Security & Privacy Data Sheet
This data sheet is the complete disclosure for the ConcertoGRC device agent. It exists so administrators can answer privacy reviews and communicate transparently with employees. A short version of this disclosure ships in the app; this page is the authoritative, detailed reference.
The agent exists for one purpose: to provide first-party evidence of endpoint security controls for compliance monitoring. It is not a surveillance or productivity-tracking tool.
What the agent collects
| Data element | Purpose | Example |
|---|---|---|
| Device security posture | Evidence of endpoint controls | Disk encryption on/off, host firewall on/off, screen-lock/passcode enforced |
| Operating-system details | OS-currency and patch evidence | OS name and version, build number |
| Agent health | Confirm the agent is functioning | Agent version, last heartbeat, update state |
| Policy evaluation results | Map posture to compliance policies | Pass/fail against configured device policies |
| Device identity | Associate posture with a device and person | Device name, platform, enrollment binding |
What the agent does not collect
- Application inventories or lists of installed software beyond OS/agent identity
- Browser history, URLs, or search activity
- Document contents, file contents, or filenames
- Keystrokes, screenshots, screen recording, or clipboard contents
- Employee credentials, passwords, or authentication secrets
- Personal messages, email, or communication contents
- Raw IP addresses or ASN telemetry for the tenant enrollment experience
Transport
- All agent-to-platform communication is over TLS (HTTPS).
- Each enrolled device authenticates with its own rotating credential — the shared deployment token is used only at first-run enrollment and never for ongoing heartbeats.
- Posture reports are tenant-scoped; a device reports only to the tenant it enrolled into.
Retention
- Posture and heartbeat data are retained to support compliance evidence, trend history, and audit export for the tenant.
- When a device enrollment is revoked, the platform immediately reprojects that device's monitoring state and it stops reporting.
- Historical posture snapshots already captured are retained as compliance evidence per your tenant's data-retention configuration.
Employee rights and transparency
- Disclosure: Employers deploying the agent are expected to disclose its presence and purpose to employees. The installer/first-run flow surfaces a disclosure at the point of install, and this data sheet is provided for wider communication.
- Scope transparency: The "what the agent does not collect" list above is exhaustive for compliance monitoring — the agent has no capability to read content, keystrokes, or credentials.
- Access questions: Employees with questions about what is collected about their device should contact their organization's compliance or IT administrator, who can share this data sheet and the specific policies evaluated.
For administrators
Deploying the agent is a decision with privacy implications. Before rollout:
- Confirm your internal acceptable-use / monitoring policy covers endpoint posture collection.
- Communicate this data sheet to affected employees.
- Scope deployment to the devices your compliance program actually requires.
See Deployment to roll out, and Revoke Semantics to stop collection for a device.