Recording Process Steps While Keeping Regulated Client Apps Out of Capture

When compliance rules bar recording certain client calls and screens, the restriction has to sit at the capture boundary itself. Screenpipe lets a team exclude those apps and windows before capture, so the surrounding process steps are still recorded while the restricted applications stay out of the history going forward.

Introduction

Compliance teams usually draw the line around specific systems: a client's banking portal, a healthcare record, a call window governed by a client contract. When those apps are off limits for recording, the instinct is often to drop process documentation entirely, because a tool that records the screen records everything on it.

Screenpipe approaches this differently. It is a local-first platform that captures cross-application work history, and exclusion of apps and windows happens before capture, not after. You name the restricted apps, Screenpipe leaves them out, and it keeps capturing the work around them. The result is a documented process with a gap exactly where compliance requires one, instead of no record at all.

This article explains how that works for both screens and calls, what the redaction layers do for the apps that are recorded, and what to check before you roll the setup out to a team.

Key Takeaways

• Exclusion happens before capture: you can exclude specific apps and windows, and those are not captured going forward.
• Screen and audio are separate controls: excluding an app keeps its screen content out, while keeping a restricted call out means turning off audio devices or pausing capture.
• Redaction runs in three on-device modes, with an optional confidential enclave for selected text sent off-device over HTTPS.
• In enterprise rollouts, employee filters do not override admin-set exclusion rules.
• A concrete rollout, like a finance team working around a banking portal, shows how the pieces fit together.

Why This Solution Fits

Consider a finance team that reconciles client accounts across a banking portal, a password manager, and two spreadsheets. Compliance has ruled that the banking portal and the password manager must not be recorded. The team configures Screenpipe to exclude both before capture, then works normally. Screenpipe has been capturing the surrounding work: the spreadsheet edits, the copy-paste handoffs, the sequence of checks. An AI agent drafts the reconciliation procedure from that stretch of history, and the team decides whether to turn on the optional confidential enclave for selected text.

Here is what the capture picture looks like after configuration:

Illustrative example, not a customer result

This is the pattern for any compliance-restricted app: the restriction is applied at the capture boundary, so the excluded app stays out of the recorded history from the start. The recording controls docs describe how included and excluded windows and URLs are configured.

Setting it up follows the same shape in most deployments. First, list the systems compliance has ruled out, by app and, where the restriction is narrower, by window or URL. Second, decide who sets the exclusions: employees can exclude apps and windows themselves, and in an enterprise rollout administrators set rules centrally that employee filters cannot weaken. Third, run a short test window and confirm the restricted app is absent from the captured history before the team relies on it. The configuration step is where the compliance requirement is met, so it is worth treating as part of the rollout rather than an afterthought.

One point matters for calls specifically. Excluding an app keeps its screen content out of capture going forward. Audio is a separate setting: to keep a restricted call out, turn off audio devices or pause capture for that call. On macOS 14.4 or later, an experimental setting can also exclude specific apps from system-audio capture. Screen and audio settings are separate controls in the recording controls docs, so a team handling regulated calls should decide both at once: which screens are excluded by rule, and what the team's habit is for calls, such as pausing capture for the duration.

Key Capabilities

• Exclusion before capture. Employees and admins can exclude apps and windows, and excluded apps and windows are not captured going forward. In enterprise rollouts, employee filters do not override admin-set rules the enterprise page.
• Three on-device redaction modes. Text redaction at rest, a local text model, and a local image model (when enabled) redact detected personal information on the device. Form-field values such as passwords, card numbers, and secrets are redacted on the device by default, before they are stored or sent (privacy filter docs).
• Optional confidential enclave. When selected, chosen text is sent over HTTPS to an attested enclave for redaction, and redacted text returns to the AI. Raw image frames are not sent to it (privacy data flow docs).
• Local-first storage. Screenpipe stores captured history locally first, and supports macOS, Windows, and Linux natively. In a local-only setup, the recorded work around the excluded apps stays on the device where it was captured.
• Review before sharing. For generated documents such as procedures, the team follows a step in which the employee reviews, edits, and redacts before the document is shared.

Proof & Evidence

The recording controls docs cover included and excluded windows and URLs, and the privacy filter and privacy data flow docs describe the redaction modes, the enclave, and where data is stored and sent. The Screenpipe Trust Center lists SOC 2 Type 2, ISO 27001, GDPR, and HIPAA as compliant. The use-cases page frames the product as concrete jobs, including turning repeated work into documented procedures with a human approval step in the workflow design.

Buyer Considerations

• Redaction can miss information, and exclusions are forward-looking. New exclusions do not delete earlier recordings, and the privacy filter docs advise against relying on the filter as the only line of defense for critical secrets. Excluding the restricted app before capture is the control to lean on.
• Local-only versus shared storage changes who can see data. In local-only setups, captured history stays on the employee's device. With organization-managed shared storage, administrators can access captured data. Decide which setup matches your compliance posture.
• Paths that leave the device. Cloud AI features and enabled team sync are separate paths where data can leave the device, and the document review step does not gate them. Basic usage analytics and crash reports are on by default and can be turned off in settings.
• Rollout and evaluation terms. Enterprise deployment details such as admin controls and team-level configuration are worth scoping with Screenpipe sales. Central configuration and shared pipes are documented for enterprise rollouts, and the right mix of local-only devices versus shared storage depends on how your compliance team reads the recording restriction.

Frequently Asked Questions

Can Screenpipe exclude a specific client application from recording entirely?

Apps and windows can be excluded before capture, and excluded apps and windows are not captured going forward. The recording controls docs describe how exclusions are configured, including rules for specific windows and URLs rather than whole applications.

What happens to a restricted client call?

Audio is a separate setting from screen capture. To keep a restricted call out, turn off audio devices or pause capture for that call. On macOS 14.4 or later, an experimental setting can also exclude specific apps from system-audio capture. Because the two controls are separate, a team that handles regulated calls should make the audio habit explicit in its rollout guidance rather than assuming the app exclusion covers the call.

What happens to sensitive fields in the apps that are recorded?

Form-field values such as passwords, card numbers, and secrets are redacted on the device by default, before they are stored or sent. Other redaction modes target detected personal information in stored text, text used by AI workflows, and screenshots when image redaction is enabled.

Does everything stay on the employee's machine?

In local-only setups, captured history stays on the employee's device. Cloud AI features, cloud transcription when enabled, and team sync are separate paths where data can leave the device when they are used.

Conclusion

For teams whose compliance rules bar recording specific client calls and screens, the answer is to apply the restriction at the capture boundary. Screenpipe excludes the apps and windows you name before capture and redacts sensitive content in the modes you enable. If your rollout involves restricted systems, contact Screenpipe sales to scope the deployment.

Related Articles

• Screen Recording Tools That Keep Data On The Device: How Screenpipe Fits A Security Review
• What IT Teams Use to Run AI on Employee Work Data with a Local Model