Recording & Monitoring Notice

1. Introduction & Purpose

The Service includes capabilities that, by their nature, involve accessing devices and sessions remotely and, on plans that include session recording, capturing and storing what happens during a session. This Notice exists to state plainly, and consistently with the rest of the Vexaro Legal Center, what Vexaro does and does not do with session media, what happens when a session is recorded, and where the responsibility for notifying and obtaining a lawful basis from affected individuals sits.

Its purpose is twofold. First, it reconciles two facts that must hold at the same time: Vexaro does not store or inspect the content of live sessions in normal operation, and a Customer that turns recording on has its Desk sessions recorded on its own computers (Section 3). Second, it sets out the practical division of responsibility: Vexaro provides the recording capability and keeps each Recording’s details and event timeline, and the Customer decides whether recording is on, where the recording files are kept, which of its devices run the signed-in Vexaro app, who in its organisation may access Recordings, and whether to delete them before their retention period ends.

This Notice describes the mechanism. The controller/processor roles are set in the documents cross-referenced above; this Notice does not change them.

2. Live Sessions (Without Recording)

Live session media is encrypted in transit and is not stored by Vexaro (Section 3 describes recording). Screen streams, remote keyboard and mouse input, clipboard content synchronised between devices, and files transferred during a Desk session pass between the participating endpoints encrypted in transit, and Vexaro does not retain that content as part of providing the live session. Between Vexaro apps the session is encrypted end-to-end, and no Vexaro component holds the session keys: the two devices agree them for each session.

Where the participating devices cannot establish a direct peer-to-peer (P2P) connection, the session is carried over a relay. Between Vexaro apps of version 0.2.13 or later on both devices, the relay forwards data it cannot read. Where one of them runs an older version, the session is encrypted with a key the relay supplies, so it is not end-to-end encrypted against the relay and the relay is technically capable of accessing its content. The relay’s role is connectivity, not content access.

Where the viewer is a web browser, the session always uses the relay, and a Vexaro server component (the browser bridge) opens the session media on the browser’s behalf and forwards it to the browser over TLS, which Vexaro’s edge provider terminates; it does not store that content (see the Encryption Overview).

Accordingly, in normal operation Vexaro does not store or inspect the content of live sessions. What Vexaro does process for every session is connection metadata: the data needed to set up, route, and account for a session. It is distinct from session content and is described in Section 6.

3. When Sessions Are Recorded

Which plans record. Session recording is included in the Team, Business, and Enterprise plans, including the Team trial. It is not included in the Free and Starter plans, and sessions on those plans are not recorded.

Recording is off by default. Session recording starts only after an owner or administrator of the Customer’s organisation turns it on in the administrative console, and it stays on until they turn it off. Turning it on asks them to confirm that the people whose computers will be recorded have been told and that the organisation has a lawful basis to record them. Vexaro keeps that confirmation, with who gave it, when, the version of this Notice in force, and the address it came from, and it appears in the organisation’s audit log; while recording is on, the recording settings in the administrative console say so. While it is on, a Vexaro Desk session is recorded when the Vexaro Windows app on the host device accepts it while a user of the Customer’s organisation is signed in to that app. In a portable or per-user installation this includes unattended and password sessions that the app accepts itself. In a standard installation, where the Vexaro host service runs sessions, a session that a person accepts in the Vexaro app is recorded, and a session that the host service accepts on its own is not: an unattended or password session, or a session that resumes by itself after its connection dropped. A session is not recorded when no user of the Customer’s organisation is signed in to the Vexaro app on the host. Only version 0.2.15 or later of the Windows app records; older versions do not. The connection request on the host says that the session will be recorded, and the host’s session window, and a viewer using the Windows app, show a recording mark (REC) while the session is recorded.

What the Customer decides. The Customer decides whether recording is on and where the recording files are kept: on the computer that is accessed, on the operator’s computer, or on both. The operator’s computer keeps a copy only when the operator connects with the Vexaro Windows app (version 0.2.15 or later) and is a member of the Customer’s organisation. When the Customer keeps recordings on the operator’s computer only and that is not the case, for example when the operator uses a web browser or belongs to another organisation, the computer that is accessed keeps the file instead, so a recorded session is not lost. Vexaro does not decide whether a Customer records.

