Privacy Protection
No cookies or tracking
Sentinel does not use cookies or fingerprinting. It avoids consent requirements by design, and backs that up with automated cleanup: verification logs are anonymized and automatically discarded after a short, configurable period.
Ephemeral Device Keys (EDK)
To still support rate-limiting and security enforcement without persistent tracking, Sentinel uses Ephemeral Device Keys (EDKs) — short-lived, non-persistent identifiers, generated to adhere to strict data-privacy regulations.
How EDKs work
- An EDK is derived from HTTP headers and the device's IP address, then hashed with a cryptographic hash function (SHA-256) under a rotating daily salt — this is what makes the key unlinkable across days and resistant to reverse-engineering.
- Keys are generated daily and valid for up to 24 hours, so rotation is automatic; there's no long-lived identifier to manage or revoke.
- EDKs are used only for temporary device identification within that window — not for long-term tracking or user profiling. They exist to let Sentinel recognize "the same device, right now" for rate-limiting and abuse detection, without building a persistent record of who that device belongs to.
Data privacy compliance
The EDK design is built around three specific properties:
- Minimized data — an EDK is derived from device-level attributes, but isn't directly linked to an identifiable individual.
- Non-persistent — daily key rotation prevents tracking any user or device beyond that day.
- Legal basis — this processing relies on legitimate interest under GDPR Article 6(1)(f), balancing system integrity (bot/abuse detection) against user privacy, rather than on consent.
IP anonymization
When IP addresses are stored — in request logs or form submission data — anonymization is enabled by default via ANONYMIZE_IP_ADDRESS=1: the last segment of the address is dropped before storage, so 123.123.123.123 becomes 123.123.123.0. ACCESS_LOG_ANONYMIZE_IP_ADDRESS controls the same behavior specifically for access logs.
Retention
Verification logs are anonymized and automatically discarded after a short, configurable window — 72 hours by default, via REQUEST_LOGS_TTL.
Related
- ENV Variables —
ANONYMIZE_IP_ADDRESS,ACCESS_LOG_ANONYMIZE_IP_ADDRESS,REQUEST_LOGS_TTL. - Human Interaction Signature — the interaction signal this privacy model applies to.