Which AI tools are in use. Never what anyone typed.
This page is written for the people GhostAudit is installed for and about: employees, works councils and data protection officers. Share it freely. Everything on it can be checked against the software.
One question, and only the data that answers it.
Organizations need to know which AI tools are used for work, so they can approve the good ones and guide people away from risky ones. Answering that takes the name of the tool and the time spent in it. It does not take anything else, so nothing else is collected.
What is collected
- Which AI tool was used, identified by its hostname (such as claude.ai) or application name (such as Cursor.exe)
- When, in five-minute windows, and for how many seconds the tool was active
- How many times the tool was opened in that window
- Whether a warning or a block page was shown, and what the person did next: switched to the approved tool, continued or closed the tab
- Only if the employer turns on sensitive-data warnings: the category of a flagged paste, such as "payment card", and a count
- Only from the desktop agent, and unless the employer turns it off: which AI agent clients are set up, and the name, package name or hostname of each MCP server they connect to
- Device details: operating system and version, browser and version, and for the desktop agent the computer name
- The user, as a work email or username, as a salted hash, or not at all, depending on the employer’s setting
What is never collected
- Prompts, questions, or anything typed into an AI tool
- Responses, generated text, images or code
- Page content, page titles, screenshots or screen recordings
- Keystrokes, clipboard contents or form input
- The text of anything you paste or upload, even when sensitive-data warnings are on
- Passwords, tokens, arguments or file paths from AI agent configuration files
- File names or file contents; documents that are open
- Full web addresses, search queries or browsing history
- Any website or application that is not on the employer’s list of AI tools
- Anything in incognito or InPrivate windows
{
"type": "web_usage",
"tool_key": "claude",
"host": "claude.ai",
"window_start": "2026-11-09T10:00:00Z",
"window_end": "2026-11-09T10:05:00Z",
"active_seconds": 240,
"visits": 3,
// pseudonymous identity mode
"user": { "hash": "9f2c…e41a" }
}Limits that are built in, not promised.
A privacy policy says what a company intends. These are things the software cannot do, whoever configures it.
- By default the browser extension touches no page. It injects no script anywhere. It sees the hostname of the active tab and nothing inside the page.
- One optional feature runs inside AI tool pages, and it is narrow. If the employer turns on sensitive-data warnings, a small script is added to the AI tool sites on the employer's list and to no other site. It listens for three things: a paste, a drop and choosing a file. It does not read the page, the conversation, what you type or the clipboard outside a paste you make.
- Matching happens on your device. The sensor holds your employer's list of AI tools and compares against it locally. Sites and applications that are not on the list are discarded in memory and are never stored or sent.
- The most specific thing collected is a hostname or an application name. Not the path, not the query, not the page title.
- The desktop agent does not look inside traffic. No packet capture, no TLS interception, no proxy. It needs none of the macOS permissions for screen recording, accessibility or full disk access.
- Data goes to one place. The sensors talk to the employer's GhostAudit server and to nothing else: no analytics, no third-party services.
- The extension does not run in private windows.
The extension is about 2,300 lines of unminified JavaScript with no third-party code, so these statements can be verified by anyone who can read it. The agent can print exactly what it would send, without sending it.
The extension popup, as an employee sees it. Names and figures are illustrative.
Northwind records which AI tools are used on work devices, and for how long. It does not record what you type or see. Questions: [email protected]
- ChatGPTApproved42 min
- ClaudeUnder review18 min
- CursorNot approved6 min
Three identity modes. The employer chooses; the choice is visible.
Whether usage is linked to a person is a setting, with three options.
- Named. Events carry a work email or username. The employer can see which AI tools a person uses and for how long.
- Pseudonymous. The sensor computes a salted SHA-256 hash on the device and sends that. The employer can count distinct people without the sensor ever sending a name.
- Anonymous. No user identity is sent. The desktop agent does not look up who is logged in. Usage is known per device only.
If a sensor receives a mode it does not recognise, it treats it as anonymous.
We recommend that employers choose the weakest mode that meets their purpose, agree it with employee representatives, and say which mode is in use in their notice to staff.
Sensor settings in an example workspace.
No hidden monitoring.
GhostAudit is not designed for covert use, and our acceptable use policy prohibits it.
- The extension popup shows what is collected, what is not, what was reported today, and a notice written by the employer.