What is captured. A Recording contains the screen video of the session (without audio) and a timeline of events that the Vexaro app on the host observes during it: keyboard shortcuts pressed with Ctrl, Alt, or the Windows key (the key and the modifier keys, not other typing); the title of the host’s foreground window each time it changes; files received by the host (name and size) and failed file transfers; and whether the Vexaro app on the host runs with elevated (administrator) rights. Window titles can contain personal data, such as document names or email subjects.

What the result is. A Recording is Customer Content. Its video stays in files on the Customer’s computers (Section 4); Vexaro stores its details and event timeline on the Customer’s behalf, for the retention period of the Customer’s plan (Section 4), accessible to the people the Customer authorises within its organisation (Section 5). The resulting content belongs to, and is governed by, the Customer.

4. Where Recordings Are Stored

On the Customer’s computers. Recording files are written by the Vexaro Windows app on the computers the Customer chose. On the accessed computer, when the Vexaro host service runs the session, they are kept in %ProgramData%\Vexaro\Recordings, readable by the system and administrators only; otherwise, as with a per-user or portable installation, in Vexaro\Recordings in the local application data of the Windows account that runs the app. On the operator’s computer they are kept in the Videos\Vexaro folder of the operator’s Windows account. The files are never uploaded to Vexaro. Protecting, copying, and backing up those files is the Customer’s responsibility.

At Vexaro. Vexaro stores each Recording’s details (the session, the time, which computer keeps the file and the folder path on it, which can include the Windows account name, its size and duration) and its event timeline, on the hosting infrastructure named in the Subprocessor List. The console lists them, so the Customer can find each file.

Self-hosted. In a Self-Hosted Deployment, Recordings are stored on the Customer’s own infrastructure and remain under the Customer’s control.

Retention. Recording details and timelines are retained for the recording-retention period of the Customer’s plan and are then deleted: 30 days on Team (including the Team trial), 90 days on Business, and without a fixed limit on Enterprise unless an Order Form sets one. Each time the Vexaro app finishes a recording on a computer, it deletes the recording files older than that period from its recordings folder there; a copy the Customer makes elsewhere is the Customer’s to manage. The Customer’s administrators and owners may delete a Recording’s details before that period ends. Deleted details and timelines can remain in encrypted database backups until those backups expire in the ordinary backup lifecycle. This is distinct from the platform retention periods, such as the session-metadata retention, described in Section 6.

5. Who Can Access Recordings

Within the Customer’s organisation, the details of Recordings are shown in the console to users with the owner, administrator, or auditor role, and owners and administrators may delete them. The recording files can be opened by whoever may open files on the computer that keeps them, as that computer’s permissions allow. The Customer determines who holds those roles and who uses those computers, and is responsible for maintaining appropriate roles and offboarding so that only currently authorised people retain access.

Vexaro personnel do not access Recordings in the ordinary course. Vexaro accesses Customer Content, including the details and timelines of Recordings, only as needed to provide or support the Service and only as instructed by the Customer: for example, to resolve a support request the Customer raises, to operate the database and backup of the Service, or where required by an applicable mandatory rule. Such access is limited to the personnel who need it. When Vexaro personnel act in the Service as a user of the Customer’s organisation, that is recorded in the organisation’s audit log; access at the server level, such as to the database that holds the details of Recordings, is not recorded in the audit log. Vexaro does not use Recordings for its own purposes and does not sell or share them, consistent with the Privacy Notice and the Data Processing Addendum, under which Vexaro acts as a processor for Customer Content.

6. Monitoring & Audit Logs

Separately from session content, the Service records metadata and audit events so that sessions can be established, accounted for, secured, and reviewed. These records describe activity on the Service; they are not the media content of a session, and they exist whether or not a session is recorded.

• Session and connection metadata: connection timestamps, session duration, connection-quality metrics, the network addresses of the participating endpoints, and the relay path used where relevant. Vexaro retains this metadata according to the applicable Product, plan, configuration, account, or Order Form.
• Audit events: records of relevant actions on the Service, such as sign-in, session initiation and termination, administrative actions, configuration and policy changes, and the deletion of Recordings. Opening a recording file on a computer is not recorded in the audit log. Audit-log retention is plan- and configuration-based and may be extended by Order Form.

Audit logs are a control that helps the Customer oversee how the Service is used within its organisation, including who initiated sessions and who deleted Recordings. They record that an event occurred and by whom; they do not capture the media content of a session. Audit-log storage and retention in a Self-Hosted Deployment are addressed in the Self-Hosted Responsibility Matrix.

