# What data does Cyber Crucible collect — and what does it never collect?

**Short answer:** Cyber Crucible operates under a Zero-Content Harvesting directive. It processes system operational telemetry — process execution paths, parent-child process chains, hardware execution indicators, and memory integrity states — analyzed locally on the endpoint. It does not collect, transmit, store, or process encryption keys, credentials, session tokens, or your files.

## Strictly excluded categories

Cyber Crucible software does not collect, transmit, store, or process:

- **Cryptographic variables** — private keys, decryption keys, and application encryption keys.
- **User credentials** — user passwords, Active Directory secrets, and API private keys.
- **Session identifiers** — OAuth tokens, access tokens, refresh tokens, and session cookies.
- **Customer content data** — proprietary files, documents, database contents, email bodies, and user communications.

## Why full protection doesn't require harvesting content

Full capability of the threat prevention software is achieved without harvesting or exfiltrating private customer content. The behavioral engine evaluates *what a program is doing* — which processes are reaching where, having done what beforehand — and none of that requires opening the file or reading the secret.

This is the same principle behind identity protection: access is traced and analyzed without the credential itself being accessed.

## Where analysis happens

Process execution paths, process lineage, hardware execution indicators, and memory integrity states are analyzed **locally on the endpoint**. Where cloud-assisted or centralized management is enabled, outbound administrative telemetry is limited strictly to the operational indicators needed for system health monitoring and security reporting.