Support and escalation
Who is responsible for what, how to escalate, the release inventory, known gaps and the controls that stay in place.
What Recursift does not provide
Who is responsible for what
| Area | Recursift | You |
|---|---|---|
| Endpoint software | Builds, signs and publishes the Mac installer, updates and release notes | Installs, enrolls, applies updates, uninstalls |
| Hosted services | Operates the console, Query API, MCP service and update host | Manages console sign-in, endpoint enrollment and revocation |
| Collection and posture | Provides policy, profiles and gold builds | Sets policy, reviews acknowledgements and comparisons |
| Monitoring | None | Reviews presence, events, findings and detection results |
| Incident response | None | Decides and acts with your own process and tools |
| Local evidence | No key escrow; cannot recover lost keys | Keeps the Mac and its keychain healthy; backs up what you need |
| API keys | Issues and revokes customer API keys on request | Stores keys securely and asks for revocation when needed |
How to escalate
1. Run the read-only checks in Triage health and incidents. 2. Collect the agent version, the status output, the last 100 lines of the agent log, the console agent ID, any question or job ID, and the time you saw the problem. Never send enrollment tokens, API keys or raw evidence. 3. Write to hello@recursift.com with a short description of what you expected and what happened.
For a suspected compromise, start your own incident process first. Recursift can explain what the product observed and how to read it; it is not your responder.
Response expectations
Support is best effort. There is no service-level agreement, no guaranteed response or resolution time, and no on-call coverage.
Release inventory
| Component | Version | Source commit | Supported profile |
|---|---|---|---|
| Endpoint agent and Mac installer | 0.2.4 (September 26, 2026) | agent d106bd0 | Mac with Apple silicon, observe-only |
| Console at recursift.app | No version number | webapp cfb115f | Current browsers |
| Query API and MCP service | 0.1.0 | api 6d23a5e | Server-side integrations with a customer key |
| Developer documentation | v0.1 | This site | Reviewed September 27, 2026 |
Commits are the main branches reviewed on September 27, 2026. Check the installed agent with recursift-agent version.
Known gaps
| Area | Gap |
|---|---|
| Platforms | Windows, Linux and Intel Macs are not supported. No minimum macOS version is published. |
| Installation | No uninstaller. The console's enroll command omits the installed path and state folder. Local questions and profiles from Terminal need extra configuration. |
| Coverage | Process activity between polls can be missed; process-creation events are not collected. File scans report Unavailable on a standard installation. |
| Console | No alerts or notifications, no incident timeline, and no acknowledgment, assignment or closure of findings. No detection exceptions. |
| Response | Observe-only. Isolation, process and file actions are refused. |
| Updates | No centrally managed updates, version policy, gradual rollout or rollback. |
| Retention | No console retention period or endpoint deletion; no bound on local audit segments. |
| Recovery | No evidence key escrow. Whole-folder deletion or rollback by a privileged user is not detected. |
| Reliability | Restart, load, offline and update reliability have not been measured. |
| Support | Best effort only; no SLA, on-call or staffed monitoring. |
Controls that stay in place
| Control | What it means |
|---|---|
| Observe-only | Enforcement mode refuses to start. Would-be actions are recorded, never executed. |
| Policy cannot grant power | Collection policy cannot enable enforcement or change the endpoint's action gate. |
| Peer evidence | Peer evidence raises priority, never authorizes action. |
| Fixed read-only questions | Questions run only fixed read-only checks with bounded arguments; they cannot run arbitrary queries. |
| Sealed local evidence | Local evidence is sealed with keys held in the Mac's keychain. There is no unsealed fallback. |
| One-time enrollment | Tokens work once and expire after 24 hours. Endpoint keys can be revoked at any time. |
| Signed findings and configuration | The console verifies signed findings; the endpoint rejects unsigned or mismatched configuration and keeps the previous one. |
| Customer isolation | API keys are scoped to one customer, expire and can be revoked. Browser-origin API calls are refused. |