EU compliance profile

The EU profile: monitoring that stays visible and limited

Licences for customers in the EU and EEA, the United Kingdom and Switzerland get MonBuddy’s EU compliance profile by default. It is part of the digitally signed licence and sets limits that no administrator can switch off. It is designed to support GDPR-compliant use; it does not replace your own legal assessment.

What the EU profile enforces

The rules come from the signed licence and are enforced by the Core server and by the agent on each computer.

The tray icon cannot be hidden

On every monitored computer the MonBuddy icon is always present in the notification area of the taskbar. Covert operation is not available: no MonBuddy setting can hide the icon, and the agent keeps it there on its own as well. As with any tray icon, Windows may show it in the overflow area, depending on the taskbar settings.

Outside working hours: only active and idle time

Outside the work schedules set in the Console (by default Monday to Friday, 8:00 to 16:30), only active and idle time is kept: no programs, window titles, web addresses, key-press or mouse counts, screenshots, live view, USB or print events. This cannot be switched off, not even for a department.

Retention with upper limits

Screenshots are kept for at most 90 days, activity data and alerts for at most 365 days. Shorter periods can be set; unlimited retention cannot be chosen. These limits apply to the Core’s live data: the encrypted backups keep their copy until you delete them.

No keystroke content, webcam or microphone

MonBuddy never records what is typed, only the number of key presses, and it has no webcam or microphone recording. Under the EU profile the licence also blocks these capabilities and covert mode, whatever else it contains.

How the profile works

Part of the signed licence

The profile is recorded in your licence, and the licence server signs every licence answer digitally. The Core checks the signature and applies the profile. The Console only shows the profile; it has no switch for it.

Who gets it

By default, every licence issued to a customer in the 27 EU member states, Iceland, Liechtenstein, Norway, the United Kingdom or Switzerland. The United Kingdom and Switzerland have their own data protection laws (the UK GDPR and the Swiss Federal Act on Data Protection); the profile is the same there. Licences for other countries get the standard profile, in which the customer sets retention and the outside-hours rule.

Changing the profile

On a documented request, we can change the profile of a specific licence. The licence key stays the same, and the Core applies the change at its next online licence check, within minutes; with an offline licence, once you import the new licence file. Renewing or extending a licence never changes its profile.

In the 7-day demo too

The 7-day demo that a Core installed without a key requests by itself always runs with the EU profile, so you can see how it works before you buy. A demo issued in the customer’s name and a purchased licence, including a demo that becomes a paid one, get the profile of the customer’s country.

In every licence

These privacy features do not depend on the profile.

Screenshots are encrypted on the monitored computer. Screenshots, web addresses and activity data are stored on your own server; the MonBuddy provider does not receive them. The exception is the Console’s e-mail alerts when they go through MonBuddy’s mail relay: they pass through our server with their content, for a high-severity alert for example the computer name, the Windows user and the matched term.
An access log shows who opened which computer’s data.
Everything kept about an employee’s Windows accounts can be exported and erased (GDPR Articles 15 and 17). The erasure covers the Core’s live data; backups keep their copy until you delete them.
Excluded programs and websites, screenshot blurring (on by default under the EU profile) and department rules, for example without screenshots or live view.
USB and print events are recorded only if you turn them on.

What remains your task

The EU profile is a technical aid; it does not replace your own compliance review. Before monitoring starts, these steps are usually needed:

Define the purpose and the legal basis, and check that the monitoring is necessary and proportionate. In an employment relationship, consent is not automatically an adequate legal basis.
Carry out a legitimate-interest assessment and, where required, a data protection impact assessment (DPIA).
Inform employees clearly and in writing before monitoring starts. MonBuddy shows them no notice of its own, only the tray icon.
Consult the works council or the employee representatives where the applicable rules require it.
Set rules for access, retention and deletion, including the backups in the Backups folder, and a procedure for requests from data subjects.

This is general guidance, not legal advice. Please ask your legal adviser which rules apply to you.

Questions about the EU profile?

Write to us if a licence needs a different profile, or if you would like to know how the profile fits your rules. Or try it yourself: the 7-day demo of a Core installed without a key runs with the EU profile.

Try it free for 7 days Contact us