Security · Activity Racoon

Activity Racoon builds Activity Racoon for engineering teams that need accurate delivery analytics without sacrificing trust. This page describes the security controls implemented in the product today. For what data we collect, see our Privacy Policy.

Architecture overview

Activity Racoon has three main components: a Windows desktop agent (service + tray) on monitored workstations, an optional IDE extension (VS Code / Cursor), and a server stack (customer API, dashboard, PostgreSQL database). Activity data flows from agents and integrations to the server, where it is stored and surfaced in dashboards.

Organizations may run the server on infrastructure they control (self-hosted) or use a deployment operated by Activity Racoon. In both cases, customer data is stored in PostgreSQL and access is scoped by organization.

Encryption

In transit

Communication between the desktop agent, IDE extension, browser dashboard, and API should use HTTPS/TLS in production. Agent ingest payloads may use an additional encrypted envelope: ephemeral X25519 key exchange with AES-256-GCM for the request body.

At rest

Screenshots — when screenshot sampling is enabled, captures use AES-256-GCM. Encryption keys are protected with the platform secret store on the workstation and are separate from database contents.
Agent credentials — registration tokens and machine identity are stored in an encrypted file on the workstation, not in plain text.
Passwords — dashboard account passwords are hashed with Argon2 before storage. Session tokens are stored as hashes, not plaintext.

Authentication and access control

Dashboard access uses bearer-token sessions with a defined time-to-live.
Each organization has admin and member roles. Admins manage policy, invitations, and team visibility; members are mapped to Windows tracking usernames for the agent.
API routes for calendar, team views, policy changes, and agent registration require authentication once an organization is configured.
Agents authenticate with organization-issued credentials tied to a machine ID and tracking username.

Desktop agent safeguards

We designed the Windows agent with explicit limits on what it captures:

No keystroke logging and no clipboard capture.
Collects application, window, session, and AFK signals — not file contents or typed input.
Screenshot sampling is off by default and only runs when enabled in organization policy.
Exclusion rules let organizations block processes or title patterns before data is stored or synced.
When offline, events buffer locally and sync when connectivity returns; server policy and exclusions are applied on upload.
An integrity chain appends tamper-evident hashes to selected event streams for auditability.

Window titles and browser URLs can still contain sensitive information. Organizations should configure exclusions and provide workforce notice as required by law.

IDE extension

The developer extension sends workspace context and edit summaries (not full file contents or keystrokes) to the organization's API for task attribution. It uses the same API authentication model as other clients.

Integrations

Third-party connectors (GitHub, Jira, Linear, GitLab, Slack, and similar) use credentials or OAuth tokens supplied by the customer. Activity Racoon only accesses data those integrations authorize. Tokens are stored for the organization and used solely to provide the Service.

AI features

Optional AI capabilities (sprint summaries, dashboard Q&A, task matching, screenshot analysis when enabled) send contextual activity data to a configured model provider (Google Gemini when GEMINI_API_KEY is set). Organizations should enable AI features only if this processing meets their compliance requirements.

Infrastructure and operations

Database — PostgreSQL is the system of record for activity, accounts, and policy.
Deployment — the server stack can run via Docker Compose on customer-controlled hosts or equivalent infrastructure.
Observability — optional OpenTelemetry metrics/traces, Prometheus, Grafana Cloud, and Sentry may be enabled for service health. Sentry is configured with send_default_pii: false so error reports do not include end-user personal data by default.
Process icons — optional Google Cloud Storage may cache application icons; this does not include user activity content.

Data retention and deletion

Retention is governed by organization configuration and operational needs. Screenshot storage respects organization storage caps with oldest-first eviction. Customers may request deletion of hosted data when their agreement ends; self-hosted customers control deletion on their own infrastructure.

Incident response

We investigate suspected security incidents affecting the Service. If we confirm unauthorized access to customer personal data in a hosted deployment, we will notify affected customers without undue delay and in line with applicable law.

Report a vulnerability

If you believe you have found a security issue in Activity Racoon, please report it to [email protected] with the subject line Security report. Include steps to reproduce, impact, and any proof-of-concept. Please do not publicly disclose issues until we have had a reasonable opportunity to investigate.

Compliance posture

Activity Racoon is built with GDPR-style data-processing concepts in mind (controller/processor roles, data minimization, customer-configurable policies). We do not currently hold third-party certifications such as SOC 2 or ISO 27001. Enterprise customers may request our Data Processing Agreement and ask security questions during evaluation.