WorkMonitor for Enterprise
Your questionnaire, answered before you send it
Rollouts rarely stall in deployment. They stall in review, waiting on answers a vendor could have published. SSO, SCIM, retention, residency, audit, the DPA and support terms are all answered below — including the rows where the answer is no.
- SAML 2.0 single sign-on
- SCIM 2.0 provisioning
- Retention you set, including keep-forever
- Hash-chained audit log, reads included
The procurement checklist
Every line on the form, answered
The rows a questionnaire actually contains, answered from what the platform does today, each with the document that evidences it beside the answer. 17 rows, 2 of which say no.
Identity and access
- 01Single sign-on
SAML 2.0 against your identity provider: an owner pastes your sign-on URL, entity ID and signing certificate into Settings, and everyone on the configured email domain is handed to Okta, Microsoft Entra ID or your own IdP from then on. Those three are directory connectors too, so the roster arrives with the identity. OIDC sign-in with Google is live on every plan.
Enterprise - 02Provisioning and deprovisioning
SCIM 2.0 for users and groups. An owner mints a per-tenant bearer token under Settings, Directory sync, and pastes it with the SCIM base URL into Okta or Entra. A leaver removed in your directory loses access here, without a ticket and without waiting for someone to remember.
Enterprise - 03Scoped roles
A role binds to a node in your org tree, so a regional manager sees their region rather than the company. Widening a scope is a privilege change and is recorded as one.
Every plan - 04Who read what
Reads, not only writes. Data access appends to its own hash chain, so you can show which administrator opened whose record, and when.
Enterprise
Data, residency and retention
- 05Retention
You set the window, including keep-forever, and you can always set it shorter than your plan allows. The cap is enforced server-side, not in the interface, and a deletion appends to the audit chain.
Enterprise - 06Data residency
Hosted in the United States today. Regional hosting is on the roadmap.
Not yet - 07Encryption of secrets
Secrets are encrypted with AES-256-GCM: integration credentials, single sign-on secrets, two-factor seeds and signing keys.
Every plan - 08Sub-processors
Published as a document you can diff between versions, alongside the data processing addendum, rather than named on request.
Read the listEvery plan - 09Getting your data out
A read-only v1 REST API with scoped keys, a warehouse export connector, and certificates that stay verifiable on a public page whether or not you are still a customer. Every export is itself audited.
API referencePro and up
Evidence and audit
- 10Tamper-evident audit log
Governance changes, data access and our own staff actions are recorded on a SHA-256 hash-chained, tamper-evident audit trail. Checkpoints are written to write-once storage that cannot be altered or deleted early.
Enterprise - 11Tenant isolation
Your organisation is resolved from the verified credential, never from a URL, and every request is checked against it before any data is returned. The database also refuses to link a record to another organisation’s data.
Every plan - 12Employee rights
Everyone monitored gets a self-view of what was captured, a consent centre, a one-click private-time pause, and a dispute that freezes automated re-decision while it is open. This is the machinery a works council asks about.
Every plan - 13Certifications
None held. SOC 2 and ISO 27001 are in preparation. What exists today is the control set an audit examines, with a detailed control and limitations inventory shared under NDA instead of a badge.
The security positionNot yet
Enforced by the product itself
- Checked on every request
- Every request is checked against your organisation before any data is returned.
- Linked only within your organisation
- The database itself refuses to link a record to another organisation’s data.
- Tamper-evident audit trail
- Governance changes, data access and our own staff actions are hash-chained, so an edit anywhere is detectable.
- No keystroke content
- Keystroke content is never recorded. The desktop agents count key presses and never read what was typed.
Contract and support
- 14Data processing addendum
Part of the platform terms and published in full, with a separate FAQ answering the questions procurement usually returns with a week later.
Read the DPAEvery plan - 15Uptime commitment
The service level agreement commits to 99.9% monthly availability, with service credits of 10% of monthly fees between 99.0% and 99.9% and 25% below that. The exclusions are written down rather than implied.
