Hosting

Docker + Caddy as described in docs/DEPLOYMENT_VPS.md. SQLite on a persistent volume. No PostgreSQL migration while workers stay single-process.

Encryption

HTTPS via Caddy. HMAC session cookies. bcrypt passwords. Webhook secrets wrapped (AES-256-GCM). Optional LOGGED_IN vault with a dedicated server key, never logged.

Backups

Daily VACUUM INTO, configurable retention, status in data/backups/status.json, file-open test. An untested backup is not treated as reliable.

Subprocessors

VPS host (configured by the operator) — Application hosting and SQLite (Depends on deployment)
Resend — Transactional email if RESEND_API_KEY is set (EU / US depending on account)
Stripe — Subscription payments (See Stripe DPA)

Retention

Scan history follows plan quotas. Screenshots 14 days, off by default, signed URL. Runtime observability: aggregated third-party hosts, never form contents or identity.

Security policy

Revocable HMAC sessions, public rate-limit 10/min/IP, scanner SSRF protection, network secret redaction, no tracking in transactional emails. Viewer is read-only on the server.

DPA

A formal DPA is negotiated with the deployment operator (often the agency itself, local-first). Stripe and Resend have their own DPAs if you enable them.

Uptime

Local technical status: /status. No hosted external status page yet.

Contact

Operator contact: MAIL_FROM / agency account email. No public bug-bounty programme.

Responsible disclosure

Report a vulnerability to the operator email (MAIL_FROM). No public bug-bounty programme for now. Dedicated external status page not deployed.

SentriRail is a drafting aid. It is not legal advice. You are solely responsible for whether generated documents fit your situation. When in doubt, consult a privacy lawyer.