For operators & fleets
Your insurer asked for this. Here's what it actually means for you.
Your general-liability renewal now excludes robot damage. The specialty market filling that gap prices instrumented fleets differently — so instrumentation arrived on your desk uninvited, from your broker. You didn't ask for a recorder. You're entitled to know exactly what it records, who sees it, and what it does for you. This page is that answer.
What your insurer sees — and what they never see
- Disclosure is per incident, not a live feed. The record is built on inclusion proofs: one incident can be disclosed and verified without revealing anything else. Your carrier receives the incident pack for the claim in front of them — not a periscope into your building.
- No video. No audio. Ever. Raw media never enters the log under any configuration. Footage stays in your own retention, referenced by content hash, so it can be proven unaltered later without anyone else holding it.
- Your workers are not in the data. Worker identity never enters any analytic pool. This is structural, not policy — there is no field for it.
- Your daily life is not incriminating. A gap in the record is a signed event that carries its reason: connectivity, power, fault. A warehouse dead zone is not a gap in the record — recording is local-first, and commitments queue until the network returns. A battery swap is a signed power event. Only unexplained silence reads as suspicious, because it is.
What the record does for you
The same properties that make the record credible to your insurer make it your shield — a record nobody can doctor is a record nobody can doctor against you either.
| Situation | What the record changes |
|---|---|
| A forklift hits an AMR (again) | First-party damage is your high-frequency claim. A signed timeline settles it on reconstruction instead of a ninety-day coverage argument. |
| An incident in autonomous mode | Continuously asserted control authority pushes the loss toward the manufacturer's product-liability policy — off your GL. Today that fight is unwinnable because nobody can prove who was driving. |
| An employee is injured | Where the record shows the machine, not your operation, failed, your comp carrier recovers from the OEM — and your experience mod reflects it. |
| Someone blames your people | The record that convicts a bad operation is the same record that exonerates a good one — and neither your OEM, your vendor, nor we can quietly rewrite it. |
What it costs you operationally
The collector is read-only by design: it publishes to zero command, actuation, or parameter interfaces, runs as a separate process within published resource budgets, and cannot issue a command to your robots. ROS 2 fleets install in a day. Other stacks connect through the open capture protocol — an integration whose lift depends on the stack, so for a multi-vendor fleet, ask us and we'll scope each OEM honestly before you commit. Either way: no downtime, and no safety-case surgery on machines you don't control the firmware of — which, with a multi-vendor fleet, is exactly your situation.
The commercial bargain is the one usage-based insurance proved in personal auto: you supply the feed, the premium credit pays for it. And "the feed" means something specific: signed commitments and continuity status — proof your record exists and is intact — plus the incident pack when a claim needs one. Your carrier never receives continuous operational telemetry. In adjacent fleet lines, verified instrumentation earns 5–20% credits. Well-run fleets are underpriced today; verified data is how yours stops subsidizing the ones that aren't.
The uncomfortable part, stated plainly
Yes: the record is discoverable, like every operational log you already keep. A maintenance flag your team ignored will be in it. Here is why an accurate record still beats the status quo — your raw logs are already discoverable, just worse for you: editable by anyone with root access, which means an adverse expert can argue they say anything, and useless for your defense for the same reason. A record that cannot be rewritten is the first one that can actually testify for you.
Records outlive vendors by design: verification requires no server of ours, and continuity of stored data — escrow, hosting jurisdiction — is put in writing, fleet by fleet. Outside what law compels — a court order, a safety regulator exercising a statutory power — release to any commercial party happens under authorization you granted in the contract, scoped before the feed turns on, not assumed after.
Talk to us before your renewal does