Straight answers, including the awkward ones

In most jurisdictions, monitoring work activity on company equipment during working hours is lawful when employees are informed. What varies is the notice and consent required. In Australia, state surveillance-devices legislation and the Privacy Act apply; in the EU, GDPR requires a lawful basis and usually a data protection impact assessment. We build for informed monitoring and provide the employee-facing transparency that most regimes expect, but this is not legal advice — check your obligations for the countries you employ in.

No. We record that input activity occurred, never what was typed. Keystroke content is not captured, stored or transmitted at any point, and there is no setting that turns it on.

Yes, and it is on by default. Every person gets the same day and week view their manager sees, and the desktop agent displays a visible indicator whenever tracking is active.

Only if an administrator explicitly enables the optional screenshot feature for a team, which is off by default. When enabled, employees are told, images can be blurred, and the capture interval is configurable.

Tracking can be restricted to defined working hours and shifts, and we recommend doing so. A private mode also lets people exclude defined periods entirely.

Keystroke content capture, webcam access, private message reading, and covert monitoring that hides itself from the person being monitored. These have been asked for and declined.

In AWS, with Australian data residency available on Enterprise plans. Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256.

Access is role-scoped: employees see themselves, team leads see their team, administrators see the organisation. Our own staff access customer data only with a support request and an audit record.

By plan — 30 days on Starter, 12 months on Growth, unlimited on Business, and a custom retention policy on Enterprise. Deletion requests are honoured within 30 days.

Yes. CSV and Excel export from every view, plus a REST API. Your data remains yours and stays exportable through cancellation.

We can share our current security documentation, penetration test summary and completed security questionnaires under NDA. Ask us directly for the current certification status rather than taking a marketing claim on trust.