How Reliable Group Handles Your Data

In a standard GCC engagement

The team Reliable Group hires works inside your entity, on your systems, under your access controls. Reliable Group operates the local backbone (facilities, HR, payroll, statutory administration) and does not require access to your client data to do that work. Where an engagement does require access, the scope is defined in the services agreement rather than assumed.

In a Trace deployment

Capture runs on the machines your team designates and is limited to approved applications and windows. The record stays on the device in a local store inside your environment, with no captured content sent to any cloud service. Analysis runs inside your infrastructure. Access is restricted to named authorized personnel under the terms you agree, including Reliable Group personnel performing human validation inside your environment.

Capture and analysis both run inside your environment. No captured content leaves it, and there is no Reliable Group cloud in the path. Where no sufficiently capable in-boundary model exists for a given data set, that data set is not processed.

Only named applications are recorded. Applications and windows outside the list are denied at source: an excluded window is never admitted to the capture stream by the operating system, so its content is not captured rather than captured and then filtered. Screen text is read from the accessibility tree, with optical character recognition only where no text layer exists.

Microphone and system audio are not captured. Keystroke capture is disabled, so application switch events are retained but the content of typing is not recorded. Clipboard contents are not captured. Product analytics and crash reporting are disabled and verified before go-live, so no telemetry leaves your environment.

No screenshot frames are retained. Frames are used transiently to extract text where no accessibility text exists, then discarded. Storage is a local database with a full-text index and no media files. The data directory can be relocated to a volume your IT team approves, and file permissions on the store are restricted to the installing user and verified as an install step.

The engine exposes a local interface on loopback that is unauthenticated in its default product configuration. Reliable Group enables authentication and disables network exposure. There are no inbound network connections in this configuration.

Access to captured data and to the derived documentation is restricted to named authorized individuals who are US persons. Reliable Group offshore personnel do not have access to an engagement’s captured data. This applies to every Trace deployment, not only to regulated work.

Requests through the local interface are restricted to specified applications, windows and content types, with raw-database and raw-frame endpoints denied at the interface layer. Enforcement is a deterministic policy in the request path rather than an instruction to a model. Direct file access to the store is governed separately by operating-system permissions. Administrators set policy centrally and do not see captured content.

Every read of captured data made through our analysis layer is recorded in an append-only, hash-chained log. It runs as a supervised service bound to loopback, and installation of the endpoint agent is gated on the log being live and its chain verifying. The chain is verifiable in a single command. Off-box export to a location the endpoint cannot write, such as your SIEM or write-once storage, is available as an option and is what makes the record durable against a root-level adversary on the endpoint.

Outputs aggregate at task and procedure level. No individual is scored or ranked, whether observed or appearing incidentally. Generated documentation is reviewed and corrected by a person before it is treated as institutional knowledge.