Each organisation's captured activity lives in its own database, so tenant isolation is structural rather than a filter someone has to remember to apply. The desktop agent authenticates per device, data is encrypted in transit and at rest, and capture defaults to application metadata only.
The single decision most of this page follows from.
Most multi-tenant products keep every customer's rows in one table and add a tenant column to every query. It works until one query is written without it, and then it fails silently and completely — the worst possible shape for a bug in a product holding an organisation's activity data.
ActivityPulse does not have that column. Each organisation's captured activity is stored in a separate database, resolved from the authenticated session. There is no query that could return another organisation's rows, because there are no other organisations' rows in the database being queried. An automated architecture check fails the build if a tenant column is ever added to the per-organisation schema.
The most reliable way to not leak something is to not hold it. Sensitive capture — screenshots, input activity — is off by default and gated behind both a plan and a compliance review. Keystroke content has no code path at all.
Configuration inherits in one direction only: a team's settings can narrow what the organisation permits, never widen it. So a capability nobody granted at the top cannot appear at the bottom.
Report security issues to security@activitypulse.ai. A machine-readable contact is published at /.well-known/security.txt in line with RFC 9116. Please give us a reasonable window to fix an issue before disclosing it publicly.
Each organisation's captured activity is stored in its own database. Isolation is structural rather than a filter applied at query time, so there is no query that could return another organisation's rows even if one were written incorrectly.
Data is encrypted in transit over TLS and encrypted at rest by the underlying storage. The desktop agent authenticates with per-device credentials rather than a shared key.
The device's credentials can be revoked from the console, which stops that machine syncing. Segments queued on the device are of the same kind already visible in reports: application and window metadata, not documents or screen contents.
Access is scoped by role. A member sees only their own data, a team admin only their team's subtree, an organisation admin their organisation. There is no cross-organisation visibility at all.
Email security@activitypulse.ai. A machine-readable contact is published at /.well-known/security.txt in line with RFC 9116.
Free for up to three people. Windows and macOS. No screenshots, no keystroke logging.