Privacy is enforced at the collector - not promised in marketing.
Code paths for capturing file content, keystrokes, or screenshots do not exist in the agent. Every alert ships with a verifiable receipt of what data was used to produce it.
WHAT WE REFUSE TO SEE
A refusal list, enforced in the agent - not promised in a PDF.
Keystrokes
Behavioural shape, not typed content, is what an insider’s pattern shows. Storing keystrokes is surveillance theater that creates legal liability without adding signal.
Screen content
A screenshot pipeline is a continuous capture of everything an employee reads and writes. That category of data has no legitimate home in an insider-risk product.
Document contents
Files are observed by their shape and movement, never by what is inside them. The product cannot regress into a content scanner because the capability does not exist in the agent.
Email and chat bodies
Communication content belongs to the people communicating. Insider-risk signal lives in patterns of access and movement, not in the messages themselves.
Browsing history
Page-level browser history mixes work and personal activity in ways no employer should ingest by default. Network-layer signal is sufficient and proportional.
Microphone and camera
Audio and video capture have no place in a behavioural-risk platform. There is no code path in the agent that activates either device.
The capabilities above are not toggles. There is no configuration, update, or operator role that turns them on.
WHAT WE OBSERVE
Categorically - shape and movement, never content.
The categories below describe what an insider-risk platform needs to see at all. Specifics live in the per-tenant privacy receipt, not in marketing copy.
Behavioural signals across the host layer
Characteristics of activity on the device, categorically, not content. Shape and movement, not what is inside.
Identity-anomalous patterns across login and access
Where, when, and how privileged actions occur, relative to a user’s own history and the history of their peers.
Network-level destination diversity
The diversity and timing of outbound destinations a host reaches. Destination categories, not page content.
Persistence and integrity changes
Changes that affect whether the host will behave the same way tomorrow as it did yesterday. State, not content.
A receipt of exactly what your tenant's data shows - exportable for audit.
Every tenant admin can export a privacy receipt covering the trailing 30 days. It shows the categories of data Vedric processed (with counts), the categories Vedric explicitly did not collect, retention windows, and the audit-trail entries backing each. The export is sourced from append-only logs, so an auditor can cross-check it against the live database.
What an evaluation team will ask - answered up front.
Encryption
- TLS 1.3 in transit
- AES-based encryption for at-rest secrets
- OS-level credential vault on the endpoint
- Asymmetric signing for browser session tokens
Authentication
- Email + password + TOTP (mandatory for operator console)
- SAML 2.0 SSO with per-tenant IdP configuration
- JIT user provisioning and group → role mapping
- Force-signout via SAML SLO and admin control
Tenant isolation
- Tenant scoping enforced at the data access layer
- Build-time tests fail if any tenant code path bypasses scoping
- Cross-tenant access only via privileged operator role + audit log
- Per-tenant encryption keys for sensitive fields
Audit trails
- Three independent append-only logs
- Database-level enforcement against UPDATE / DELETE on audit tables
- Tenant-visible audit log + operator-only audit + permanent forensic trail
- Every privileged action stamped with actor, time, reason
Agent integrity
- Every update signed with an offline Ed25519 key and bound to its version
- Installer refuses any binary that fails signature verification
- Auto-update verifies signature before swap; rollback on failure
- Tamper-resistant; key never on the production host
Operational
- Live system status at status.vedric.io
- Configurable retention windows for events, alerts, audit data
- Daily automated backups with documented restore procedure
- Off-site backup mirroring to a separate region
- Production change-control with full audit history
PROCUREMENT
Procurement-ready documentation.
Standard artifacts security teams need before an evaluation. Available on request under NDA.