Platform
One agent. Every desk. One record.
One lightweight agent on Windows, macOS, Linux and the browser. Everything it sends lands in a single record, and every WorkMonitor product reads that record rather than keeping one of its own.
Free for two seats, no card. The agent is the only thing to install.
One captured event, end to end
10:4210:42. The agent notes the window in front and the app it belongs to, and counts key presses without reading one of them. A screenshot falls due on the cadence your team set.
The two ends
You set the policy. The record shows what survived it.
A privacy setting you cannot see the effect of is a promise, not a control. These are the two screens that turn it into one. The first decides what the agent may collect, and the decision is enforced on the device rather than on the server. The second is what a manager opens an hour later. The same record, read twice.
- 01
- Blur, deny lists, cadence and private time land before an upload exists to undo.
- 02
- Hours, scores, the ledger and every invoice inherit that decision. There is no second path.
What the org decided the agent may do
- Proof Ledger
- Outcomes
- Certificates
- Audit log
- Data access
- Disputes
- Data egress
- Export
- What We See
- Controls
- Screenshot captureEvery 15 min, working hours onlyWhole orgOn
- Blur before uploadBlurred on the device — the sharp frame never leaves itWhole orgOn
- Keystroke contentNot collected, and cannot be switched onWhole orgUnavailable
- Private timeAnyone can pause capture; the pause is logged, the screen is notDesign teamOn
What a manager opens, an hour on
- Today
- Insights
- Activity board
- Live screens
- Team
- Agents
- Integrity
- App categories
- Reports & digests
- Capacity
- AKAria K.Figma92Active
- JMJon M.Terminal78Active
- SDSara D.Slack61Active
- RPRavi P.Notion34Idle 11m
- LMLena M.Teams55In a call
- TVTomas V.Off shift0Off
Where it runs
Every desk it runs on, and where each one really is.
Half the company is on Windows, the design team is on a Mac, engineering is on Linux and somebody lives entirely in a browser tab. One agent covers all four. What changes per platform is how it reaches the desk, never what it may do once it is there.
| SURFACE | WHAT IT CAPTURES THERE | HOW IT REACHES THE DESK | STATUS |
|---|---|---|---|
| macOS | Window and app in front, categories, screenshots on your cadence, key presses counted. | A notarised app. Screen and input permission asked for once, in plain language. | Live |
| Windows | The same capture set, under the same policy the org agreed. | A signed installer that runs as a service, so the day is counted before the first login. | Beta |
| Linux | The same rules again, on the desks that run Ubuntu and its relatives. | A native agent built against the same enrol, session and ingest protocol. | Beta |
| Browser | The tab in front, and the time spent in it. Never the page you are reading. | Chrome, Firefox and Safari, for the work that never leaves a browser. | Beta |
| Editor | Nothing extra. It shows a developer their own record without leaving the editor. | A VS Code companion, installed by the developer who wants it. | Live |
| Deskless | Attendance and clock-in for people who do not work at a desk. | Not shipped. It is on the roadmap and this is the honest place to read that. | Planned |
Scroll the table sideways for how each one ships, and its status.
Every status here is read from the catalogue the product feature lists are built from, so a surface cannot be sold on this page at a status it does not have. See the full capture feature list.
The boundary
Everything that crosses it, in both directions.
A record nobody can get data into or out of is a silo with better branding. So here is the whole edge of the system, written down: what feeds it, what leaves it, and which half of each is still landing.
What goes in
26 connectors liveThe only thing you install. Activity, apps, captures and attendance, all of it under the policy the org set.
- HR & identity9
Workday · ADP · SAP SuccessFactors · Oracle HCM · Deel · Finch · Okta · Microsoft Entra ID · Google Workspace
- Project management4
Jira · Asana · ClickUp · Trello
- Developer tools4
GitHub · Linear · Jira outcomes · Asana outcomes
- Communication4
Slack · Microsoft Teams · Zoom · Email & webhooks
- Accounting2 · all in beta
QuickBooks · Xero
- Payroll & payouts4 · all in beta
Gusto · ADP Payroll · Wise · Deel Payouts
- Analytics & BI4 · all in beta
Snowflake · Google BigQuery · Amazon Redshift · Microsoft Power BI
- Migration5
Hubstaff · Time Doctor · Toggl · Clockify · ActivTrak
What comes out
Scoped keys only- GET/v1/membersList members with their consent status.
