Privacy Policy

The data controller is Meridian Infrastructure Ltd, trading as Zentinel, a private limited company registered in England and Wales under company number 17221205. Questions about your data go to hello@zentinel.dev.

When you book an assessment. The booking form asks for your name and email, and optionally your company, the URL of the application to be tested, a short description of what it does, and rough answers about its type, whether it has user accounts, whether it handles payments, and roughly how many users it has. All of it is information you type in deliberately.

When you pay. We ask for the country you are billed in. Payment is handled by Stripe, which collects your billing address and, if you give one, your VAT or GST number, so tax can be calculated correctly. Card details go to Stripe directly and never reach our servers. We store the checkout session and payment identifiers so a payment can be matched to your engagement.

When you use the client portal. Your email address, sign-in sessions, and, if your organisation uses Google or its own SSO provider, the identity information that provider returns to us.

When you browse the site. Standard analytics: pages viewed, approximate location from IP, device and browser type, and which links you click. We also record anonymised session replays, which show how people move through the page, so we can see where the site is confusing. Replays never capture what you type: every form field is masked before the recording leaves your browser, so your name, email and company are not in them. We use this to understand what parts of the site are useful, nothing more.

During an assessment. Findings, evidence, and the report we produce for your scope. This is the most sensitive data we hold and it is covered in more detail below.

When you authorize a white-box assessment. Code Review and Hybrid engagements include read-only access to your repository. We use it solely to perform the assessment: it is cloned read-only into an isolated, encrypted working environment used only by the engineer assigned to your engagement, never shared, never copied into analytics or marketing systems, and never used to train or fine-tune any model. Working copies are deleted within 7 days of report delivery and your access grant is removed at the same time. You can revoke access at any moment.

When you run the free exposure check. The domain you enter. The check only runs once a DNS record proves you control the domain; we compute the expected record from the domain itself, so nothing about the verification is stored. To check it we query public DNS and certificate-transparency logs (crt.sh, operated by Sectigo, and Cert Spotter, operated by SSLMate), which means those services see the domain, and we make a few ordinary requests to the domain itself. The result is held in memory for up to 15 minutes so repeat checks do not hit the site again, and is not stored. The domain appears in our server logs. Rate limiting uses a short hash of your IP address, never the address itself. If you ask us to email the results, we keep your email address, the domain and when we wrote to you, send the results once and one reminder 30 days later, and nothing else. The reminder can be cancelled from the link in the email.

When you request a quote. Your name, email, optional company, and what you tell us you need. It is stored with our other enquiries and emailed to our team so a person can reply.

On a continuous plan. The automated monitoring results for your in-scope targets: DNS records, subdomains, certificate and header details, and what changed between checks. They are stored with your engagement and visible only to your organisation and to us.

If you publish a verification badge. Your organisation owner chooses to make a verification page public. It shows your organisation name, the application name you set, your verified domain and whether testing is active. It never shows findings, assessment dates or your testing schedule. Disabling the badge takes the page down. To issue it we keep the domain you verified and, if you use the install checker, the result of one fetch of that domain's homepage. We count verification-page views and badge loads per day, as totals with no visitor identifiers, and show them to you in the portal.

• Card numbers, CVVs, or any payment instrument details. Stripe handles those and does not pass them to us.
• Passwords. Sign-in is by emailed link, Google, or your own SSO provider, so we never hold a password for you.
• Your customers' personal data, beyond the minimum needed to demonstrate a finding. Where a finding requires evidence involving real records, we take the smallest possible sample and redact it in the report.
• Anything from systems you have not authorised us to test.

We keep the list short on purpose. Each of these has access only to what its function requires:

Findings from your engagement belong to you. We do not publish them, name you as a client, or use your engagement as a case study without your written permission. Where we describe our work publicly, as on our own home page, targets are generalised, payloads are withheld, and no client is identified.

Report files are stored in a private Google Cloud Storage bucket with public access prevention enabled, reachable only through time-limited links issued to you.

• Booking submissions that do not become engagements: 12 months, then deleted.
• Engagement records, findings, and reports: 24 months, so we can re-test and compare against your previous assessment. You can ask us to delete them sooner.
• Source code provided for white-box assessments: working copies deleted within 7 days of report delivery, and the repository access grant is removed at the same time. It is not kept for the 24-month engagement window.
• Continuous monitoring results: kept with your engagement records, on the same 24-month basis.
• Payment records: as long as tax and accounting rules require.
• Analytics: per the retention defaults of PostHog and Google Analytics.

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email hello@zentinel.dev and we will action it. If you are in the UK or EU, the usual GDPR rights apply and this is how you exercise them.

Our analytics run on PostHog's EU cloud specifically so that product analytics data stays in the EU.

Questions about any of this go to hello@zentinel.dev. A person reads it.