RECORDS
Where the records live
Records are written to a directory on your own machines. The recorder has no hosted account, no cloud database and no background upload; there is nowhere for them to go but your disk.
DVC receives an export only if you choose to send one, and only after you have read it. That export is hash-chained, so you can confirm independently that what we received is what your machines wrote — run witness verify against it yourself, with our code or your own reading of the format.
EXCLUSIONS
What is never recorded
Secrets, tokens, API keys, passwords, authorization headers and cookies are excluded by construction, not by configuration. Any key matching those names is dropped before a record is written, and stays dropped even if someone explicitly allow-lists it.
Tool arguments and results are stored as SHA-256 digests, not content. The record proves a call happened, when, by whom and with what outcome — it does not carry the file, the query or the message body.
BEHAVIOUR
What Witness does not do
It does not modify traffic, block calls, approve calls or phone home. Every frame passes through byte-for-byte; the recording path cannot delay, alter or drop a frame.
It is read-only by default and has no dependencies. If it cannot write its log it says so on stderr and keeps relaying — recording can be lost, uptime cannot. You switch it off by restoring the backed-up config.
ACCESS
Access and paperwork
Work is performed under your NDA. An MSA and a DPA are available on request before any access is granted.
Everyone who will touch your systems is named to you before access is granted, and works under your NDA. If that list changes mid-engagement, you approve the change before it happens — there is no standing pool of people who can be rotated in.
ENTITY
Who you are contracting with
Dark Vector Cognition LLC, a Texas limited liability company, based in Austin, Texas.
Professional liability coverage is bound before an engagement begins, with limits agreed in the MSA to match the scope and duration of the work. A certificate of insurance is provided at contracting.
The recorder is Apache-2.0 and public, so what runs inside your environment can be read line by line before it runs.
DISCLOSURE
Responsible disclosure
Findings from your engagement are shared with you and no one else. They are not published, not used as a case study, and not shown to another prospect — not in redacted form, not as an aggregate statistic.
If a Flight Check surfaces a vulnerability in third-party software, we will tell you first and agree the disclosure path with you before contacting the vendor.