Security & deployment
Keep control of your workforce data.
Keep activity records in your infrastructure. Define who sees them, what is collected and how long it stays.
Built around your on-premise environment
Architecture and data flows
Time Tracking and Employee Monitoring share the same core architecture. Choose the visibility you need; keep the on-premise Server in your infrastructure.
Working time, applications, websites and activity reports. Screenshots follow your collection policy.
Activity records are stored in PostgreSQL; scheduled screenshots are stored on the Server’s filesystem. On-demand screenshots are displayed without entering screenshot history; authorised users can download them. TT does not include live screen streaming or continuous screen video.
Adds live screens and continuous recording, with playback alongside applications, websites and events.
Explore the product documentationA separate product
KeepActive DLP is a standalone program, not an edition of Time Tracking or Employee Monitoring. It has its own deployment, security controls and documentation.
Detect sensitive content, control supported data-transfer channels and investigate incidents.
Optional collection profile
The No Sensitive Data licence retains reporting and self-monitoring. Apply it to selected workstations alongside standard Time Tracking in the same installation.
Plan a screenshot-free pilotURLs, window titles, work intervals, numerical input-activity counters and workstation events. These metadata fields can contain personal or confidential information.
No scheduled or on-demand screenshots, live screen streams or continuous screen video. The agent records input-event counts, not typed content.
Screenshot capture is disabled for the licensed workstation, regardless of its screenshot policy.
The agent checks its licence and does not capture screen images.
Any screenshot arriving from that workstation is discarded before it reaches storage.
No new screenshots captured or stored.
Connections beyond your network
In standard on-premise Time Tracking, primary activity records stay in your installation. Licence checks, updates and diagnostics are separate connections. The details below cover the documented TT configuration.
Licence, update and account services use AWS Frankfurt. Stripe handles payments; Google and Zoho handle email and support. Some provider processing may occur outside the EEA. Confirm diagnostic destinations and handling before enabling transmission, and agree handling before submitting sensitive support material.
Request the Data Transfer and Subprocessors StatementMap your data flows, agree access and retention, and validate the configuration in your environment. Bring your IT and security teams into the plan from the start.
Security review
These controls describe standard on-premise Time Tracking 2.1. Review EM, Managed Cloud and the separate air-gapped version against your selected configuration.
Agent-to-Server traffic uses TLS 1.2 or later.
Enable server-certificate validation and mutual authentication; neither is enforced by default. Configure HTTPS/WSS for the web interface and TLS for external database connections.
Password hashing and manager access scoped to assigned teams.
Replace default administrator credentials. Configure password rules, account lockout and session lifetime. Native SSO, MFA and custom roles are not available in 2.1.
Your team controls how stored data and recovery are protected.
Apply disk encryption, file permissions and encrypted, tested backups. Application-level encryption at rest and built-in backups are not provided. Protect agent buffers through endpoint disk encryption.
Set how long reports and screenshots stay in your installation.
Enable the cleanup worker, which is disabled by default, and verify deletion. Manage backup retention separately.
Review sign-ins, screenshot views and administrative changes.
Review coverage against your audit requirements. Report exports are not currently logged.
Update packages are checked against their size and SHA-256 digest.
Release 2.1 does not verify cryptographic publisher signatures. Resolve any mandatory signed-update requirement before deployment.
Use the Security Hardening Guide to prepare and verify your deployment. See the assurance FAQ for our current certification and independent testing status.
| Deployment | KeepActive | Your organisation |
|---|---|---|
| On-premise | Product releases, vulnerability handling and technical documentation. Vendor-operated licence and update services. | Operate the Server and endpoints. Configure certificates, accounts, storage protection, backups and retention. |
| Managed Cloud | Managed hosting within the agreed service scope. Define operator access, maintenance, backup and recovery responsibilities in that scope. | Define collection policy, users and access requirements. Agree the hosting region, protection, retention and recovery requirements before rollout. |
| Air-gapped | Product releases and documentation for the separate air-gapped version. Agree offline update and support procedures before rollout. | Host the Server, endpoints and local Licensing and Update Center. Operate network isolation, accounts, certificates, storage protection, backups and retention. |
Your organisation remains responsible for a lawful, transparent monitoring policy. Confirm product-specific controls and operational responsibilities for the version and environment you select.
Confirm hosting location, operator access, network boundaries, encryption, backups, retention and the division of operational responsibilities.
Review local licensing, activation, offline updates, diagnostic handling and support procedures within the isolation requirements of your environment.
Confirm supported platforms and session behaviour. Include user separation, access scope and resource use in your pilot acceptance criteria.
Customer experience
Customer deployment story · 2020
A retail company deployed Kickidler using Active Directory Group Policy. Explore the published case from before the KeepActive rebrand.
Documentation
From architecture to production hardening: put the technical detail behind your deployment decision. Request the complete set or start with one document.
Your product, your review
Select the product you plan to deploy to find its documentation and review scope.
Review the architecture, access controls, data transfers and production configuration for Time Tracking, including the optional No Sensitive Data licence.
The detailed security controls below cover standard on-premise Time Tracking 2.1.
Employee Monitoring adds live screen broadcasting and video recording. Its user guide covers manager visibility, monitor and session selection, playback and export.
Include recording storage, retention and review permissions in the assessment of your selected EM deployment.
KeepActive DLP is a separate on-premises product for sensitive-content detection, supported-channel controls and investigation. Review its own documentation and operating-system coverage.
Windows offers the fullest control set; Linux and macOS capabilities vary by feature and configuration.
For your security review
Tell us what your reviewers need. We’ll confirm the documents and any confidentiality arrangements for your selected product and deployment.
Request the documents above, or email sales@keepactive.io. A DPA, deployment diagram and support terms are available on request. A software bill of materials is available under a non-disclosure agreement.
Frequently asked questions
Answers for release 2.1 on-premise Time Tracking and Time Tracking No Sensitive Data.
No. KeepActive does not currently hold ISO 27001 certification or a SOC 2 report. An independent external penetration test has not yet been completed. Technical documentation supports your assessment; it does not replace required independent assurance.
The server build pipeline runs automated tests and scans compiled server binaries for known dependency vulnerabilities. Report vulnerabilities to security@kickidler.io. Our policy targets acknowledgement within two business days and initial assessment within five business days. These are response targets, not contractual guarantees.
Native SSO and MFA are not available in 2.1. Restrict administrative access through your own MFA-protected network access where appropriate. This is an infrastructure control, not native product MFA.
Not within the same role in 2.1. A manager authorised to view an employee’s reports can also view that employee’s screenshots. Where screen access is inappropriate, exclude screenshot collection, including through the No Sensitive Data licence.
Periodic outbound licence validation is required in standard on-premise 2.1. Disabling updates and diagnostics does not remove this requirement. The separately offered air-gapped version uses local licensing; confirm its activation, update and support procedures during technical review.
Collection limits, scoped access and retention settings support your compliance assessment. Compliance also depends on your monitoring purpose, applicable requirements, configuration and contractual terms. Deploying KeepActive alone does not establish GDPR or HIPAA compliance.
Ratings & recognition
Workstation agents
KeepActive Server
Web interface
