Before I automate anything, a lightweight agent runs for a week on your team's machines and finds where the hours actually go — which workflows repeat, which tools the work bounces between, what it costs. You get a ranked Automation Opportunity Report; I get a build plan. The audit is the method. Building the automation agents is the service.
Real app/tab names for a decision-grade report · stays on the device · one gated egress point · opt-in manifest · strict metadata-only mode available · uninstall in one command.
Ranked by recoverable hours — what to automate first.
Everyone sees the privacy manifest — what's collected, what never is — before anything runs. Then a one-command, unsigned install per machine (I do it with you, white-glove). No covert deployment, ever.
For a workday-week the agent samples which apps are active, how long, in what sequence; what kinds of files move where; which categories of SaaS the browser time goes to. Idle time is excluded. People are pseudonymized.
The per-action timeline never leaves the machine. The agent rolls everything up locally and ships only the compact summary — through a single, gated upload path you can read in the code.
The Automation Opportunity Report: your team's real workflows, ranked by recoverable hours and dollars, with the evidence behind each. That ranked list is the build plan for the actual service — the automation agents.
Every event passes a privacy gate at capture time — a single chokepoint that keeps only the allowed fields and fails loudly if a forbidden one ever appears. The local datastore re-checks the same contract before anything is stored, and nothing leaves the machine without a human approving it. This is the same architecture standard I work to at a major US bank.
· App + the real window/tab title + activity category
· Active duration & idle time
· Process name + start/stop (never command-line arguments)
· File action + name + type + size bucket + location category (never the full path)
· In-browser SaaS category + the real tab title
Real titles make the report decision-grade. Want stricter? A one-flag metadata-only mode drops every title and keeps just categories.
· Keystrokes, screenshots, clipboard
· File or message content
· Passwords, secrets, tokens
· Full URLs (query strings) or hostnames
· Full file paths
· Command-line arguments
· Personal identity — people appear only as pseudonymous IDs
Local-first: data — titles included — stays on the device and aggregates there; only the report is shared, and only through one gated egress point a human approves. Opt-in · transparent manifest at install · 30-day retention by default · delete on request · uninstall in one command. Purpose: find workflows to automate — never employee monitoring or scoring.
White-glove and unsigned by design: no app-store gatekeeping, no opaque binaries — the agent is readable Python installed into a sandboxed virtualenv. I run the install with you on a short call; removal is just as fast.
bash packaging/install-macos.sh
Shows the manifest, asks for consent, installs a per-user background service, and triggers the one-time "Automation" permission click that lets it read Safari/Chrome tab titles (kept on the device, never the URL). Requires Python 3.10+.
powershell -File packaging\install-windows.ps1
Shows the manifest, asks for consent, registers a least-privilege Scheduled Task, and sets up the optional browser extension (loaded unpacked — it categorizes in-page and only ever hands over a category). Requires Python 3.10+.
By default: nowhere. The agent writes its daily aggregate to a local datastore on the machine. For multi-machine pilots, devices enroll with a per-client key and upload summaries to a private, client-scoped bucket — encrypted, TLS-only, auto-expiring, and revocable per device. Uploads stay off until you and I turn them on together.
Downloads are issued per engagement during the white-glove install — there's no public binary. Want it on your team's machines? Start with the free audit →
One week of measurement. A ranked report in hours and dollars. Then we automate the top of the list.