How we keep it safe
PC Investigator reads a lot about your devices. Here is exactly what it can do, what needs your approval, and what it never does on its own.
What it reads
Investigations use a fixed set of read-only collectors: recent events, running processes, background services, network settings and which apps own network ports. The AI can ask for more of these, but it cannot write its own commands into an investigation.
What needs approval
Anything beyond those collectors waits for an administrator.
You can require a second administrator, so nobody approves their own request. Each approved command runs either as the signed-in user or as administrator, and is stopped if it runs past its time limit.
Who can do what
- Viewers can read everything but change nothing.
- Technicians investigate, chat and request commands.
- Administrators approve commands, manage users and change settings.
Sign-ins, enrollments, investigations, commands, approvals, setting changes and agent updates are all recorded in an audit log. Repeated failed sign-ins are slowed down and then locked out, and changing a password signs out every other session.
How agents connect
Agents connect out to your Hub over HTTPS, so devices need no open ports. Each device enrolls with a one-time code that expires after 30 minutes, then uses its own secret. On Windows, the agent’s data folder is limited to SYSTEM and administrators.
With optional release signing, agents refuse an update that wasn’t signed with your key.
Where your data goes
The Hub runs on your infrastructure and stores its data there. When you investigate or chat, the relevant evidence is sent to the AI provider you configured, using your own key. Nothing is sent to us.
What we don’t claim
PC Investigator is under active development. We don’t claim certifications or compliance attestations the product hasn’t earned.