7. End-User Notice & Consent (Customer Obligation)

Because the Service can be used to access devices and sessions remotely, to monitor and log activity, and, on plans that include it, to record sessions, the Customer is responsible for notifying its End Users about that use and for having a lawful basis for it. Because the Customer decides when recording is on, the Customer must tell the people whose devices or sessions may be recorded before it uses the Service with them.

In particular, the Customer must, with respect to its End Users:

• inform them, before the relevant capability is used, about remote access to their devices, sessions, or networks, about the monitoring and audit logging that occurs, and about Recording on plans that include it;
• obtain consent or any other authorisation required where applicable rules, or the relationship with the individual, require consent, notice, or another step before an individual’s device, session, or network is accessed, monitored, logged, or recorded; and
• establish and maintain a lawful basis for the Processing it carries out through the Service.

Vexaro provides features to help, including on-screen consent for attended access (Section 8), audit logging (Section 6), the access controls on Recordings (Section 5), and the confirmation asked for when recording is turned on (Section 3), but the obligation to inform End Users and to obtain any necessary basis rests with the Customer, as the controller of that Processing. How Personal Data is handled, and the controller/processor split, are described in the Privacy Notice. If you are an End User with questions about how your device, session, or network is accessed, monitored, logged, or recorded, please contact the organisation that operates the relevant account; that organisation controls those settings and that data.

8. Attended vs Unattended Access

The Service supports two access modes, and the Customer chooses which apply to its deployment.

• Attended (consent-based) access. An Operator requests a connection to a device, and the person at that device sees who is asking and accepts or declines the request on screen. Attended access is initiated at the time of the session and is intended for interactive support.
• Unattended (password-based) access. An Operator connects to a device that has been configured in advance to permit access without a person present at the device (for example, a managed endpoint or server), using the access password set on that device, optionally limited to named Vexaro IDs. Unattended access depends on the Customer’s prior configuration and authorisation.

In both modes, Vexaro keeps a record of each session a computer lets in: which computer and the account signed in there, which Vexaro ID and account connected, in which mode, when, and the address of the computer’s request (see the Privacy Notice, Section 3.9).

In both modes, the Customer remains responsible for the End-User notice and lawful-basis obligations in Section 7; the difference in mode does not transfer that responsibility to Vexaro. Where the Customer uses an emergency or break-glass access path provided by its configuration, that access is logged as an audit event (Section 6) so that it can be reviewed afterwards.

9. Vexaro’s Role & Limits

Vexaro provides the capability and stores the details and timelines of Recordings on the Customer’s behalf; the Customer controls whether recording is on, where its files are kept, and who in its organisation may access them. Vexaro makes the recording, monitoring, and audit-logging features available as part of the Service.

Consistent with this, and stated the same way across the Vexaro Legal Center: Vexaro does not store or inspect the content of live sessions, and the video of a Recording stays on the Customer’s computers. Live session media is encrypted in transit and is not stored by Vexaro. Between Vexaro apps the media is encrypted end-to-end, whether the devices connect directly (peer-to-peer) or through a relay because a direct connection is not possible: the two devices agree the keys of each session, no Vexaro component holds them, and a relay forwards data it cannot read. This needs version 0.2.13 or later of the Vexaro app on both devices; where one of them runs an older version, a relayed session is encrypted with a key the relay supplies and is not end-to-end encrypted against the relay. Browser-viewed sessions are opened by the browser bridge on a Vexaro server to deliver them to the browser, without being stored (Section 2). When a session is recorded, its files stay on the Customer’s computers, and Vexaro keeps the Recording’s details and event timeline for the recording-retention period of the Customer’s plan, accessible to the owners, administrators, and auditors of the Customer’s organisation.

This allocation is the same one reflected in the Privacy Notice and the Data Processing Addendum, under which Vexaro acts as a processor for Customer Content and the Customer acts as the controller of the Processing it carries out through the Service.

10. Contact

For questions about this Notice, about recording, monitoring, or audit logging, or to exercise a privacy right where Vexaro acts as a controller, contact our Privacy Contact:

• Privacy / data-protection contact: [email protected]

For other matters, write to:

• Legal and contracting: [email protected]
• Security reports and vulnerability disclosure: [email protected]
• Support: [email protected]

Contracting and notice details are provided on invoices and Order Forms.

This document is part of the Vexaro Legal Center.