- A usage agent collects app names, durations, SaaS URLs for detection, and the work email; nothing else.
- It never collects keystrokes, screenshots, file contents, personal browsing, camera, or audio.
- The agent is upload-only over TLS with no inbound connections and no remote-control capability.
- Tell employees before rollout, state the purpose narrowly, and get every vendor claim in writing.
A desktop usage agent collects which applications run on a work device and for how long, so IT can see software usage that never touches the company’s sign-on system. A well-designed one collects application and SaaS usage metadata and nothing else: no keystrokes, no screenshots, no file contents.
This article answers the privacy questions we hear on nearly every call where an agent comes up, plainly and specifically, because “trust us” is not an answer an IT leader can take to their security review or their employees. The context: SSO sign-in logs only see applications connected to your identity provider. A meaningful share of real software usage (desktop apps, tools bought on cards, browser SaaS never put behind SSO) is invisible there. An endpoint agent exists to close that gap, and whether it belongs in your environment depends on exactly what it collects, which should be written down, not implied.
What does the agent collect?
License Logic’s desktop agent (currently macOS) collects three categories of data, and it’s worth being precise:
- Application usageProcess name, duration, and start/stop times. Enough to know Figma ran for three hours; nothing about what happened inside it.
- Browser activity for SaaS detectionURL and page title, used to identify which web applications are in use. The purpose is recognizing “this is Asana” from the address, not reading content.
- User identityThe employee’s work email (via Entra or Active Directory), so usage can be mapped to a person for license right-sizing and offboarding checks.
What does it NOT collect?
No keystrokes. No screen captures. No file contents. No personal browsing profiling, no audio or video, no camera access, and no personal communications. The agent is a usage meter, not a monitoring or productivity-surveillance tool, and the difference is architectural, not a settings toggle: the collection categories above are all it gathers.
How does the data move, and who can see it?
Upload-only, encrypted. The License Logic agent transmits over HTTPS (TLS 1.2+) and accepts no inbound connections: there is no remote-control channel, no command execution, no way to reach into the device from outside. Data files are encrypted with AES-256-GCM, with RSA-2048 key exchange and a fresh key per log file. The agent runs with least-privilege access and requires no admin rights. These answers come from the same security documentation we hand to infosec reviews; the current full story lives at our security overview.
On the viewing side, usage data feeds license decisions: unused-seat identification, renewal right-sizing, offboarding checks. Access on the customer side is role-based, and the useful outputs are aggregates (“34 of 200 seats inactive for 90 days”), not feeds of an individual’s day.
Should employees be told?
Yes, and not only where the law or a works council requires it. An unannounced agent discovered by employees costs more trust than any license savings are worth, and the announcement itself is usually well received when it’s honest, because the collection list is genuinely modest. A rollout pattern that works:
Publish what is and isn’t collected
Using the explicit lists. The vendor should hand you this text; ours is above.
State the purpose narrowly
License right-sizing and software cost control, not performance evaluation. Put in writing that the data is not used in individual performance reviews.
Deploy via your device-management tooling
To a pilot group first, then broadly, so the mechanism is auditable and standard.
Check regional requirements
Where you have EU or UK employees, notification obligations differ, and your privacy counsel or DPO should see the collection list before rollout. Ask the vendor how regional data handling is addressed for your footprint.
What should you ask any usage-agent vendor?
Take this list into the evaluation, and expect written answers:
- Exactly what fields does the agent collect? Ask for the enumerated list, not a category name.
- What can it never collect: keystrokes, screenshots, file contents, camera, audio?
- Is the agent upload-only? Is there any remote-command capability? (The right answer is none.)
- How is data encrypted in transit and at rest, specifically?
- What privileges does it need on the device? Root or admin should not be required.
- Can we see the employee-facing disclosure text other customers use?
- How is agent data deleted when we offboard from the platform, and on what timeline?
A vendor that answers all seven in writing is treating the agent as what it should be: a scoped measurement tool. A vendor that answers with adjectives is asking you to carry their ambiguity into your security review. For how agent data fits alongside SSO analytics, see our article on the three-tier visibility model.
License Logic’s optional agent collects app usage metadata, upload-only and encrypted, to close the gap SSO logs miss, as one scoped input to license management. The full collection list, encryption details, and deletion timelines are on the security page for your review.
Frequently asked questions
Is a usage agent the same as employee monitoring software?
No, and the difference is architectural. Monitoring software captures content: screenshots, keystrokes, attention metrics. A usage agent captures metadata: which applications ran and for how long. If a product can show a manager screenshots, it’s surveillance software regardless of how it’s marketed.
Can the agent read my documents or messages?
No. It collects process names, durations, start/stop times, and URLs with page titles for SaaS detection. File contents, message contents, keystrokes, and screen captures are not collected.
Can IT remotely control a device through the agent?
Not through License Logic’s agent: it is upload-only, with no inbound connections, no remote access, and no command execution capability. That’s a design property worth demanding from any vendor.
Do employees have to be notified before deploying a usage agent?
Legal requirements vary by region (EU and UK employees, and works councils, come with specific obligations), but the practical answer is: always notify. Publish the collected and never-collected lists, state the purpose as license cost control, and put in writing that the data isn’t used in performance reviews.
Why not just use SSO logs instead of an agent?
SSO logs only see applications connected to your identity provider. Desktop apps, card purchases, and browser SaaS outside SSO are invisible there. Most teams start with SSO analytics and add the agent where fuller coverage justifies it; the two are complementary tiers, not alternatives.