The University does not use S1 to watch an individual’s personal use of the University networks or devices. The University will not use this data to support investigations related to employee productivity, attendance/activity and any other general monitoring of behaviour not directly associated with security threat protection at the University.

Designated Information Security staff will interact with the data only if a security threat alert has been triggered. S1 uses artificial intelligence to analyze basic file data such as file name, size and file hashes to find potentially malicious files. Still, it does not analyze content data beyond threat detection. This is consistent with best practices to mitigate against constantly evolving cyber threats.

SentinelOne does not record keystrokes. In addition, it does not access or record the contents of:

• Documents
• Email messages
• IM/chat communications
• Login credentials (e.g. bank, ROSI, etc.)

If a security alert is triggered, SentinelOne agent (if set up in Protect mode) will automatically block the threat and quarantine any malicious files. The alert and the associated actions performed by the agent can be found on the SentinelOne user interface under threat history and quarantined files. In a few cases, when the tool is not successful at remediating the threat, designated information security staff at your unit may take further actions such as isolating the device from the network. In such cases, you will be informed by your unit’s IT team.

SentinelOne monitors all applications and files for signs of malicious activity. Data files, being inactive, are ignored unless they contain malicious code. Additionally, SentinelOne compares hashes and other markers of all files against those of known malicious files. Malicious files found on systems may be downloaded individually for further analysis, with the knowledge of the end user. These downloads are encrypted and recorded in the activity log. Search results for a specific suspicious file may also be downloaded in this manner; any file that is not part of a cybersecurity investigation is ignored.

Information collected is only used for protection against security threats. It is not used to support investigations related to employee productivity, attendance/activity and/or any other general monitoring of behaviour not directly associated with security threat protection at the University.

SentinelOne does not have access to data within your files. It can only read information about your file (metadata) such as filename, author and file path. As such, we recommend that you do not include any personal/sensitive information in the filename and other metadata for your file.

However, if a security alert is triggered, designated information security personnel may request remote access to a file that is flagged as malicious. Such access will be time-bound and will occur with your knowledge and permission. Access is limited to authorized information security staff who are required to sign a confidentiality agreement with the University as part of a formal access request and approval process.

SentinelOne does not specifically monitor users’ browser activity. However, as it looks for malicious activity, it captures information about sites and files accessed via browsers by users, devices and automated processes. Typically, majority of these records pertain to automated processes, with user activity constituting only a small fraction.

SentinelOne cannot access the virtual machines on your system unless you have specifically deployed SentinelOne agent on the virtual machine itself.

SentinelOne monitors all applications on your system for signs of malicious activity, but it cannot access those applications. It tracks the names and versions of installed applications to identify security vulnerabilities on them. In addition, SentinelOne maintains a log of activities related to services and applications running at any given time. This is needed to track progress of malicious activity and, ideally, roll back any unauthorized changes. Information about process/application activity is only used for the purposes of security threat detection and is automatically deleted in accordance with the retention policy.

SentinelOne provides remote console capabilities that allow information security personnel to use command-line prompts for accessing endpoints remotely. This capability is available to a limited number of security personnel and is solely used for cybersecurity investigations. Remote access is conducted with the knowledge and permission of the end user (for end-user devices) or IT administrators (for infrastructure assets).

SentinelOne does not collect login credentials for websites. At most, it collects URLs for websites visited by you, your device or automated processes running on your device.

The likelihood of something like this happening is very low. In 2023, there were 26,447 new vulnerabilities but only 97 zero-day exploits. It is more probable that a vulnerability on an unprotected device would be exploited, potentially leading to data loss, rather than a zero-day exploit specifically targeting SentinelOne and causing a data breach.