AI/ML: Transparency and Choice

Throughout Sentry’s history, we’ve operated under a policy of privacy by default. This same principle applies to our work in the Artificial Intelligence (AI) and Machine Learning (ML) space, where we want to be just as transparent about what data we’re using and why.

Sentry is at a juncture where prior heuristics-based approaches cannot sustain the demands of the product. For example, fingerprinting error events as part of creating groups, has gotten a lot more complicated with the rise of JavaScript and the use of extensions and third-party services.

To train and validate models for grouping, notifications, and workflow improvements, Sentry will need access to additional service data to deliver a better user experience.

You can update these settings within the new “Service Data Usage” section of the Legal & Compliance page in Sentry, which is located within the “Usage & Billing” Settings.

Use of Non-Identifying Data

In accordance with our Terms of Service, Sentry may use non-identifying elements of your service data for product improvement. For example, we may aggregate web vitals data to show your site’s performance against a Sentry-built benchmark. The data accessed for the benchmark cannot be linked back to any particular project or customer, making it non-identifying.

Use of Aggregated Identifying Data

For upcoming features like priority alerts or ML-based grouping, Sentry is asking for access to the following forms of service data:

• Error messages
• Stack traces
• Spans
• DOM interactions

Use of Identifying Data for Generative AI Features

For upcoming features like Autofix that use Generative AI and Retrieval Augmented Generation (RAG), Sentry is asking for access to the following forms of service data:

• Stack traces
• Relevant code to linked repositories

All functionality leveraging RAG will require user opt-in. By opting in, you agree to our use of relevant stack trace and code from your linked repositories with generative AI models hosted by the feature-specific subprocessors identified on our subprocessor list.

To ensure our BAA customers can remain HIPAA compliant and that data stays in your selected region, we will disable generative AI features in Sentry for all BAA customers and EU region customers by default where we are unable to flow-down necessary BAA terms or where data storage in the EU region is not available, as applicable.

Data Access Summary

Data Handling

In addition to the consent mechanisms mentioned above:

1. We'll continue to encourage all customers to use our various data scrubbing tools so that service data is sanitized before we receive it.
2. We'll apply the same deletion and retention rules to our training data as we do to the underlying service data. This means that if you delete service data, it will also be removed from our machine learning models automatically.
3. We'll scrub data for PII before it goes into any training set.
4. We'll ensure that the only service data presented in the output of any generative AI feature belongs to the customer using the feature.
5. We'll only use AI models built in-house, deployed in our production cloud, or provided by our existing trusted third-party subprocessors who have made contractual commitments that are consistent with the above.

We're confident that with these controls in place, we'll be able to use service data to improve our products through AI while at the same time protecting that data.