Looks authorized to the wall
Stolen or borrowed credentials. A departing employee's access that was never revoked. A vendor service account with more rights than anyone remembers granting. To the wall, every one of these is an authorized user.
Home / Services / Inside Guard
Got-Data Inc. · r.Team · Inside Guard
The wall stops strangers.
The wall stops strangers.
Inside Guard watches after someone is let in.
The perimeter stops people who do not have a login. Inside Guard is r.Team's Cyber Fighter stationed inside that wall — watching what a valid login actually does: credentials, privileged roles, service accounts, and vendor sessions.
Keep the cybersecurity you already run. Add the guard who knows what a normal day in trust administration looks like — and notices the moment it stops looking normal.
The problem
Valid login
Patient insider
Altered record
Why trust companies
Why the wall cannot see it
Why it is a fiduciary issue
The most costly attacks do not come through the front door.
A perimeter wall is built to keep outsiders out. Keep it. The attacks that put fiduciary assets, beneficiaries, and the firm's reputation at risk increasingly happen after a valid login — using credentials, roles, and access your systems are told to trust.
No single event trips an alarm
Small changes spread over weeks: a payee address on a dormant account, a fee schedule adjusted by a few basis points, disbursements kept just under the approval threshold. The pattern is the attack.
Edited, not breached
Beneficiary instructions, tax lots, reconciliation entries, or statement data changed from the inside. Perimeter tools watch traffic. They do not read trust accounting.
Long silences, few people
Long time horizons, dormant and low-activity accounts, vulnerable beneficiaries, and discretionary authority concentrated in a small number of people. Inside abuse can run for years before a beneficiary, examiner, or auditor asks a question.
Packets, not ledgers
Firewalls, endpoint protection, and intrusion detection examine packets, devices, and sign-ins. They do not know what a discretionary distribution is, what a fee schedule should say, or which accounts have been silent for a decade.
Duty, not just an incident
Regulators and courts do not ask whether the firewall was current. They ask whether the trustee exercised reasonable care over the assets and the record. An inside attack you could have noticed is a breach of duty.
Two lines of defense
Outside · the perimeter wall
Inside · the Cyber Fighter
Keep the wall. Add the guard who lives inside it.
Inside Guard does not replace your cybersecurity program. It completes it. The firm's existing perimeter security still stops strangers. Inside Guard covers the territory the perimeter cannot: what authorized access actually does to your trust data.
Your existing cybersecurity
Firewalls, endpoint protection, identity and access management, intrusion detection, and incident response. Essential. Still required.
- Stops external intrusion and malware
- Controls who is allowed to sign in
- Watches network traffic and devices
- Responds once a breach is known
Sees the door. Cannot read the ledger.
r.Team Inside Guard
A specialist with your data architecture in hand and forensic experience behind it — watching behavior inside trust accounting, custody feeds, and disbursement workflows.
- Knows what normal looks like on every account
- Recognizes inside-access playbooks as patterns form
- Reads the record: payees, fees, lots, reconciliations
- Preserves evidence the moment something is wrong
Reads the ledger. Escalates to a human. Never acts alone.
What Inside Guard is
Architecture
Forensics
Peered
A Cyber Fighter who already knows how your trust shop works.
Inside attacks are more sophisticated than outside ones because the attacker already has the keys and knows the floor plan. Catching them takes someone who knows the floor plan better — and knows how to prove what happened afterward.
Knows the data, not just the packets
Inside Guard is built on the same private Reasoning Engine that powers r.Team. It already understands governing instruments, fee schedules, account structures, custody relationships, and firm conventions — so it can tell a legitimate exception from a disguised one.
Handled like an investigation
Every notice is handled the way an investigator would handle it: establish the baseline, preserve the evidence, reconstruct the sequence, and attribute the action to a role and a session. Findings are written to stand up to examiners, auditors, and counsel.
Proposes. Never acts alone.