Read the SLAPro and up - 16Support terms
Standard support is email during business hours. Priority and round-the-clock support are agreed in the Enterprise order form, alongside security review and rollout assistance.
Enterprise - 17Notice to the people monitored
A worker privacy notice written for them rather than for you, so a works council consultation does not start with drafting one from scratch.
Read the noticeEvery plan
What a checklist is for
The rows that say no — 2 of 17 — are what make the rest worth reading.
Anyone can write yes down a column. A no is the only entry that costs the vendor something to publish.
Where the line sits
Which plan clears your checklist
Most of the platform is on every plan. Enterprise is where the sign-off items live. Here is that boundary, drawn rather than described.
| Requirement | Free | Pro | Business | Enterprise |
|---|---|---|---|---|
| Price per user / month | $0 | $8 | $14 | Custom |
| Screenshot retention | 30 days | 180 days | 365 days | Custom |
| Analytics history window | 7 days | Unlimited | Unlimited | Unlimited |
| SAML 2.0 SSO + SCIM 2.0 provisioning | Not included | Not included | Not included | Included |
| Hash-chained, tamper-evident audit log | Not included | Not included | Not included | Included |
| Consent evidence with IP, agent & version | Not included | Not included | Not included | Included |
| Dedicated support with an agreed SLA | Not included | Not included | Not included | Included |
Prices are per user per month on monthly billing; annual billing takes two months off Pro and Business. The full comparison is on the pricing page.
Not a description of the product
Every control on that list is a screen
Retention, scope, consent, export and keys are pages an administrator opens, with a history and an owner. Pick a row to open the one it lives on.
Straight answers
The questions we would ask in your position
Every answer here is the one you would get on a call. Open as many as you like; they stay open, so two can be held side by side.
Agents install and enrol without a hand on every machine, and the device inventory shows which ones have not checked in yet, so the long tail is visible rather than assumed. Identity comes from the provider you already run: Okta, Entra ID or Google Workspace, with roles scoped to a node in your org tree so a regional manager sees their region and not the company.
Two independent layers. Roles are scoped to a node in the org tree, so a regional manager sees their region and not the company. Beneath that, every request is checked against your organisation before any data is returned, with the scope taken from the credential rather than the request path, and the database refuses to link a record to another organisation’s data.
Not yet, and we will not imply otherwise. Both are in preparation. What exists today is the underlying control set an audit examines: credential-derived tenant isolation, tamper-evident audit chains anchored to immutable storage, role-scoped access with the access itself recorded, and documented employee data rights. The security page states the current position precisely.
Consent, notice and retention rules apply per jurisdiction rather than globally, with the record to show which policy version each person accepted and when. Employees get a self-view of what was collected and a route to appeal a specific capture, the machinery a works council asks about. Local law still varies on automated evaluation, so what the data may be used for is a policy you set explicitly.
It is exportable while you are a customer and not held hostage on the way out: a read-only v1 REST API with scoped keys, a warehouse export connector, and issued Proof Ledger certificates that stay verifiable on a public page whether or not you are still a customer. Retention and deletion are governed by the policy you set, not by us.
Not today. Self-hosted deployment is on the roadmap, with regional hosting and bring-your-own-key encryption.
For the file
The pack to forward to your team
Everything a reviewer asks for is already written and already public. Send the links; nobody has to wait on us for a PDF.
- Data processing addendumThe processor terms in full, published rather than sent on request.
- DPA FAQsThe questions procurement returns with, answered once.
- Sub-processorsWho else touches the data, and for what.
- Service level agreementThe availability commitment, the credits, and the exclusions.
- Worker privacy noticeWritten for the people being monitored, ready for a works council.
- Security overviewThe control set, and what your reviewer receives under NDA.
- Monitoring law, country by countryWhat each jurisdiction requires, and the control that meets it.
- Public API and webhooksScoped keys and a read-only v1 — the exit route as well as the integration one.
Bring your questionnaire. We will answer it in writing.
A review call with the people who wrote the controls, a scoped pilot, and terms on your paper where they need to be. If you would rather look first, two seats are free for as long as you like.