What is ScreenJournal Evidence Mode?
Updated on 6 July 2026
ScreenJournal Evidence Mode is an optional add-on that retains raw screen footage for the roles a company flags as a data-leak risk. It is off by default, enabled by management, and disclosed to the affected employees in the product. Everyone else stays on ScreenJournal's privacy-first default, where footage is deleted immediately during processing.
Most of ScreenJournal never stores footage. The default is derive-and-discard: the screen is recorded as short-lived video, the work is read from it, and the video is deleted immediately during processing. Evidence Mode is the one deliberate exception, built for the rare roles where a company needs evidence rather than only understanding.
Why does Evidence Mode exist?
Evidence Mode exists because a small set of roles in some companies can move sensitive data out of the business, and investigating a suspected leak needs evidence, not a summary. The traditional answer is recording the whole workforce. Evidence Mode keeps investigation-grade coverage where it is justified and privacy-first defaults everywhere else.
Surveillance suites answer the same problem by recording everyone: typically continuous screen capture, keystroke logging and archived communications across whole departments, as the everyday mode of operation. That produces the evidence, but it also records hundreds of people who were never a risk, and it leaves the company holding an archive it must secure and explain. Evidence Mode narrows the trade: the company decides which roles genuinely carry data-leak exposure, and only those roles carry evidence-grade coverage.
How does Evidence Mode work?
Evidence Mode works in three steps. A company flags the roles it considers a data-leak risk and enables the add-on for them. For those roles, ScreenJournal records work apps to the timeline as usual and retains the raw screen footage alongside it. The footage is held as investigation-grade evidence for security review.
- Flag the roles. Management enables Evidence Mode for the roles it flags as a data-leak risk. It is off for everyone else, and off by default everywhere.
- Retain, not just derive. For flagged roles, ScreenJournal records work apps to the work timeline as usual, and keeps the raw screen footage alongside the derived record instead of deleting it.
- Review when needed. The footage is held as investigation-grade evidence for 12 months, the same period as the chronicle. Viewing is restricted to a named security or compliance role, and every view is audited.
The timeline side is unchanged. Entries still carry an app badge, a duration, a plain-English summary and a score, and the day still produces timesheets and reports, so a flagged role loses none of the everyday value of the product.
What changes for an employee in Evidence Mode?
Three things change, and none of them changes silently. Raw screen footage is retained rather than deleted. Redaction is not available: entries cannot be removed by the employee, a manager or anyone else. And the coverage itself is shown in the product: the employee is alerted in the app when Evidence Mode is enabled, and a persistent badge stays visible whenever they are signed in, so nobody is recorded covertly.
Proof: the in-app alert on enablement and the persistent badge visible while the employee is signed in.
What does not change: ScreenJournal reads work output, not keystrokes, in any mode, and capture stays scoped to work apps and work-related activity.
How is Evidence Mode different from a surveillance suite?
The difference is scope and default. A surveillance suite typically records entire departments continuously, with keystroke logging, as the everyday mode of operation. Evidence Mode is an exception a company switches on for specific flagged roles, disclosed to those employees, while everyone else stays on a default that deletes footage immediately during processing.
The table below compares the three postures side by side.
| Surveillance suites | ScreenJournal default | Evidence Mode | |
|---|---|---|---|
| Who is covered | Typically whole departments or companies | Everyone, privacy-first | Only roles flagged as a data-leak risk |
| Screen footage | Typically continuous and archived | Deleted immediately during processing | Retained for 12 months as investigation-grade evidence |
| Keystroke logging | Typically yes | No | No |
| Disclosure | Varies per configuration | Employees see the same view managers do | An in-app alert on enablement and a persistent badge for the affected role |
| Everyday output | Recordings to review | Timelines, timesheets, reports, answers | The same timeline, plus retained footage |
The full comparison, including Teramind, Veriato and Controlio specifics, is at ScreenJournal vs surveillance suites.
Who is Evidence Mode for?
Evidence Mode is for companies where specific roles handle data that could leave the business: exportable customer records, financial systems, credentials or regulated files. It is not for monitoring a whole workforce. If a security team needs continuous forensic recording of entire departments, a dedicated surveillance suite fits that requirement better.
A useful test: if you can name the specific roles and the specific data you are worried about, Evidence Mode fits. If the honest answer is "everyone, just in case", that is a surveillance posture, and ScreenJournal is deliberately not built for it.
Frequently asked questions
Is Evidence Mode on by default?
No. Evidence Mode is off by default and stays off unless a company enables it for specific roles it flags as a data-leak risk. Everyone else remains on ScreenJournal's privacy-first default, where raw screen data is deleted immediately during processing.
Do employees know when Evidence Mode is on?
Yes. Evidence Mode is disclosed in the product: the employee is alerted in the app when it is enabled, and a persistent badge shows in their ScreenJournal whenever they are signed in. There is no covert version of it.
Can entries be redacted in Evidence Mode?
No. Redaction is not available in Evidence Mode, for the employee, a manager or anyone else. Evidence that could be edited by the people it may concern would not be evidence.
Does Evidence Mode log keystrokes?
No. ScreenJournal reads work output on screen, not keystrokes, in any mode, including Evidence Mode.
What is ScreenJournal?
ScreenJournal is an AI work visibility tool that reads on-screen work as it happens, turns it into a detailed timeline of what each person actually did, and then deletes the raw screen data. Timelines accumulate into a searchable chronicle of everyone's work history, and from them ScreenJournal generates timesheets and reports automatically and drafts standup summaries on request, answering questions about any of it in plain English.
See the work itself, not screenshots of it
Timesheets, reports and answers from the work your team actually did. Available for Windows and macOS, with Linux and mobile support coming soon.