Sockit privacy policy

Sockit is a product of Ziliconcloud LLC (“we”, “us”), which works with its Indian affiliate, Ziliconcloud Private Limited. This policy covers the Sockit product: the Sockit server, its web console, and the Sockit agents installed on computers. How our website handles information is in our website privacy policy.

Each Sockit server serves one organisation (“the customer”), usually an employer. The customer chooses what Sockit connects to and collects, and decides how that information is used. For the people whose information Sockit holds, mainly the customer's staff, the customer is responsible for it (the controller). Questions about your own information should go to your employer first.

• When the customer runs Sockit on its own server, the information stays on that server. Sockit sends nothing back to us: it has no licence check, usage reporting or analytics that contact us.
• When we run the Sockit server for the customer, we hold the information on the customer's behalf (as a processor) and use it only to provide and support Sockit for that customer, under our agreement with them.

• Email: info@ziliconcloud.com
• Post: Ziliconcloud LLC, 1429 241st Ave NE, Sammamish, WA 98074, United States
• Phone: +1 (913) 206-5033

When the customer connects Active Directory or Microsoft Entra ID, Sockit reads a fixed set of details and keeps a copy that it refreshes on a schedule:

• People: name, sign-in name, email address, company, department, job title, manager, group memberships, whether the account is enabled, and when the password was last changed and the account last signed in.
• Groups: name, description, type and members.
• Computers and devices: name, operating system and version, and when they last signed in; from Entra, also the make, model and whether the device is managed and compliant.

Sockit never changes Microsoft Entra ID. It can change Active Directory (create, edit, disable or delete accounts, reset passwords, manage groups, organisational units and Group Policy) only when the customer turns this on for the whole server and for that directory, and only for people with permission. Each change is recorded in Sockit's audit log.

When someone signs in with their directory account, Sockit checks the password with the directory and does not keep it.

The Sockit agents run on Windows, macOS and Linux computers the customer chooses. Depending on the customer's settings, they collect:

• Device details: computer name, operating system, processor, memory, graphics, IP and MAC addresses, time zone, domain and the signed-in user's name.
• Software: installed applications, installs and removals, updates and patches, running services, antivirus status, certificates, and local user accounts and groups.
• App usage: which application is in front and for how long, with its name and, as the operating system reports it, the title of its window. Window titles can contain document or page names. The console does not show titles, but the server stores them.
• Performance: processor, memory, disk and network use, for the computer and for its busiest programs.
• Network: connections programs make and accept, with addresses, ports, host names, the program and the amount of data, and the names of Wi-Fi networks the computer joins.
• Security and system logs: sign-ins and sign-outs, account and group changes, programs started, file and share access, firewall blocks, service and shutdown events, and crashes. On Windows, the agent turns on the audit settings these logs need. On Linux, programs started are recorded with their full command line.
• File activity: when files are created, changed, renamed or deleted, with the file's name, folder and user, not its contents. Temporary, cache and browser profile folders are left out. USB drives being connected or removed, with their label and size.
• Applications Sockit watches for the customer: error lines from their logs, with passwords and keys removed before they are sent; and, on Windows, the contents of their configuration files (for example appsettings.json, web.config, package.json, Dockerfile), up to a small size each, so Sockit can work out what the application is and where it logs.

The agents do not take screenshots, record keystrokes, read the clipboard or collect browsing history, and they do not read the contents of people's files, apart from the application configuration files and log lines described above.

People with permission can also act on computers through Sockit: remove, update or reinstall applications, restart programs and services, run scripts the customer has uploaded, install updates, read a log file, give someone time-limited administrator access, show a message to the user, or update or move the agent. These actions are recorded in the audit log.

Sockit's AI features work only after the customer adds an AI provider: DeepSeek, Anthropic Claude, Google Gemini, or the customer's own model on its own network. Until then, nothing is sent to an AI provider.

Once a provider is added, Sockit sends it what each feature needs to answer: the question someone asks and the information Sockit's tools look up to answer it (such as names, computers, events and logs); application names, to sort applications; the configuration files and file lists described above, to describe watched applications (these are not filtered for secrets); log lines with secrets removed, to explain errors; and case details, to help investigate them. The provider handles this under its own terms, which the customer accepts when it adds the provider. The console says this on the AI provider settings page.

Conversations with the assistant and the results of its lookups are kept on the Sockit server so people can return to them.

• Sockit keeps the accounts that can sign in to its console: local accounts with their password stored only as a one-way hash (bcrypt), and directory accounts whose password stays with the directory.
• Two-factor sign-in with an authenticator app is available, and the customer can require it.
• Each sign-in attempt is recorded, successful or not, with the account name, time and device details, so administrators can investigate access.

If the customer sets them up, Sockit sends alerts and approval requests to Microsoft Teams, to a web address of the customer's choosing, or by email through the customer's own mail server. These messages carry a summary of what happened and a link back to Sockit. To message people in Teams, Sockit looks up their Microsoft account by email address.

• sockit_session: keeps you signed in to the console. It can only be read by the server, and ends when you sign out or the session times out.
• sockit_setup: used only while the server is first set up, for up to 12 hours, to remember that the person setting it up entered the server's setup code.
• Your browser's local storage keeps screen preferences, such as the colour theme, the sidebar and page sizes. They stay on your device.

The console has no analytics or advertising cookies. It loads its fonts from Google Fonts, so your browser contacts Google when the console opens.

• Passwords and keys Sockit needs to reach other systems (directory accounts, AI providers, Teams, mail) are encrypted (AES-256-GCM) before they are stored.
• Connections to Active Directory use LDAPS by default, with the server's certificate checked.
• Console sessions end after a period without activity and after a maximum length, and repeated wrong passwords lock an account for a while.
• The audit log is tamper-evident: each entry is chained to the one before it with a keyed hash, and the database refuses changes to past entries.
• On Windows, the agent's credentials are protected by the computer's own data protection keys.

Where the customer runs the server, the customer is responsible for securing that server and its network, including encrypted (HTTPS) access to the console and the server's disks.

Sockit keeps some information for a set time by default and the rest until the customer deletes it:

• Detailed performance readings: about a day for individual programs and about five weeks for the computer as a whole; daily summaries for dashboards for just over a year.
• In-app notifications: 30 days.
• Ended sign-in sessions: removed a day after they end.
• Directory data: refreshed on each sync; people removed from the directory are marked disabled.
• Events from computers, the audit log, sign-in records and assistant conversations: kept until the customer deletes them. The audit log cannot be edited.

Sockit shares information only with the services the customer connects it to:

• The AI provider the customer adds, as described above.
• Microsoft, when the customer connects Microsoft Entra ID or Teams.
• The customer's own mail server and web addresses it chooses for alerts.

When we run the Sockit server for a customer, our hosting provider stores it, and our team in the United States and in India may access it to support the customer. We do not sell information from Sockit, use it for advertising, or use it to train AI models.

Because the customer decides what Sockit collects, requests to see, correct or delete information should go to your employer or the organisation that runs Sockit. Depending on where you live, for example under the EU or UK GDPR or India's Digital Personal Data Protection Act, you have rights over your information, and the customer may need to tell you that Sockit monitors work computers. If we run the server for your organisation, we will help them answer your request; you can also write to us at info@ziliconcloud.com.

A customer that runs its own server deletes its information by removing the server and its database; uninstalling the agents stops collection on a computer. A customer whose server we run can ask us to delete its information when its agreement ends.

If we change this policy, we will update this page and the date at the top. Using Sockit is also covered by our Terms of service.