Compliance and security review documentation

What ET Ducky holds today

A control mapping is a self-assessment performed by the vendor. It has not been examined by an independent auditor and is not offered as a substitute for one.

Documentation by framework

Cyber insurance endpoint control questions

The endpoint control questions on an application or a renewal, each answered with the specific mechanism: behavioral detection, automatic isolation and its dual-approval release, command logging, retention tiers, and where data is stored. Written to be forwarded to a broker or an underwriter without editing.

HIPAA Security Rule endpoint controls

Which Security Rule citations an endpoint agent produces evidence for, principally 164.312(b) audit controls and 164.308(a)(1)(ii)(D) activity review, plus the narrow route by which an identifier could enter telemetry and the business associate question that follows from it.

SOC 2 endpoint logging controls

The full control mapping to Trust Services Criteria CC6 and CC7, the records available as evidence in a customer's own audit, and the attestation status stated first rather than last.

GLBA Safeguards and FFIEC endpoint monitoring

Which regime applies to which institution, since banks and credit unions answer to different citations than non-bank financial institutions for the same control, then the endpoint requirements themselves: 314.4(c)(8) logging, (c)(5) multi-factor authentication, (c)(3) encryption, (c)(6) disposal and the (d) monitoring alternatives.

Public sector procurement facts

Authorization status first because several requirements are disqualifying, then hosting and United States data residency, sub-processors, the self-hosted deployment for agencies that cannot place telemetry with a cloud vendor, and contracting facts.

Where the platform fits in a control program

An endpoint monitoring agent produces evidence for a specific band of requirements and nothing outside it. The band is roughly: logging of privileged user activity, detection of unauthorized or anomalous behavior, containment of a compromised endpoint, endpoint configuration posture, patch state, and encryption of the data the platform itself holds.

It supplies nothing for risk assessment, workforce training, policy, physical safeguards, contingency planning, board reporting or vendor contracting. Those are program obligations, and any vendor page suggesting otherwise is selling.

The one structural claim worth making is about where evaluation happens. Behavioral rules are evaluated against events already streaming from the kernel, through Event Tracing for Windows on Windows and eBPF on Linux, rather than against a report from the process being evaluated. For a reviewer asking how unauthorized activity would actually be noticed, that is the substance of the answer.

Deployment options that change a review

Two facts often resolve a review that would otherwise stall.

Self-hosted. The Local-First tier runs the same server codebase on customer infrastructure. Cloud-only surfaces are removed from the application model at startup rather than blocked, no vendor-side secrets ship, and endpoint telemetry lands only in the customer's own PostgreSQL. For an organization whose vendor policy requires an attested provider, this moves the data out of scope for that policy.

Bring your own AI key. AI analysis is user-initiated rather than automatic, and it is the only path by which data leaves United States infrastructure. It can be disabled, or run against the customer's own provider key.