What a workplace productivity tool should not collect

There is a category of software that watches how employees spend their working day. It is bought by employers, installed on machines employers own, and it exists because managing distributed teams without any visibility is genuinely difficult. That is a real problem and we build a product for it.

It is also a category with a bad reputation, mostly earned. The failure is rarely that a tool collects too much on purpose. It is that nobody drew a line, so the tool collected whatever was technically available.

The employer is the customer, not the authority on everything

An employer configuring what gets captured is legitimate. An employer configuring their way to capabilities the software should never have is not. The difference is whether a setting exists at all. If a tool ships with a switch for something indefensible, someone will eventually flip it, and the vendor will point at the switch.

So the useful question when designing this kind of product is not what should be default-off. It is what should not be buildable.

Redaction belongs on the device

If sensitive content is blurred or dropped only after it reaches a server, then it existed in full on that server, in logs, in backups, and in whatever queue carried it there. Any promise about it is a promise about deletion, which is much weaker than a promise about collection.

Doing the reduction on the machine where the data originates means the unreduced version never leaves. That is harder to build and it is the only version of the guarantee that means anything.

Encryption at rest, on the endpoint too

Captured data waiting to upload is data sitting on a laptop that might be lost. Encrypting it locally is straightforward and it is often skipped, because the window is short and the risk feels small. The window is not short when the machine has been offline for a week.

Idle time is not a moral category

A tool can measure that a keyboard was not touched for forty minutes. It cannot know whether that was a break, a phone call, a design problem being thought through, or reading a specification. Software that presents the first number as though it were the second is not measuring productivity. It is measuring typing.

We think the honest design is to report what was actually observed, let people annotate it, and resist the temptation to compute a score that looks authoritative and is not.

The person being measured should be able to see it

Not every deployment will enable this, and there are lawful reasons for that. But the capability should exist, and the default posture should be that someone can see what is recorded about their own working day. A system nobody can inspect drifts, and nobody notices.