Key takeaways
- Presence-based monitoring records signals such as active or idle status, not screens, keystrokes or messages.
- TIMO360 publishes exactly what it collects and what it never collects.
- Retention windows, role-based access and employee transparency reports keep the data you do hold under control.
Employee monitoring software has a reputation problem, and much of it is earned. Tools that capture screens, log every keystroke or record webcam video turn a management question into a trust problem. But most teams asking for monitoring want something far narrower: to know who is working, when, and how their time is spent.
Presence versus surveillance
Surveillance records content: what is on a screen, what someone typed, what they said. Presence-based monitoring records signals: whether someone is at work, whether their device is active or idle, and which application or website domain is in use. The first asks what exactly a person did. The second asks whether the team is working and how time is being spent, and that is all most attendance, workload and productivity questions need.
What presence-based monitoring collects
The TIMO360 desktop agent collects a short list of high-level signals:
The active application name and process ID
Window title text and the browser domain, never the full page URL
A yes/no signal for keyboard and mouse activity, used to tell active from idle
System lock, unlock, sleep and wake events
Device details such as the operating system version and agent heartbeats
What it never collects
Keystroke content: the agent detects that typing happened, never what was typed
Passwords, form field contents or clipboard data
Private message contents, such as email bodies or chat
Full page URLs or query strings
Screenshots, screen recordings, audio or webcam capture
Why this matters for trust
Collecting less is a practical decision as well as a privacy one. There is no screen content to store, review or protect, and the data you do keep stays under your control. Each organization sets how long raw events, aggregated sessions and reports are retained, from 1 day up to 10 years, and older data is deleted automatically. Access is role-based, so managers see only their assigned departments, and every employee gets a personal transparency report of their own data.
Your responsibility
No software replaces a clear policy. Organizations remain responsible for telling employees how they are tracked and for complying with local employment and privacy law.
Questions to ask any monitoring tool
Does it capture screenshots, screen recordings or keystrokes, and can that ever be switched on?
Can employees see what is recorded about them?
Can you set how long data is kept, and is it deleted automatically?
Who can see whose data: is access limited by role and department?
Is the list of collected and never-collected data published in plain language?
You can read TIMO360's answers to all five in the privacy policy and the security and privacy overview.