Security & data
How okokumo hosts and protects your data — see also the full legal notices and privacy policy.
Data location
Hosted on Scaleway infrastructure located in France (fr-par region). A second, EU-based probe region exists for monitoring redundancy only — it never stores your personal data, only transient check-execution results in transit.
Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Scaleway SAS | Hosting: compute, storage, managed database, DNS, transactional email for alerts | France |
| Stripe | Payment processing and billing | EU (Stripe Payments Europe Ltd, Ireland, for EU customers) |
Technical measures
- TLS on all customer-facing endpoints, Let's Encrypt-issued, auto-renewed.
- Passwords stored as salted bcrypt hashes — never in plaintext.
- Session-based authentication with secure, httponly cookies.
- Multi-tenant isolation enforced at the application layer — every record is scoped to an organization, every query is organization-scoped.
- Webhook alert payloads are HMAC-signed so recipients can verify authenticity.
- Infrastructure provisioned via version-controlled Terraform; deploys via CI/CD with a full audit trail.
Retention
Account and organization data is kept for the lifetime of your account. On account deletion, personal data is deleted or anonymized within a reasonable delay, except where French or EU law requires longer retention (e.g. billing records).
Measurements we generate by probing you — each check result, with its latency, status code and the error text our own probe recorded — are kept for 90 days, then deleted automatically. 90 days is the widest window anything in the product reads: a public status page draws 90 days of history per component, and nothing looks further back.
That 90 is a floor rather than an average. Check results are dropped a whole block of storage at a time and each block covers a week, so an individual result can outlive its 90th day by up to a week before its block goes. It is never deleted before it.
Text your own job sends us is kept for less time, because it is yours rather than ours. When a
scheduled job reports its own failure through POST /ping/<token>/fail, it can
attach its output, and that output can carry stack traces, internal hostnames, or a connection
string sitting in an error message. We delete it after 30 days. It exists to
tell you why a run failed, which is a question asked while the incident is live or in the days
after it, and holding your logs for three months to serve a one-week question is exposure with
nothing on the other side of it.
30 is a floor too, but a tighter one, because a different mechanism enforces it: captured output is cleared by a pass that runs once a day rather than by the storage blocks above. So it outlives its 30th day by up to a day, not by up to a week.
The incident record is not the output, and it stays: that a check went down at 02:14 and recovered at 02:51 is a small, useful row we keep for the lifetime of your account, long after the job output attached to it is gone.
All of this is the same on every plan, free included. We do not sell longer retention as an upgrade, and there is no tier where your data is kept around longer than on any other.
Neither window is the only way data leaves. You can request erasure under Art. 17 GDPR at any time, which deletes an organization's monitoring data immediately and in full instead of waiting for a window to run out.
Data Processing Agreement
Read the full DPA (Art. 28 GDPR structure) online, or use your browser's print-to-PDF to save a copy: View DPA.
Live status
Curious whether Sentinel itself is up right now? Live system status.