The production Web surface has no admitted request channel for analytics, uploads or remote processing.
LOCAL FORENSIC WORKSPACE · ZERO TELEMETRY
Nothing leaves the Keep.
Privacy is an execution property, not a marketing promise: no telemetry path, no upload path and no hidden network fallback in the admitted Web runtime.
Analysis may mask presentation. Sanitization and transformation create explicit new artifacts instead of rewriting source state.
Static releases carry deterministic manifests, SBOM/provenance evidence and bounded deployment readback.
TRUST CENTER / FIVE QUESTIONS
Every result should answer what happened, where it came from and what crossed a boundary.
01
What did the engine read?
Exact local input and declared runtime profile.
02
What did it infer?
Findings carry evidence and confidence rather than unexplained certainty.
03
What did it change?
Nothing implicitly. Derivatives disclose fidelity and loss.
04
What left the Keep?
Nothing through the admitted Web runtime; network fallback is denied.
05
Which release produced this?
Build and deployment evidence bind results to attributable versions.
SECURITY / PRODUCT RULE
Don't mutate while diagnosing.
Security masking must never alter the execution value consumed by another component. Displayed/redacted state and runtime state remain separate by design.
NETWORKDENYFILESYSTEMENGINE DECLAREDSHELLENGINE DECLAREDTELEMETRYNONE
Declared state is not runtime truth without readback.
Release and deployment paths are designed around exact source/artifact binding plus post-deploy health and inventory verification. Report security vulnerabilities privately to security@octetkeep.com; the Security Reporting page defines the coordinated intake boundary.