Policies & Agreements

Your rights and obligations as a Sentsai customer, including payment terms, limitations of liability, and acceptable use. Governed by Ontario, Canada law. Acceptance is version-stamped - if the terms change materially, you will be prompted to re-accept before running further scans or initiating payments.

What personal data we collect (account data, Microsoft 365 tenant data processed on your behalf, usage logs, payment confirmations), why and on what legal basis, how long we retain it, when and how it is deleted, and how to exercise your rights. Covers our dual role as both data controller (for your account data) and data processor (for your Microsoft 365 employee data).

Required by GDPR Article 28 and incorporated by reference into the Terms of Service - no separate signature needed. Defines Sentsai as data processor and your organization as data controller for Microsoft 365 tenant data. Covers sub-processor disclosures, technical and organizational measures, breach notification obligations (72-hour window), data subject assistance obligations, and deletion/return commitments.

Required for California businesses under the CCPA/CPRA. Certifies Sentsai as a Service Provider - we do not sell, share, or use the data we process for you for cross-context behavioral advertising or for any purpose other than providing the contracted service. Defines processing restrictions and Sentsai's obligations to your California consumers.

Every cookie Sentsai uses. The signed-in app uses only strictly necessary cookies: an opaque session identifier (sentsai_session_id, 8 hours, backed by a server-side Redis store), a tenant reference (sentsai_tenant_id, 30 days) and a short-lived CSRF token (oauth_state, 10 minutes, sign-in only), all HttpOnly, Secure and SameSite=Lax. The public website can also use optional Google and Microsoft advertising, analytics and session-recording cookies: off until you accept outside the United States; advertising and analytics on with a one-click Reject inside it; session recording only if you switch it on; never in the app.

Audit-ready technical detail: OAuth 2.0 read-only access model, RS256 id_token cryptographic verification, server-side session architecture with Redis, field-level AES-128-CBC encryption with startup self-test, PostgreSQL audit log immutability trigger (SOC 2 CC7.2), GDPR data subject rights endpoints, Stripe webhook signature and BOLA controls, HTTP security headers (CSP, HSTS, Permissions-Policy), and container non-root execution.