A policy that says capture is always disclosed is worth less than a device that cannot capture without disclosing. This paper describes the capture device as a compliance instrument: an always-visible indicator wired so that capture cannot run with it unlit, cryptographically signed firmware that causes a device to refuse an unsigned image, no camera and no image sensor of any kind, and no on-device speaker enrolment. It explains why the no-covert-mode guarantee is placed in hardware rather than in configuration — a software setting requires a reviewer to trust the vendor’s change management and every future release — and what that costs us commercially when a buyer asks for an evaluation mode with the indicator off. Further sections cover on-device redaction of payment and personal identifiers before transmission, encryption in transit and at rest, key custody, the audit log of every access including Gaincraft staff access, and the physical estate questions procurement asks: mounting, power, network posture on a store LAN, and replacement logistics.