Research

SentriRail publishes aggregates only when the cohort is large enough. No "Observed by SentriRail" claim is invented.

Governance

• Minimum 30 organizations, 100 sites, 500 scans.
• Anonymization: no hostnames, no e-mails, no client tokens, no network payloads.
• Forbidden: individual_site, client_identity, raw_html, form_data, credentials.

Insufficient cohort (min 30 orgs, 100 sites, 500 scans). Flag research_benchmarks off.

SentriRail is a drafting aid. It is not legal advice. You are solely responsible for whether generated documents fit your situation. When in doubt, consult a privacy lawyer.