# What is the difference between system telemetry and customer data?

**Short answer:** System telemetry describes how software is behaving — which process started which, what memory looks like, whether execution patterns are anomalous. Customer data is the content your business creates and holds — files, emails, database records, credentials. Cyber Crucible analyzes the first and never collects the second.

## A useful way to think about it

Telemetry is metadata about *machine behavior*. Content is the *information itself*.

Knowing that `process A` spawned `process B`, which then attempted to read a browser credential store while showing signs of in-memory modification, is enough to identify an attack. Reading what was in that credential store is not required — and Cyber Crucible does not do it.

## What this means practically

- Behavioral analysis is performed on identity access **without processing the identity information itself**.
- Telemetry that does leave the endpoint in cloud-assisted deployments is limited to operational indicators for health monitoring and security reporting.
- Technical and behavioral metadata is treated as personal data only where it can directly or indirectly identify an individual — and in those cases identifiers are pseudonymized or masked.

## Customer control

Telemetry sources are configurable. Organizations can tailor which sources are gathered, so no unnecessary information is acquired. Fields that aren't essential to threat detection are excluded or discarded.