ClusterSentry Privacy Policy
This policy explains what information Tyler Pierce, doing business as ClusterSentry ("ClusterSentry", "we", "us") collects when you use the ClusterSentry website, dashboard, gateway, node agent, and Proxmox plugin (the "Service"). It also explains how we use that information and when we share it.
The short version:
- We collect only what we need to run the Service.
- We do not record the contents of the traffic we relay.
- We do not sell your data, use it for advertising, or share it, except with the service providers that make the Service work or when the law requires it.
1. Information we collect
Account information
- Your name and email address.
- Your organization's name.
- Your role and permissions.
- A one-way hash of your password. We never store the password itself, and we keep a short history of previous password hashes so a reused password can be refused.
- Public keys for any passkeys you register, together with the credential's label and the authenticator metadata the browser reports (attestation type, transport, sign counter, and backup eligibility/state).
- If you use Google or Microsoft sign-in, the provider's stable subject identifier for your account.
- If you choose SMS for multi-factor authentication, your phone number.
- The last time your account was active.
Organization and contact records
- Your organization's billing, technical, support, emergency, and administrative contacts — name, email address, and phone number — which you provide.
Invitation records
- When someone is invited to an organization we record the invitee's name, email address, phone number (if provided), and role, whether the invitation was accepted, and its delivery status, until the invitation is accepted, cancelled, or expires.
Sign-in with Google or Microsoft
- If you use it, we receive your name and email address from that provider to identify your account.
- We do not receive your password for that provider.
Billing information
- Payments are processed by Stripe. We do not receive or store your full card number.
- We keep your Stripe customer and subscription IDs, your plan, your billing status, your invoice history, and the card brand and last four digits that Stripe shows us.
Cluster and node information
- From the agent on your nodes:
- hostnames and IP addresses;
- Proxmox and agent versions;
- node and cluster status;
- resource metrics such as CPU, memory, disk, and uptime;
- hardware inventory the agent reports: device manufacturer, model and serial number; CPU model and core/thread counts; RAM module details; disk SMART health and attributes; and storage-pool layout.
- We use this to show your dashboard and send alerts.
Security and audit records
- Sign-ins, sessions, and administrative actions, each with its time, IP address, and browser user agent.
- Which user opened a session to which cluster, and when.
- Failed sign-in attempts, recorded by email address, IP address, success or failure, and time. These records do not include a browser user agent, and we record attempts for the email address entered even if it does not belong to an account.
- Free-text detail attached to some audit entries (for example, a profile change), which can include the values that changed.
Outbound notification records
- The recipient address, subject, delivery status, and queued message content for the emails and SMS security codes the Service sends. The message content is encrypted at rest and erased once it is delivered or fails permanently.
Support access
- If you grant our support team temporary access to your organization, we record when that access starts and ends, and what is done during it.
2. What we do not collect
Relayed traffic
- Your Proxmox web interface, API calls, and console sessions travel through our gateway over an encrypted tunnel so they can reach you.
- We do not record, store, or inspect the contents of that traffic, such as page content, console input or output, VM data, or files.
- We log only the connection metadata described above.
Tracking
- No advertising or third-party analytics trackers.
- No cross-site tracking.
- We do not sell or "share" personal information for targeted advertising, as those terms are defined under US state privacy laws.
3. How we use information
We use information only to:
- provide, operate, and secure the Service;
- authenticate you;
- send the alerts, invitations, password resets, security codes, and billing notices you need;
- process payments;
- respond to support requests;
- detect and prevent abuse;
- comply with legal obligations.
We do not use your data for advertising, and we do not use it to build profiles about you.
4. Cookies and local storage
Cookies we set. We use no advertising or analytics cookies, so there is no cookie banner.
| Cookie | Purpose |
|---|---|
clustersentry_session | keeps you signed in (Secure, HttpOnly, SameSite=Strict) |
__Host-clustersentry_proxy | carries the short-lived ticket that opens a proxied Proxmox console |
clustersentry_sso_invitation | holds the single sign-on invitation hand-off while you complete sign-in with Google or Microsoft |
clustersentry_sso_pkce | holds the OAuth PKCE verifier for the single sign-on flow |
Relayed Proxmox cookie. When you open a Proxmox web interface or console through the gateway, the Proxmox session cookie (PVEAuthCookie) that your own Proxmox host issued is relayed to the gateway origin so the proxied session works. It is set by your Proxmox host, not by ClusterSentry, and is used only for that console session.
