Shadow Detective watches for one thing: AI tools running in a business that nobody approved. This page says, in plain language, exactly what it looks at, what it writes down, where that record lives, and who can see it. No legal fog — the legal text is in the Privacy Policy; this is the working truth.
On the machine. Installed AI applications, browser extensions, running processes, startup items, services, and local AI runtimes — observed directly, on the device.
On the network. Which devices connect to which AI services, and when — gathered from the wire, DNS, and firewall logs. Connection metadata only. The content of the traffic is encrypted and is never read.
In Microsoft 365 and Entra ID. Where a customer connects their tenant: enterprise apps, sign-ins, and Copilot interaction metadata — the AI activity that never touches a local file. Metadata, never content.
Each finding goes into the Living Register: what the tool is, where it lives, when it was seen, and the evidence behind it. Approvals are written down too — who approved a tool, when, and the scope of the approval — so an approved tool stops being flagged and the decision stays on the record.
What it records is the use, never the content: which AI tool ran, on which machine, when — and the evidence that it ran.
The Living Register lives in your environment: on the machine, station, or virtual machine the product runs on, under your administrators’ control. The console is local — it answers on the machine itself and is not exposed to the network. On plans that run on a hosted console, the Register reports to that console — the one the plan runs on.
Your own administrators, in your console. Where Henschel Technologies manages the service for you (managed delivery, with monthly reporting), our team sees the Register’s reports in order to run the service — as your provider, for that purpose. Nobody else. Register data is never sold, and never shared for advertising.
A standard install makes one kind of call out: it fetches signed definition updates — and signed product updates — from our update service. Your license is verified offline, on the machine, against its signed license file; there is no activation call. Detection records are not transmitted to us on a self-run install.
The Register is your record. We set no deletion clock on it: it stays under your control for as long as you keep it. Removing the software keeps the Register data by default — deleting it is your decision, made by you. (Data given to this website’s Early List is covered by the Privacy Policy: kept until launch communications conclude, and removed at any time on request.)
The watch runs visibly. A tray icon on each machine shows Watching; the product is not hidden from the people whose machines it runs on, and the console belongs to your administrators. Our standing instruction to every organization that deploys Shadow Detective: tell your people the watch is in place before you switch it on, and run it under your own acceptable-use policy.
For local IT needs — Henschel Technologies·henscheltech.com·855-IT-PROBLEM
