We agree in writing: installation mode, what we do not do (no active scanning, no blocking rules), where the data lives, who sees it, when it is deleted.
Mirroring/TAP in standard mode. We verify speed and duplex at installation. The sensor brings its own modem; we ask nothing from the client's network.
Passive collection: inventory, commands to PLCs, new devices, remote access, clear-text protocols, versions for CVE correlation.
Within 10 working days of removal: inventory, communication map, IT/OT and remote access, insecure protocols and write commands, indicators of compromise, NIS2/IEC 62443 recommendations.
Within 5 working days of delivering the report, raw data is deleted from the sensor and the dedicated server, with an evidence log and written confirmation.