Security posture, stated plainly.
What the product does with your directory, what it never does, how releases are signed, and how to report a vulnerability. Items marked as placeholders are unpublished, not unknown to the company.
Reads
Active Directory attributes: servicePrincipalName, msDS-SupportedEncryptionTypes, msDS-AllowedToDelegateTo, msDS-AllowedToActOnBehalfOfOtherIdentity, TrustedForDelegation, pwdLastSet, msDS-KeyVersionNumber where readable. Local service configuration on hosts you point it at.
Writes
servicePrincipalName on one account at a time, six providers only, ShouldProcess-gated. Files you ask it to export: plans, hand-off bundles, runbooks, reports.
Never
Keytabs, passwords, or any secret. It does not send telemetry: there is none. The shipped module contains no outbound call of any kind — no usage counter, no ping, no error report. It does not call home for licensing at all. The token is verified against a public key that ships inside the module, so verification completes with no network available — which is what lets it run on an isolated network.
- release signing
- Module and evidence packs are signed. Key fingerprint:
{{SIGNING_KEY_FINGERPRINT}} - verify
- Steps:
{{VERIFY_STEPS}} - SBOM
{{SBOM_URL}}- dependencies
- Third-party components and licences are listed on the license page →.
- tests
- Unit suites for the PowerShell module and the C# engine, run on every change. Counts are not published here: they move with the work, and a figure that is a week stale reads worse than none.
- coverage
- Line coverage is measured, and treated as a floor rather than a result. Mutation score is the number that governs: it asks whether a test would fail if the code changed, which coverage cannot.
- mutation testing
- On top of coverage: would the test fail if the code changed
- live proof
- Ephemeral forests in AWS and Azure; signed evidence packs. Proof and evidence →
Report vulnerabilities to {{SECURITY_EMAIL}}. Acknowledgement target, remediation target, and safe-harbour statement are on the vulnerability disclosure page →.
- legal entity
- Detent Point LLC
- jurisdiction
{{JURISDICTION}}- data handling
- Data handling and sub-processors →
- privacy
- Privacy policy →