Inside Guard proposes; your officer decides. It never freezes an account, reverses an entry, or locks a user on its own. It surfaces the finding with full context and waits for the human decision — which is then recorded.
How it works
Baseline. Watch. Flag. Preserve. Decide. Anchor.
Inside Guard connects through the Bridge — the same single, governed, read-only doorway r.Team uses to reach your systems of record. It reads without rewriting. Every access is inspected and logged.
- 01 · Baseline
Learn what normal is
Inside Guard studies months of account activity, user behavior, approval patterns, and vendor sessions to build a baseline for your firm — not an industry average.
- 02 · Watch
Stand inside the perimeter
Continuous review of trust accounting, custody feeds, disbursements, fee runs, and privileged activity. Patterns are compared against the baseline and against known inside-access playbooks.
- 03 · Flag
Notice when it stops looking normal
A Notice is a deviation worth a look. A Flag is a pattern that matches a known inside-access playbook — payee changes on a dormant account, threshold-splitting, an after-hours fee edit by a service account.
- 04 · Preserve
Hold the evidence first
The sequence, the role, and the session are captured before anyone debates what it means. Evidence is preserved the moment something is wrong.
- 05 · Decide
A named officer decides
Each finding goes to the designated officer with full context: what changed, who changed it, from what role and session, and why it matters. The officer questions, dismisses, or acts.
- 06 · Anchor
Write it to the record
Finding, evidence, and the human decision are written to the account's hash-chained record. Years later, what was noticed and what was done is arithmetic, not recollection.
Guardrails
Governance in the architecture, not wrapped around it.
A guard inside your systems needs stricter rules than any outside vendor. These are not policies Inside Guard follows. They are constraints it cannot cross.
Read-only by design
Inside Guard observes through the Bridge. It has no write path into your trust accounting, custody, or payment systems. It cannot move money, change an instruction, or alter a record.
Human in the loop, always
No account is frozen, no user is disabled, no entry is reversed without an officer's recorded decision. Inside Guard proposes. Your firm decides.
Nothing leaves the boundary
Client names, account numbers, positions, and instructions never leave your environment. Only a 32-byte fingerprint of the record is ever published, and it cannot be reversed into a client file.
Every access is inspected and logged
Inside Guard is itself watched. Each read it performs is recorded, so your examiners can see exactly what the guard looked at and when.
Isolated per institution
Each trust company runs in its own isolated environment. There is no shared tenancy, no pooled data, and no way for one firm's activity to touch another's.
Evidence that holds up
Findings and decisions are written to a per-account hash chain. Alter an earlier entry and the break is immediately visible — to you, to an auditor, to a court.
What the trust company receives
Not another dashboard. A defensible answer.
Early notice of inside-access patterns
Payee and address changes on dormant accounts, threshold-splitting, after-hours privileged activity, fee schedule edits, unexplained reconciliation adjustments, and vendor sessions that outlive their purpose — surfaced while they are still small.
Forensic-grade findings
Each escalation arrives as a case file: baseline, deviation, sequence of events, role and session attribution, and the officer's options. Written for the examiner you will eventually face.
A record of reasonable care
When a beneficiary's counsel or a regulator asks what the trustee did to protect the assets, the answer is in the chain: what was noticed, when, by whom, and what was decided.
Continuity through turnover
The institutional knowledge of what normal looks like on your book no longer leaves when a senior operator retires. It compounds in the record, and every decision sharpens the next watch.
The firewall protects the building. Inside Guard protects the fiduciary duty — by knowing the data, recognizing the pattern, preserving the evidence, and leaving the decision with the trustee.
— r.Team product principle
Inside Guard
Keep the wall. Add the Cyber Fighter inside it.
Request a briefing to see Inside Guard review a synthetic trust book, surface an inside-access pattern, and route the decision to an officer — with nothing executed and everything recorded.
Not a replacement for your perimeter security. Inside Guard watches after a valid login. Availability and scope are set per firm. No customer logos, case studies, pricing, or compliance certifications are implied.