Privacy is enforced at the collector. The agent has no code paths for capturing file content, keystrokes, or screenshots. A tenant admin can export a current privacy receipt that discloses collection categories, the bounded PowerShell script-preview exception, retention, and sharing settings. The receipt is a tenant-level disclosure, not a per-alert evidence signature.
Insider-risk patterns show in behavior, not in typed content. Storing keystrokes creates legal liability without adding signal.
Screenshots capture everything an employee reads and writes. That data does not belong in an insider-risk product.
The agent reports bounded sensitive-extension inventory counts and removable-media write metadata. It never reports file payloads or a per-file read history. The agent has no content-scanner capability.
Communication content belongs to the people communicating. Insider-risk signal comes from patterns of access and movement, not from message content.
Page-level browser history mixes work and personal activity, and employers should not ingest it by default. Network-layer signal is sufficient and proportional.
Audio and video capture do not belong in a behavioral-risk platform. The agent has no code path that activates either device.
This refusal list is enforced in the agent itself. These capabilities are not toggles. No configuration, update, or operator role turns them on.
Collection is deliberately minimized, with one documented script-text exception. The categories below are the minimum an insider-risk platform needs to see. Specifics are in the per-tenant privacy receipt.
Primarily process, authentication, file-system, and host-state metadata about activity on the device.
When and how often privileged activity occurs, and through which observed process and command shapes, compared with available personal and peer history.
Host-level connection counts, unique and new destination counts, and byte-rate deltas, plus bounded DNS metadata when configured. No packet or page content.
Changes that affect whether the host keeps behaving the same way over time. The agent records state, not content.
When host Script Block Logging is enabled, up to 2 KB of executed script text is retained after best-effort secret redaction. This is the one explicit exception where content is collected.
Every tenant admin can export a privacy receipt for audit. It covers the trailing 30 days and shows exactly what your tenant's data contains: the categories of data Vedric processed (with counts), the categories Vedric explicitly did not collect, effective telemetry/deviation and cold-archive settings, current AI-egress and aggregate-baseline choices, and online versus enrolled agents. Its HMAC is a server integrity checksum with a key ID. It is not an independently customer-verifiable signature. An auditor can compare the receipt with separately exported audit and database records.
The standard artifacts security teams need before an evaluation are available on request under NDA.
Current control descriptions and known deployment requirements are available for evaluation. This page does not claim a completed independent penetration test or certification.