What does Crawft not capture?
There is no camera capture code in the agent, and Crawft does not capture password-field typing. It focuses on activity records — keystroke aggregates, browser context, app focus, screenshots at scoped intervals — sized to support review under your organization's own policy. It also produces no productivity score, ranking, or grade: Crawft describes what someone was doing and leaves the judgment to you.
What does Crawft capture?
Depending on your organization's configuration: focused apps and active windows, typed text in normal fields, browser URLs and visible page text, periodic screenshots during active use, device health and offline signals, and derived records (segments, sessions, activity cards, alerts, exports, operator notes, audit logs).
How is monitoring disclosed to users?
The deploying organization discloses monitoring through its acceptable-use policy or workplace handbook. Crawft keeps runtime notices quiet so work is not interrupted — the agent has no menu-bar UI by default. Disclosure is the organization's responsibility, and the drafting is yours: we do not supply a template acceptable-use policy. What we supply is an exact account of what is captured — this page and the security page — which is what your counsel needs to write one.
Who controls the data?
Your organization controls policy, access, and use. Crawft processes the data on the organization's documented instruction under the customer agreement and Data Processing Addendum. One correction worth making up front: Crawft is not a company — it is operated by Cruce Saunders as an individual, and no incorporated entity exists. The privacy policy says so in full.
Does anyone else see our data?
Yes, and it is named rather than buried: the nightly step that turns raw capture into a readable day record sends captured on-screen text and typed text to Anthropic through the Claude API. The full sub-processor list — AWS, Anthropic, Vercel, Resend, Plausible — is on the security page and in the DPA.
Where does our data live?
Data is stored in AWS us-east-1. That is the only region we run in — no other region is available. Tenant data is isolated by an org_id predicate on every read query and by org-prefixed object storage; that is application-level scoping, not Postgres row-level security.
On encryption, with the one qualifier a reviewer will ask for. At rest: the database, its backups, object storage and the queues are all encrypted. In transit: the Mac agent to our API, and our API to object storage, are TLS-enforced. The hop from our application to the database is not TLS-enforced — it is protected by network isolation instead, in a private subnet with no internet route. That is a real gap rather than a formality. This answer used to compress all of it into one flat sentence about encryption everywhere, which is the kind of summary that reads fine until someone asks which hop.
How long do you keep our data?
Screenshots are kept for at least 90 days. Activity records are retained indefinitely. No timer removes either one — no age-based purge runs against a record table, the screenshot store carries no expiry rule at all, and there is no retention window for your organization to set. After about 90 days a screenshot moves to cold archival storage: archived, not erased. Deletion of the record you read happens when someone asks for it, not on a schedule.
The exception, stated rather than glossed: two object stores — the two this deployment writes to — each carry a live expiry rule in AWS. The raw upload replay log and the processed-and-export object area each carry a 365-day expiry rule. Neither is the record you read in your console, and that record is unaffected by both — but one is not an internal artifact: an export bundle you generate is written into the processed area and is removed 365 days later. If you need an export kept longer than a year, download it. Full detail is on the security page.
What happens when a user leaves the organization?
Devices can be unenrolled and access can be removed. Retained records stay retained unless you ask us to delete them — see the retention answer above. Org-wide deletion of captured data and per-device wipe both run from the operator console on your written instruction, and both are audit-logged. Precisely what “org-wide” reaches — and what survives it, including your administrator accounts and the audit log itself — is set out on the security page.
How long does deployment take?
Pilot deployment is designed for a small IT-led cohort first (typically 10–30 devices, 2–3 weeks), then a broader rollout after policy, enrollment, and support flows are confirmed. The agent installs via your MDM. We provide an enrollment-code system so each install is bound to a specific seat.
What does it cost?
$50 per seat per month, and a seat is a device. One person with two enrolled Macs uses two seats, because the agent, the quota and the billing all count machines rather than people. Ten Macs is $500/month.
Month-to-month, not an annual lock — 20% off if you choose to prepay a year. No seat minimum. No add-ons and no tiers: one price, everything included. Nothing is priced on retention, because retention is not a setting (see above). This answer used to say the opposite about the billing term, which was wrong in the direction that costs you flexibility.
No self-serve checkout — sales is a conversation with the founder. Pilot cohorts are quoted individually on scope and rollout size. Request pilot access and we'll quote you within two business days.
How is this different from web-filtering tools?
Filtering tools block or allow in real-time. Crawft creates a record for review after something important happens, with cards that cite the source context. They're complementary, and nothing stops an organization running both — though we have no customers yet to say how many do. The category we replace is “post-incident forensics done by hand in a hurry.”
Can we self-host?
No. Crawft runs as a multi-tenant SaaS on AWS with per-tenant data isolation, and a self-hosted deployment is not built and not on the roadmap — this answer used to place it on the v2 roadmap, and no such commitment exists anywhere in our plan. The only self-hosting item we have actually written down is running the language model on our own hardware, which would change our sub-processor list and not your hosting. If data-residency rules out US-hosted SaaS for you, we cannot serve you today.
What about iOS, Windows, ChromeOS?
macOS-native only at launch. The agent is Swift, built on native macOS frameworks — screen capture with on-device OCR, app-focus tracking, and a companion browser extension. Other platforms are evaluated case-by-case for v2 — start a conversation if your fleet mix needs them.
Will the agent slow down the device?
The honest answer is that we have not measured it on a fleet, so treat what follows as a description of the design rather than a performance promise. Screen capture is capped at two frames per second and most frames are discarded on a perceptual-hash comparison — what reaches disk is a frame when the screen meaningfully changes, when the focused app changes, or once every ten seconds, whichever comes first. Text recognition runs on-device through Apple's Vision framework. The local spool is bounded by row, byte, age and free-disk limits, and returns freed space to the filesystem.
Three corrections to what this answer used to claim, because each was checkable and wrong. The agent is not deprioritized — both launchd jobs declare ProcessType: Interactive, which is macOS's highest scheduling tier, chosen so capture is not throttled. There are no CPU or memory budgets; the bounds we enforce are on disk. And uploads are not deferred to quiet periods — they run on a fixed poll interval with backoff, with no time-of-day logic anywhere in the agent. Per-device footprint numbers will be published once a pilot has produced them; none exist yet.
Is this spyware?
No. Spyware operates without the device owner's knowledge or consent. Crawft is deployed openly by the organization that owns the device, with end-user disclosure through your acceptable-use policy or handbook. We don't market to the surveillance industry — our customers are organizations that need a record they can review responsibly.