# Privacy Protection

## No cookies or tracking

Sentinel does **not** use cookies or fingerprinting. It avoids consent requirements by design, and backs that up with automated cleanup: verification logs are anonymized and automatically discarded after a short, configurable period.

## Ephemeral Device Keys (EDK)

To still support rate-limiting and security enforcement without persistent tracking, Sentinel uses **Ephemeral Device Keys (EDKs)** — short-lived, non-persistent identifiers, generated to adhere to strict data-privacy regulations.

### How EDKs work

- An EDK is derived from HTTP headers and the device's IP address, then hashed with a cryptographic hash function (SHA-256) under a **rotating daily salt** — this is what makes the key unlinkable across days and resistant to reverse-engineering.
- Keys are generated daily and valid for up to 24 hours, so rotation is automatic; there's no long-lived identifier to manage or revoke.
- EDKs are used **only** for temporary device identification within that window — not for long-term tracking or user profiling. They exist to let Sentinel recognize "the same device, right now" for rate-limiting and abuse detection, without building a persistent record of who that device belongs to.

## Data privacy compliance

The EDK design is built around three specific properties:

- **Minimized data** — an EDK is derived from device-level attributes, but isn't directly linked to an identifiable individual.
- **Non-persistent** — daily key rotation prevents tracking any user or device beyond that day.
- **Legal basis** — this processing relies on **legitimate interest** under GDPR Article 6(1)(f), balancing system integrity (bot/abuse detection) against user privacy, rather than on consent.

## IP anonymization

When IP addresses are stored — in request logs or form submission data — anonymization is enabled by default via `ANONYMIZE_IP_ADDRESS=1`: the last segment of the address is dropped before storage, so `123.123.123.123` becomes `123.123.123.0`. `ACCESS_LOG_ANONYMIZE_IP_ADDRESS` controls the same behavior specifically for access logs.

## Retention

Verification logs are anonymized and automatically discarded after a short, configurable window — 72 hours by default, via `REQUEST_LOGS_TTL`.

## Related

- **[ENV Variables](/docs/sentinel/operations/env-variables/#security--access)** — `ANONYMIZE_IP_ADDRESS`, `ACCESS_LOG_ANONYMIZE_IP_ADDRESS`, `REQUEST_LOGS_TTL`.
- **[Human Interaction Signature](/docs/sentinel/features/human-interaction-signature/)** — the interaction signal this privacy model applies to.