- The desktop agent has a
statuscommand that shows the same notice and what the agent is doing. - When an employer chooses to warn about an unapproved tool, the person sees a page that explains the policy and offers the approved alternative. They can switch, continue or close the tab. Only the fact of the warning and that choice is counted, never the address they were heading to.
- A sensitive-data warning appears in front of you at the moment it applies, and says what kind of data was noticed.
- Blocking applies only to tools the employer has marked prohibited, and is off unless the employer turns it on.
Example workspace. Names and figures are illustrative.
Gemini isn’t covered by our data processing agreement. ChatGPT Enterprise is, and your work account already has a seat.
Your choice is counted (switched, continued or closed). The address you were visiting is never stored or sent.
Checked in your browser tab. Reported as a category and a count.
This feature is optional and off unless the employer turns it on. It exists to stop an accident: a card number, a password list or an API key pasted into an AI tool without thinking.
What happens. When you paste or drop text into an AI tool on the employer's list, or choose a text file to upload, the extension checks it against a set of patterns. If one matches, a banner says what kind of data it looks like. Depending on the employer's setting the paste goes through, or it is stopped, sometimes with a "Paste anyway" button.
Where it happens. In the browser tab, on your device. The check makes no network request. The text is held in memory while it is checked and is never written to storage. In block mode with "Paste anyway" it is held until you dismiss the banner, for at most two minutes, so that it can be inserted if you choose.
What is sent. The AI tool, the category, whether you were warned or blocked or pasted anyway, and how many times in a five-minute window. Nothing else: not the text, not a piece of it, not its length, not a fingerprint of it, not a file name.
The categories. Payment card numbers, US Social Security numbers, IBANs, email and password pairs, private keys, API keys and tokens, and ten or more email addresses or phone numbers in one paste.
Its limits. It recognises patterns, so it can miss things and can occasionally flag something harmless. It does not see what you type. It is a reminder, not a filter on your work.
The warning as an employee sees it, and everything that is sent when it appears. Values are illustrative.
{
"type": "sensitive_data",
"tool_key": "chatgpt",
"category": "payment_card",
"action": "warned",
"count": 2,
"window_start": "2026-11-09T10:00:00Z",
"window_end": "2026-11-09T10:05:00Z",
"user": { "hash": "9f2c…e41a" }
// no text, excerpt, length, hash of the content, position or file name
}What the desktop agent reads from AI client settings, and what it leaves.
AI assistants can be connected to other systems, such as files, code repositories or databases, through small programs called MCP servers. Employers want to know which connections exist, because a connected assistant can act on company systems.
If you have the GhostAudit desktop agent, version 1.1 or later, it reads the settings files of AI assistant applications in your user profile, a few times a day. Employers can turn this off.
What it takes from them. For each connection: which application it is set up in, the name you gave it, and either the name of the software package or the hostname of the service.
What it leaves. Everything else in those files. Passwords, tokens, environment variables, command arguments, folder and file paths, and the path or query part of any address are not read into the report. The report format has no place to put them.
What it does not touch. Settings stored inside a project or code repository. What the assistant actually did. Anything you asked it.
One thing to be aware of: the name you gave a connection is reported as you wrote it. If you named one after a client or a person, that name is in the report.
{ "mcpServers": {
"prod-db": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-postgres",
"postgresql://app:••••••@db.internal:5432/prod"],
"env": { "PGSSLROOTCERT": "/Users/dana/certs/ca.pem" }
}
} }{ "client": "cursor", "name": "prod-db",
"transport": "stdio", "command": "npx",
"package": "@modelcontextprotocol/server-postgres" }Employees can read the rules, and see what is recorded about them.
An employer can give every employee a page of their own, the employee AI hub. It shows the approved AI tools, the AI policy, a short course, and a privacy page with three parts: what is collected, what is never collected, and what has been recorded about you: which AI tools, and for how long. Nothing else is recorded, so nothing else is shown.
An employee signs in through the company's single sign-on, a link from an administrator or the browser extension. A hub session is not an account in the console. It cannot open the inventory, see risk ratings, read a reviewer's internal notes or see anything about a colleague.
The hub follows the identity mode. In pseudonymous or anonymous mode it stores a salted hash in place of the work email, and administrators see counts, not names. What the hub adds to the record is small and visible to the person concerned: that they acknowledged a version of the policy, which course modules they completed, and the tool requests they made. If an employee asks for their data to be erased, those entries go and only totals remain.
