the secret that your authenticator app uses in encrypted form, and your recovery codes as hashes. We also record when it was turned on and count failed attempts so that we can lock the account against guessing.

Activity records

We keep an audit log of actions taken in the Service, such as signing in, inviting a member or creating an API key. Each entry records the action, the account that took it, the organisation, the item affected, the time and whether it succeeded. Members with the right permissions can see the audit log for their organisation.

We also log each exchange between a connected site and the Service: the time, the site, the API key used, the operation and its result. These logs contain no personal information about your sites' visitors.

Organisation, client and site information

Members add organisations, clients and sites to the Service. This includes names and descriptions, a contact email address and branding for a client, and the address of each site. The connector module on a connected Drupal site sends us technical details about that site: its Drupal, PHP and database versions, server details and the modules installed. We compare these with public release and security advisory information.

The Service does not need the content of your sites or information about their visitors or users. Please do not submit it.

Keys and tokens

We store API keys, password-reset links and invitation links only as hashes, together with their names, expiry and when they were last used. We store the secret that a connected site uses to sign what it sends us, because we need it to check each submission.

Server logs

Our web server logs each request with the IP address, the time, the address requested and the result. It does not log query strings, the referring page or your browser details.

Cookies and browser storage

The Service uses strictly necessary cookies and browser storage, and analytics cookies only if you agree. Our Cookie Policy lists each one.

Optional analytics on public pages

If you accept optional analytics, our public pages load Google Tag Manager and Google Analytics to count visits. Google then receives your IP address, browser details and the address and title of the public page you opened, and may set analytics cookies. We do not load them, and nothing is sent to Google, unless you accept. Analytics never runs on sign-in pages or inside the dashboard, so it never sees your account, your organisation or your sites. You can change your choice at any time with the "Analytics preferences" button on public pages.

Information we do not collect

We do not receive or store payment card numbers. If you pay for a plan, you enter card details in a form served by our payment provider, and they go to the provider directly. We keep only the card brand, its last four digits and its expiry date. We do not use advertising tools, and we do not build profiles of you across other websites.

3. How we use information

  • to create your account, sign you in and keep your session secure;
  • to show your organisation the state of its sites and the advisories that affect them;
  • to send service emails: invitations, password resets and alerts about new sign-ins;
  • to detect, investigate and prevent misuse of the Service;
  • to meet our legal obligations.

We do not sell personal information, and we do not use it for advertising.

To have an account you must give us an email address, your name and a way to sign in. Without them we cannot create the account. We make no decisions about you by automated means alone, and we do not profile you.

Where the GDPR or UK GDPR applies, we rely on the following legal bases. We process account, invitation, organisation and site information to perform our contract with you or your organisation. We process sign-in security records and server logs for our legitimate interest in keeping accounts and the Service secure, and Terms acceptance records for our legitimate interest in being able to show what was agreed. We process information where the law requires it. We use optional analytics only with your consent, which you can withdraw at any time; withdrawing does not affect what happened before.

5. Who we share information with

  • Members of your organisation. Other members can see your name, email address and role.
  • Service providers. We use providers to host the Service and to deliver email: Vultr (servers and database), Cloudflare (website and file storage) and Resend (email). They process information only on our instructions.
  • Sign-in providers. If you choose to sign in with Google or GitHub, your browser goes to that provider, which learns that you are signing in to the Service.
  • Analytics provider. Only if you accept optional analytics: Google, which receives your IP address and browser details when you open a public page.
  • Payment provider. Only if you add a payment card or pay for a plan: Stripe, which receives the card details you enter, your billing details, and your IP address and browser details for fraud prevention.
  • Authorities. We disclose information when the law requires it.

6. Where information is stored

The Service's servers and database are hosted in Australia (Melbourne). If you use the Service from another country, your information is transferred to and stored in that location.

Where the GDPR or UK GDPR applies to that transfer, we rely on the European Commission's standard contractual clauses, with the UK Addendum for transfers from the UK.

7. How long we keep information

  • Account, organisation and site information: for as long as the account or organisation is active. You can delete your account, or an organisation and all its data, from the dashboard. Access stops at once. 14 days later the account is closed for good and an organisation's data is permanently deleted; you can cancel until then.
  • Closed account record: when you delete your account we keep its account record, including your email address and name, marked as deleted, for our internal records. Its sign-in history, linked sign-in records, two-factor setup, API key records, memberships and Terms acceptance records are kept for 90 days after the account is closed and are then deleted. None of this can be used to sign in, and only our platform administrators can see it.
  • Terms acceptance records: for as long as the account is open, and for 90 days after it is closed.
  • Sign-in events: 90 days.
  • Audit log entries: 90 days.
  • Logs of exchanges with connected sites: 30 days.
  • Recognised browsers and IP addresses: 180 days after they were last used to sign in.

8. Security

We use administrative, technical and organisational measures designed to protect your information, including hashed passwords and encrypted connections. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights

Depending on where you live, you may have the right to ask for a copy of your personal information, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable form. You can change your name and password in your profile. To make any other request, contact us at support@sentinelconnector.io. We will answer within the time the law allows.

Complaints

If you think we have mishandled your personal information, write to us at support@sentinelconnector.io and say what happened. We will confirm that we have received your complaint, look into it, and reply in writing with what we found and what we will do about it.

If you are not satisfied with our answer, you can complain to the privacy or data protection regulator where you live. In Australia that is the Office of the Australian Information Commissioner (oaic.gov.au).

10. Children

The Service is a tool for people who manage websites as part of their work. It is not directed to children, and our Terms of Service require users to be at least 18 years old, and creating an account requires confirming that. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it. If we learn that an account belongs to a child under 13, we close the account and delete the child's personal information.

11. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above. If a change materially affects how we use your information, we will take reasonable steps to tell you.

12. Contact

Questions or complaints about privacy can be sent to support@sentinelconnector.io or by post to TrueCMS Pty. Ltd., PO Box 8007, Carrum Downs VIC 3201, Australia. Our contact page lists our support and general addresses.