What our program on your machine can and cannot do.
On our other tiers, nothing of ours runs inside your estate. Managed is the exception: you asked us to notice when your evidence stops being produced, and a machine that has died cannot report that it has died. So a small program of ours sits on your box and tells us it is still there.
That is a thing your reviewer should be suspicious of. These six conditions were written down before the program was built, so that they could not be traded away while building it — and each one names what holds it, because a condition nothing enforces is a promise, not a property.
The six conditions
It runs as its own user, with read access to one file.
It never opens an archive at all. Your own integrity check writes a small status file; the reporter reads that one file and nothing else. Constructing an archive object WRITES — it connects an index and creates directories — so what holds this is not care, it is that the reporter cannot reach the constructor. Two tests ask that two different ways.
It sends codes and counts, never the text of a finding.
The document has no field that can hold free text. A code this build does not know becomes `unmapped` rather than passing through, so a future finding cannot smuggle a sentence out.
No records, no payloads, and no subject identifiers.
A planted canary string is asserted absent from the document that is written AND from the bytes that leave the machine. Reasoning about which fields could carry one is how that gets missed; a canary is checked against every channel that is actually read.
It holds no key of yours.
Nothing in the distribution imports a signer or a store. It has nothing to hold.
It does not anchor, countersign, or talk to the witness.
Your own timer does that, on your box, with your own credentials.
It opens no port.
It imports no listener. It calls out, over HTTPS, and nothing calls in.
What leaves the machine
One small document, over HTTPS, on a timer. It carries how many archives exist, how far each has got, how old its last countersignature is, and a finding code where something is wrong. It does not carry what any of them are about.
The credential it sends with is minted here, shown to you once, and never stored — we keep only its hash, so from that moment on we could not present it if we wanted to.
What this does not protect you from
Managed detects a machine that STOPS reporting. It does not detect one that reports falsely: a box under someone else’s control could send us a document saying all is well. What that costs is worth being exact about — a forged report forges our view, never your evidence. The archive is still hash-chained and still countersigned by a witness in another organisation, and a court reads those without us.
We would rather say that here than have it discovered during an incident.
Questions your review will have
The installer, the unit files and the source of the reporter are yours to read before you run any of it, and we will send them without a conversation first. Write to hello@tallwright.com.