RECORDS
Where the records live
Session records stay on your machine by default, with no hosted account, cloud database or background upload. Optional Witness review and feed-sharing commands can send metadata to a chosen provider or expose published indicators when you run them. Review the Witness privacy documentation before you use those commands.
DVC receives an export only if you choose to send one, and only after you have read it. Run witness verify to check its hash-chain consistency. This check does not establish the export's origin, completeness or an independent timestamp.
EXCLUSIONS
What the records contain
Full tool arguments and results are stored as SHA-256 digests. Optional allow-listed summaries contain plaintext. Keys matching token, secret, password, authorization, cookie, api_key or credential are excluded from summaries, even if allow-listed. Other summary values and metadata can still contain sensitive data, so review an export before you share it.
The session log describes observed tool calls, their local timestamps, declared principals and server-reported results. It does not verify who acted or approved a call, or independently prove what changed in the target system. HTTP headers are never recorded.
BEHAVIOUR
What Witness does not do
It does not modify traffic, block calls or approve calls. The session recorder has no background upload. Every frame passes through byte-for-byte; the recording path cannot delay, alter or drop a frame.
It is read-only by default and has no dependencies. If it cannot write its log it says so on stderr and keeps relaying - recording can be lost, uptime cannot. You switch it off by restoring the backed-up config.
ACCESS
Access and paperwork
Work is performed under your NDA. An MSA and a DPA are available on request before any access is granted.
Everyone who will touch your systems is named to you before access is granted, and works under your NDA. If that list changes mid-engagement, you approve the change before it happens - there is no standing pool of people who can be rotated in.
ENTITY
Who you are contracting with
Dark Vector Cognition LLC, a Texas limited liability company, based in Austin, Texas.
Professional liability coverage is bound before an engagement begins, with limits agreed in the MSA to match the scope and duration of the work. A certificate of insurance is provided at contracting.
The recorder is Apache-2.0 and public, so what runs inside your environment can be read line by line before it runs.
DISCLOSURE
Responsible disclosure
Findings from your engagement are shared with you and no one else. They are not published, not used as a case study, and not shown to another prospect - not in redacted form, not as an aggregate statistic.
If a Flight Check surfaces a vulnerability in third-party software, we will tell you first and agree the disclosure path with you before contacting the vendor.