Employee monitoring without keylogging: what should companies actually track?

The usual way a company buys monitoring software is backwards. Somebody becomes concerned about output, looks at a category of products, sees a feature list, and buys the one with the most features on it. Six weeks later they have screenshots nobody looks at, an activity score nobody trusts and a team that has quietly stopped volunteering information.

The better approach takes ten minutes and starts with a question.

Start with the question, not the product

Notice what is in the right-hand column. In five of the six most common questions, screenshots add nothing to the answer — they add storage, sensitivity and a conversation with your team that you did not need to have.

Why keystroke logging never makes the list

Recording keystroke counts as an activity measure is reasonable and common. Recording keystroke content is a different thing entirely, and it fails on every dimension that matters.

• It answers no management question. Nothing in the table above becomes answerable by knowing which characters were typed.
• It captures what you do not want. Personal messages, passwords typed into non-work sites, medical information, a resignation letter drafted in a text editor. You now hold all of it and are responsible for it.
• It fails purpose limitation. Under a data-protection framework you must collect for a specific purpose and no further. Keystroke content is the textbook example of collecting further.
• It is unsurvivable when discovered. And it will be discovered, because someone always checks.

This is why there is no keylogger in Employee Desk. Not as a setting, not for enterprise customers, not on request. Key presses and clicks are counted as an activity measure and the characters are never captured. See the privacy page.

The four levels, and picking the lowest that works

Most companies that arrive asking for level 4 need level 2 or 3. It is worth spending an hour deciding which, because the difference in how the rollout lands is enormous.

If you do enable screenshots

• Tell people first, in writing. A monitoring policy they have actually read, not a clause in a handbook nobody opened.
• Use a long, randomised interval. Ten minutes tells you as much as two and costs a fifth of the storage and a fraction of the resentment.
• Set retention short. Seven or fourteen days covers almost every purpose. Indefinite retention converts a small monitoring programme into a large data-protection liability.
• Let people see their own. This one change does more for adoption than every other decision combined.
• Consider blurring. If you need evidence of activity rather than of content, blurred captures give you the shape of the work without the substance.
• Restrict and log access. Role-based, with an audit trail of which manager opened whose gallery.

The rollout conversation

The single most useful thing you can do is publish what is recorded and what is never recorded, and hand it to the team before installing anything. Not a summary — the actual list. If your vendor will not give you that list in a form you can circulate, that is worth noticing before you buy.

Then explain the purpose in one sentence, honestly. "We need defensible hours for client billing" is a reason people accept. "We want to see what everyone is doing" is not, and dressing it up does not help.

Related