Security

Security and architecture

Monitoring data is some of the most sensitive data a company holds. Here is exactly how PTM Clearwork protects it, mechanism by mechanism, and what stays your responsibility.

The short version

PTM Clearwork is self-hosted. The server, the database and every screenshot live on infrastructure you control, so the vendor has no route to your data at all. There is no vendor-side account, no telemetry callback and no licence phone-home. The rest of this page lists what the software actually does, with the mechanism named in each case so you can verify it in the code you run.

Data at rest

  • AES-256-GCM for screenshots and captured URLs, using a DATA_ENCRYPTION_KEY that you generate and hold. GCM is authenticated, so tampering is detected rather than silently accepted.
  • Screenshots are compressed to WebP before encryption, which keeps the encrypted volume small.
  • Passwords are hashed with bcrypt. They are never stored or logged in a recoverable form.
  • Retention is enforced by the server: screenshots are deleted after SCREENSHOT_RETENTION_DAYS, which defaults to 90 days and is yours to change.
  • Optional S3-compatible storage (AWS S3, Cloudflare R2 and similar) is configured by an administrator from the dashboard. Those credentials are encrypted server-side and are not returned to the browser after saving.

Data in transit and session handling

  • Dashboard sessions ride in HttpOnly cookies, so a cross-site scripting bug cannot read the session token from JavaScript.
  • Login is rate limited and constant-time, which blunts both brute force and user-enumeration by timing.
  • The server sets a strict Content-Security-Policy plus HSTS, nosniff and frame-deny headers via Helmet.
  • The agent ships over plain HTTP out of the box so a first deployment works without certificates. For anything reachable from outside your network you put your own TLS termination in front. The manual covers this in Deploy the backend.

The desktop agent

  • The agent's API token is sealed in the operating system keystore: DPAPI on Windows, Keychain on macOS, libsecret on Linux. It is never written to a plaintext config file.
  • There is no open sign-up. An agent enrols only with a single-use code generated in the dashboard. Codes expire, can be locked to one email address, and can be revoked. No shared secret is baked into the installer.
  • The agent is visible. It runs in the system tray with a status icon, so the person using the machine can always tell it is there. That is a deliberate product decision, not a configuration option.
  • Outside an employee's configured monitoring hours the agent fully pauses and reports Offline.

Licensing without a phone-home

Licence keys are signed with Ed25519 and verified locally against a public key embedded in the server. Activation, seat counting and expiry are all evaluated offline. Your server never contacts ours to stay licensed, which means monitoring keeps working on an air-gapped network and there is no vendor endpoint that could log your usage.

What we cannot see

Because you host it, the list is short and worth stating plainly. We have no access to your screenshots, activity records, employee names, dashboard accounts, database or encryption key. We do not receive crash reports or usage analytics from your deployment. The only information we hold about you is what you send us directly, such as an email to sales or support. That is covered in the privacy policy.

What is still your responsibility

Self-hosting moves real duties to you, and it would be misleading to imply otherwise.

  • Keep DATA_ENCRYPTION_KEY backed up somewhere safe. Lose it and the encrypted screenshots are unrecoverable, by design.
  • Put TLS in front of the server before exposing it beyond your own network.
  • Patch the host, restrict who can reach the dashboard, and back up the database volume.
  • Tell your employees what is collected and why, and get whatever consent your jurisdiction requires.

Reporting a vulnerability

If you find a security issue, email hello@ptmsoftware.live with enough detail to reproduce it. Please give us a reasonable window to ship a fix before disclosing publicly. We will confirm receipt, tell you our assessment, and credit you if you would like that.