What SentriKat sends home

Every field, listed

This table is the contract, not a summary of it. What the server does with a field that is not on it depends on where the field is.

• In the kb block, an unlisted field makes the server refuse the whole heartbeat with an error (HTTP 422). Inside a quality-signal entry, an unlisted key is discarded and logged instead.
• At the top level of the heartbeat, and among the usage counters, an unlisted key is ignored: it is not read, it is not stored, and the heartbeat is still accepted.
• In offline_bundle, an unlisted key is discarded and logged.
• In quality, a block in any other schema is discarded, a metric the server cannot read is dropped and counted, and the metrics it can read are stored as they arrived.
• Dataset names follow a separate rule, below.

The fixed list of datasets

row_counts, cursors and last_sync_failed_dataset accept these names and no others. Without a closed list, "a map of dataset names to timestamps" would be a map of anything to anything, and the sentence above it would mean nothing.

A name outside this list is discarded. It is never stored, and it does not cost the rest of the heartbeat: the fields around it are kept. Your instance is told in the response which names were discarded, so a partly accepted report cannot be mistaken for a complete one, and we record alongside your state how many were discarded, as a number and never as the names themselves.

Knowledge-base synchronization

Every 12 hours, an installation of any edition that is not air-gapped synchronizes its knowledge base with ours. Each request carries the installation ID and the edition and, with a license, the first 64 characters of the license key. Our license service stores the mappings (first row) only from Professional licenses and refuses them from other editions; it stores the software identities (second row) from any valid license.

What is never sent

Listed explicitly, because "we only collect what we need" is a sentence every vendor writes and none of them define.

• Any CVE found on one of your machines
• Any hostname, IP, or identifier of a machine you scanned
• Any file path, configuration, or SBOM
• Any user of your instance: no names, no email addresses, no credentials
• Any log line, stack trace, or free-text error message
• Any scan result, finding, ticket, or report

An example heartbeat

Nothing in this example is redacted: the values are made up and the field names are the real ones. It does not show these optional fields: license_id, usage.organizations, usage.api_keys, kb.last_sync_failed_dataset, kb.bundle_loaded_at, kb.oracle_signals, kb.oracle_signals_version, offline_bundle and quality. The table above lists every field.

POST https://api.sentrikat.com/api/v1/license/heartbeat

{
  "installation_id": "SK-INST-7F3A9C21B4E05D8A6C13F27B90D4E5A8",
  "license_key": "SK-XXXX-XXXX-XXXX-XXXX",
  "edition": "professional",
  "app_version": "1.4.2",
  "usage": {
    "agents": 42,
    "products": 137
  },
  "kb": {
    "row_counts": {
      "vulnerabilities": 312904,
      "cpe_dictionary": 1402883,
      "osv_advisories": 296118,
      "distro_advisories": 1469177
    },
    "cursors": {
      "vulnerabilities": "2026-08-22T04:15:00Z",
      "osv_advisories": "2026-08-22T03:25:00Z"
    },
    "last_sync_at": "2026-08-22T04:15:00Z",
    "last_sync_status": "ok",
    "bundle_version": null
  }
}

Read back what we hold

The table above says what we collect. This command says what we actually have, for your installation, right now. Run it whenever you like; it needs no new credential beyond your license key and your installation ID.

curl -sS https://api.sentrikat.com/api/v1/license/telemetry \
  -H 'Content-Type: application/json' \
  -d '{"license_key":"YOUR-LICENSE-KEY","installation_id":"YOUR-INSTALLATION-ID"}'

Besides what the payload carried, the response shows what the license service records about the installation itself: its edition and version, when it was activated and last seen, the address its requests came from, and a hostname and operating system description only if a client has provided them (the current SentriKat release provides neither), the report of the last offline bundle, and the times at which the knowledge-base state and that report were received. The data-quality reports are not in this response: they are kept apart, under the installation ID alone. They are deleted 180 days after we receive them, and when the account is deleted (unless the same installation ID also appears on another customer's account); freeing a seat does not delete them. To see them, write to [email protected].

If the response contains something this page does not list, this page is what is wrong. Tell us at [email protected] and we will correct it.

Turning it off

The license check-in itself cannot be disabled: it is how a license stays valid, and it is processing necessary to perform our contract with you (Art. 6(1)(b) GDPR). Knowledge-base synchronization can be switched off, with the settings in the table above. Air-gapped instances send nothing at all, by construction, and are licensed offline.

Retention, your rights, and who processes what are covered in the Privacy Policy and the DPA.