You can look at a live example hub with fictional data.
What to ask your employer, and what we can give you.
If you are reviewing a planned deployment, these are the questions that matter, and where the answers come from.
| Question | Where the answer is |
|---|---|
| Exactly which fields are collected? | Field-level documentation for the extension and the agent, available on request and shipped with each sensor |
| Is identity named, pseudonymous or anonymous? | The employer's sensor settings; changes are recorded in the audit log |
| Who can see individual usage? | The employer's role assignments in GhostAudit |
| Is warning or blocking enabled? | The employer's sensor settings |
| Are sensitive-data warnings on, and in which mode? | The employer's sensor settings; off by default |
| Is AI agent and MCP server discovery on? | The employer's settings for the desktop agent; changes are recorded in the audit log |
| Where is the data stored? | The hosted service, or the employer's own servers if self-hosted |
| How long is it kept? | The employer's retention setting: 30 days to 2 years, or kept until deleted, with the option to keep only anonymised totals after the period. New workspaces default to 365 days. See also the data processing addendum |
| Can one person's data be exported or erased? | Yes. An owner or admin can export everything held about one employee, erase it while keeping organization totals, and stop further collection for that person. Each request is logged |
| What notice will employees see? | The employer writes it; it is shown in the extension popup |
Under data protection law the employer is the controller of this data and GhostAudit is its processor. The employer is responsible for the lawful basis, for informing employees, and for consulting employee representatives where the law requires it. We can supply the technical facts for a data protection impact assessment; we cannot carry it out for the employer.
The product includes two templates for this conversation: an employee AI monitoring notice and a briefing for works councils and employee representatives, both filled from the employer's actual settings. Our guide to monitoring notices in New York, Connecticut and Delaware explains the US notice laws.
We are glad to walk a works council or data protection officer through the software directly. Write to [email protected].
What we are not claiming.
This page describes the GhostAudit sensors. It does not describe other software your employer may run, such as endpoint security or network monitoring tools, which work differently.
It also describes capabilities, not your employer's choices. Whether monitoring is lawful and proportionate in your workplace depends on how it is introduced and used, and that is a matter for your employer, your representatives and, if needed, your data protection authority.
In named mode, your employer can see which AI tools you used and for how long. That is less than most monitoring software collects, and it is still personal data about you. You have the rights your local law gives you over it.
Questions employees ask
- Can my employer read what I type into ChatGPT or another AI tool?
Not with GhostAudit. The sensors do not collect prompts, responses or page content, and nothing in the product can show them to anyone.
- Does it read what I paste?
Only if your employer has turned on sensitive-data warnings, and then only inside your own browser tab. At the moment you paste into an AI tool, the text is checked for patterns such as card numbers or API keys. If one matches you see a warning. What is reported is the kind of data and a count, for example "payment card, 1". The text itself is discarded and never leaves your device.
- Does it record the other websites I visit?
No. The sensor compares the site you are on with a list of AI tools. If the site is not on the list, nothing about it is stored or sent.
- Does it work in private browsing?
No. The extension is not allowed to run in incognito or InPrivate windows.
- Can I see what is being collected about me?
Yes. Click the extension icon in your browser toolbar. The popup shows what is collected, the notice your employer has written, and what has been reported from that browser today.
- Does it measure my productivity?
No. GhostAudit does not record activity outside AI tools, has no idle or attendance reports, and cannot tell what you were doing in a tool. It is built to answer which AI tools an organization uses, not how individuals spend their day.
- Who decides whether my name is attached?
Your employer chooses one of three identity modes: named, pseudonymous or anonymous. Ask your employer, or your works council, which one is in use. The mode is a setting in the product and changes to it are recorded in the audit log.
- Who should I contact about my data?
Your employer is the controller of the data and the right contact for access or deletion requests. GhostAudit processes it on your employer's instructions. If you believe GhostAudit is being used unlawfully, you can also write to [email protected].
- Monitoring employee AI use without surveillanceOur guide for employers on doing this proportionately.
- Employee AI monitoring noticesWhat three US states require employers to tell you.
- SecurityHow the product stores and protects data.
- Privacy policyHow we handle personal data, as controller and as processor.
Reviewing a deployment? Talk to us directly.
We will show a works council, data protection officer or security team exactly what the sensors send, on a device of your choosing.