- GET/v1/time-entriesList time entries for members and teams.
- GET/v1/timesheetsList timesheets; submit and decide via POST.
- GET/v1/projectsList projects and their tasks.
- GET/v1/analytics/dailyDaily focus, activity, and output rollups.
- GET/v1/deliverablesList shipped deliverables from the Proof Ledger.
- Partner webhooks
HMAC-signed, so your endpoint can prove the payload came from us.
- Warehouse exportBeta
Incremental, cursor-tracked loads into Snowflake, BigQuery, Redshift and Power BI.
- Bulk export
The whole record, on the way out as readily as on the way in. Every export is audited.
- Public certificate verification
An issued certificate stays verifiable on a public page, with no account and no login.
Every read goes through a scoped API key you create in Settings → API keys. Send the key on each request in the X-Api-Key header (or as a bearer token); the secret is shown once at creation, and a key can never do more than the scopes it was granted.
Self-hosting is on the roadmap, not shipped. Data residency and bring-your-own-key encryption will land with it.
One record
One record per organisation, and the walls that keep it that way.
Scale is not a promise on a platform page. It is a boundary that holds the day two customers land in the same table. Ours is drawn twice — once in the code that answers a request, once in the schema underneath it. These are counts of the product itself; we have no customer figures to quote yet.
- 310
- server-side checks that a record belongs to your organisation before it is returned
- 31
- composite foreign keys enforcing tenant isolation in the database itself
- 3
- independent SHA-256 hash chains: governance, data access, and our own staff actions
- 0
- keystrokes recorded: all three desktop agents count key presses and never read their content
Every figure is recounted from the source it describes each time the test suite runs, so a number that goes stale fails the build instead of quietly becoming a false claim. The security page shows the workings.
One record, five readings
Nothing above belongs to a product. All five read the same row.
No separate time-tracking database. No second store for the ledger. No export job in between. A product on this platform is a way of reading one record — which is why an hour, a score, an invoice line and a certificate can never contradict each other.
- Monitoring & AnalyticsReads it as a working week: live activity, focus and capacity, with the captures behind every score.
- Trust & ComplianceReads it as consent and evidence: what may be collected, who looked at it, and a hash-chained trail of both.
- ProjectsReads it as client work: hours against budgets, timesheets, invoices and payroll runs.
- AI WorkforceReads it as answers: agents and a copilot that cite the activity behind each one.
- EmbeddedServes it back out: a v1 API, a typed SDK and verification widgets on your own domain.
Straight answers
The questions we would ask in your position
Every answer here is the one you would get on a call. Open as many as you like; they stay open, so two can be held side by side.
Agents install and enrol without a hand on every machine, and the device inventory shows which ones have not checked in yet, so the long tail is visible rather than assumed. Identity comes from the provider you already run: Okta, Entra ID or Google Workspace, with roles scoped to a node in your org tree so a regional manager sees their region and not the company.
Two independent layers. Roles are scoped to a node in the org tree, and beneath that, isolation is enforced by the schema itself: 31 composite foreign keys tie every record to its organisation, so a cross-tenant join is a constraint violation rather than a missed code review. On top, 310 server-side checks confirm a record belongs to your organisation before it is returned, with the scope taken from the credential rather than the request path.
It is exportable while you are a customer and not held hostage on the way out: a read-only v1 REST API with scoped keys, a warehouse export connector, and issued Proof Ledger certificates that stay verifiable on a public page whether or not you are still a customer. Retention and deletion are governed by the policy you set, not by us.
No. It is on the roadmap rather than shipped, and data residency and bring-your-own-key encryption land with it. If a self-hosted deployment is a hard requirement today, this is the honest place to find that out rather than three months into procurement.
Put it on one desk today.
Install the agent on one machine and watch the record fill. Add the rest of the fleet once you have seen it work, not before.
Free for two seats, no card. Talk to us about a fleet rollout.