Privacy and security
What does and does not leave the laptop
Software that keeps track of what someone does rightly raises questions. Below is exactly what Okloq measures, where it stays and who can see what. Without reservations where possible, and with reservations where necessary.
The principle
Three kinds of data, three places
The boundary is the Approve button. Whatever exists before it is only on the laptop. The messages from laptop to service have no field for window titles, file paths or programs; that is a design decision, not a setting anyone can change.
Stays on the laptop
Visible to the employees themselves, in the Measurements and Day overview windows.
- Program and window titleIncluding the title of a browser tab.
- File path or folder of the open document
- Subject of the open email in Outlook
- Start and end time of each measurement
- Days and lines that have not been approved
Goes to the service
Only after approval, per day, over an encrypted connection.
- Project number and project name
- Type of work
- Number of minutes per line
- The description of the lineAs approved by the employee. See the caveat below.
- The moment of approval
- Laptop name and app versionWhen connecting, so the administrator can recognise and revoke a device.
Not recorded anywhere
Okloq only uses public Windows functions to read the window in front.
- Keystrokes and mouse movementsOnly how long there was no input.
- Screenshots or screen recordings
- The content of documents, emails and web pages
- AudioWith Teams and Zoom, Okloq only reads whether the microphone is in use.
- Windows that are not in front
The caveat: the description
Okloq can suggest a description built from the window title, the file name or the subject of an email. For example ‘Word: Conceptdagvaarding’. If the employee approves that description, the text goes along to the service and to your software. That is the only route by which anything from a window title can leave the laptop, and the employee sees and edits the text beforehand.
The firm can switch the suggestion off. Once the hours are in your software, the service deletes its copy of the description; after that it only exists in your own software. If there is no integration with a product, the description stays with the hours in the portal.
For the employee
You stay in control of your own day
Okloq is on your laptop because the firm wants to record hours, not because anyone wants to know what you were doing at a quarter past two.
- You see everything that was measuredThe Measurements window shows every measurement from today, with program, window and source. Nothing is measured that you cannot see there.
- You can always pauseIn the icon’s menu. Nothing is recorded during a pause. After the app restarts, measuring resumes, so a forgotten pause does not cost you days.
- You can also deleteA measurement you do not want to keep, you remove. The time then no longer counts anywhere.
- Your employer does not see when you workedThe laptop sends hours per day and per project. What time you started, when you took a break and in what order you worked is only on your laptop. If your firm’s software requires a start and end time per line, Okloq calculates a place in the day from a fixed start time set by the firm. That is not the moment you actually worked. Calls you pass on with the phone app do go with their start time.
- Time without a projectIs not booked and so does not go to the firm, unless the firm has set up a project for internal hours. Then that time goes there, as a single line, and you see it in the day overview before you approve.
- Old data disappearsWindow titles, file paths and subjects are deleted from the laptop after thirty days.
Remote support only happens if you allow it
If something is not working, an Okloq specialist can help. It always starts with you: you choose Help, share the data and read out a code. The code works for half an hour. With it, the specialist sees the version, the settings and the error log; the app never writes window titles, document paths or hours to that log.
If someone really needs to look at your screen, you open Quick Assist, the tool built into Windows itself. There you approve what the specialist may see, and you stop whenever you want. Okloq does not build in its own way of viewing your screen.
Both are then recorded in your firm’s activity log: that remote support took place, by whom and when.
For the employer
You get the hours, not the activity
That is not a limitation we will remove later. It is the reason you can explain this to your people.
What you see in the portal
- Approved hours per employee, project and type of work
- Whether the hours have been sent to your software
- Budget status per project, if you set budgetsFor such a project, employees see the total for the whole firm in their day overview, without names and without amounts. This can be switched off.
- Which laptops are connected, with version and time of last contact
- The activity log of sign-ins, changes and remote support
What you do not see, and neither do we
- Which programs, websites or documents someone had open
- When someone started, took a break or stopped
- Days an employee has not yet approved
- Time that belongs to no project, unless you set up a project for internal hours
Your own obligations remain
Keeping the raw data on the laptop removes a lot, but not everything. You are installing software on employees’ laptops that records their work. You remain responsible for that yourself under the GDPR.
This is an explanation, not legal advice. Put your situation to your data protection officer or lawyer.
- Inform
Tell your employees in advance what is measured, why, and what you do and do not get to see. You are welcome to use this page for that.
- Weigh up
Recording employees’ work requires weighing your interest against their privacy and, in practice, often a data protection impact assessment (DPIA).
- Works council
If your organisation has a works council, involve it beforehand. For systems that record staff work, a works council usually has a right of consent.
- Data processing agreement
For the approved hours in the service, we are your processor. A data processing agreement and a sample DPIA are in preparation.
Security
How it is built
No certifications to point to: Okloq has not yet been released and has not yet been tested by an external party. But here are the measures built into the software.
On the laptop
- Encrypted storageMeasurements and approved hours are kept in an encrypted database file.
- Key bound to the Windows accountThe key is unique per device and protected by Windows. Another account or another computer cannot read the file.
- Encrypted connections onlyThe app refuses a service whose address does not start with https.
- A separate secret per deviceWhen connecting, the laptop gets its own secret. The administrator can revoke one device without affecting the rest.
In the service
- Passwords and secrets stored only as derived valuesPasswords, pairing codes and device secrets are not stored in readable form.
- Keys for your software encryptedOnce entered, the key can no longer be retrieved in the portal by anyone, not even your own administrator or our specialist.
- Brakes on guessingA limited number of sign-in and code attempts per minute.
- Each firm its own dataAn administrator only sees the employees and hours of their own firm.
- Activity logSign-ins, changes to settings, integrations and remote support are recorded and can be viewed by the administrator.
- Still to choose
Where the service is hosted. In a data centre in the European Union. Which provider has not yet been decided.
- Still to do
Signed installer. The installer is not yet digitally signed, so Windows may currently warn about it. Signing is planned before the first release.
- Still to do
Independent test. No security test by an external party has been carried out yet, and there are no certifications.
Get acquainted
Want to see what a day looks like with your own projects?
Okloq has not yet been released. In a demo we show the day overview, the portal and the route to your software, and discuss what still needs adding for your firm.