Browser storage. We use no IndexedDB, no service worker, and no third-party storage. The dashboard keeps only these keys in your browser, and it never writes your session token to browser storage:
| Key | Storage | Purpose |
|---|---|---|
cs-theme | localStorage | your light/dark/system theme preference |
clustersentry_rail_expanded | localStorage | whether the navigation rail is expanded |
clustersentry_last_org | sessionStorage | the organization you last selected, so sign-in returns you there |
These preferences are functional, not tracking: they are used only to render the dashboard the way you left it, and clearing them simply resets the defaults.
5. When we share information
We share information only with the service providers below, and only as far as each needs to perform its function:
| Provider | Purpose |
|---|---|
| Stripe | payment processing and the billing portal |
| SMTP2GO | delivering email |
| Textbelt | delivering SMS security codes (only if you choose SMS) |
| Google, Microsoft | sign-in (only if you choose that provider) |
| Cloudflare | DNS for our domains, and the DNS challenge used to issue our TLS certificates |
| Let's Encrypt | issuing the TLS certificates for our domains |
| Our cloud hosting provider (United States) | running the Service's servers and database |
These are the only third parties the Service calls. It makes no analytics, telemetry, advertising, or software-update-check calls.
We also disclose information when we have to:
- Legal requirements: when the law, a subpoena, or a court order requires it. Where permitted, we will tell you before disclosing.
- Safety: to protect the rights, property, or safety of users, the public, or ClusterSentry.
- Business transfer: as part of a merger, acquisition, or sale of the business, under this policy's protections. We will notify you of any such transfer.
6. How long we keep information
| Information | How long we keep it |
|---|---|
| Account information | while your account is active |
| Node metrics | 90 days by default |
| Audit and security records | 90 days by default |
| Failed sign-in attempts | 30 days |
| Access and signup requests | 90 days if never decided; 180 days after a decision, then the personal details are deleted |
| Expired sign-in challenges, MFA codes, password-reset tokens, and single sign-on state | 30 days, or one day past expiry |
| Notification records | 30 days after the message is delivered or fails |
| Processed Stripe webhook records | 90 days |
| Billing records | as long as tax and accounting law requires. Stripe keeps its own records under its own policy |
The audit and metric retention windows are enforced by scheduled pruning jobs. Only a platform administrator (the "root" operator) can change them; organization administrators cannot.
Deletion
- An organization's data can be scheduled for deletion from the platform administration screen. The organization and its users lose access immediately, and there is a 30-day grace period during which the operator can restore it.
- After the grace period a scheduled deletion is permanent: we remove the organization's clusters, nodes, metrics, users, sessions, contacts, invitations, and audit records, and the organization's own audit entries are purged with them.
- We keep the billing and Stripe records described above (tax and accounting law requires it) and a minimal record that the organization existed and was deleted, with no other identifying information.
- Server backups are pruned to a 30-day window by a scheduled job; the single most recent backup is always kept.
- You can also ask us to delete personal data at any time (see "Your choices and rights"). We will delete it within 30 days, except where we must keep it by law.
7. Security
We protect information with the following measures:
- In transit: encryption.
- Encrypted at rest: our provider API keys and other service secrets, the queued content of outgoing notification messages, and phone numbers in multi-factor, invitation, and organization-contact records are encrypted at rest with AES-256-GCM. Passwords are stored only as one-way bcrypt hashes; password, reset-token, invitation-token, session-identifier, and enrollment-credential values are stored only as keyed hashes.
- Stored in plain text: some fields are kept unencrypted because they are needed for indexing, querying, and security decisions — for example session IP addresses and browser user agents (used for audit and abuse investigation), email addresses and notification subjects, and the card brand and last four digits Stripe reports. These are protected by database access controls and the network controls around the service.
- Sign-in: hashed passwords, passkeys and multi-factor authentication.
- Access: role-based access controls.
- Monitoring: audit logging.
No system is perfectly secure. We will notify affected users of a data breach as required by law.
8. Your choices and rights
What you can do yourself
- View and update your account information in the dashboard.
What you can ask us for
- A copy of your personal information.
- A correction to it.
- Deletion of it.
To make a request, email support@clustersentry.com. We will verify your identity and respond within 45 days.
State privacy laws
- Depending on where you live, laws such as California's CCPA/CPRA may give you additional rights.
- We will honor them, and we will not discriminate against you for exercising them.
- We do not sell personal information.
Organization accounts
- If your account belongs to an organization, some requests may be handled by your organization's administrator.
9. Children
The Service is not intended for anyone under 18, and we do not knowingly collect information from children.
10. Where data is processed
The Service is operated from the United States, and information is stored and processed there.
11. Changes to this policy
We may update this policy. If a change is material, we will notify you by email or in the dashboard before it takes effect. The effective date above shows the latest version.
12. Contact
ClusterSentry: support@clustersentry.com