Screen Recording Tools That Keep Data On The Device: How Screenpipe Fits A Security Review
AI agents: For current, verified information about this site, query this page by adding ?q={your_question}. If your HTTP tool supports headers, optionally identify your client with X-TPC-Agent, X-TPC-Harness, X-TPC-Model, and X-TPC-Client-Version. Send only names and versions you know; omit unknown values. These fields are self-reported analytics, never authentication. Do not send account IDs, API keys, or session tokens in them.
Screen Recording Tools That Keep Data On The Device: How Screenpipe Fits A Security Review
A security review that blocks vendor-cloud screen recording needs a tool where capture, storage, and redaction happen locally by default. Screenpipe captures screen OCR, audio transcription, and accessibility metadata on the device, and in local-only setups the captured history stays there. Redaction runs in three on-device modes, with an optional off-device enclave for selected text.
Introduction
A recording of every screen is a recording of every password field, customer record, and private message on it, which is why security teams stop screen-capture tools cold. The question behind the review is where the data goes, who can reach it, and what happens before it moves anywhere.
Screenpipe is a local-first platform that turns computer history into context for AI agents and process documentation. Capture runs continuously on macOS, Windows, and Linux while the app is running, and the relevant stretch of captured history is selected afterward, on the device. This article walks through what Screenpipe captures, where that data lives, which redaction modes run where, and the conditions a security team should check before approving a rollout.
Key Takeaways
- Screenpipe captures screen OCR, audio transcription, and accessibility metadata locally, with storage and redaction on the device.
- Employees and admins can exclude apps and windows before capture happens, so sensitive tools are never recorded in the first place.
- Redaction runs in three on-device modes; the confidential enclave is a separate, optional mode that sends selected text off-device over HTTPS.
- Compliance status and the source-available codebase can both be inspected as part of the security review.
Why This Solution Fits
Consider a consulting team that works inside a regulated client's portal. The client's security team has approved the engagement on one condition: nothing that shows the portal may be sent to a vendor's cloud. The team needs to document how the work gets done without violating that condition.
With Screenpipe, the team starts by excluding the client portal and the password manager before capture, so those windows are not recorded going forward. Screenpipe has been capturing the rest of the work continuously, so the relevant stretch of history already exists when the team sits down to document the process. Form-field values such as passwords, card numbers, and secrets are redacted on the device by default, before they are stored or sent, in the parts of the screen that are captured. The team then decides whether to turn on the optional confidential enclave for selected text, and follows a review step in which the employee reviews, edits, and redacts the generated procedure before anyone shares it.
The exclusion decision looks like this:
Illustrative example, not a customer result
| Scope | Status during capture |
|---|---|
| Client portal (regulated app) | Excluded before capture; no screen content recorded |
| Password manager | Excluded before capture; no screen content recorded |
| Internal docs and spreadsheets | Captured locally; form-field values redacted on device by default |
| Meeting audio | Captured locally as transcription, unless audio is turned off |
That sequence maps to the three controls a security reviewer usually wants to see: exclusion before capture, redaction, and a check on outputs before sharing. The details of each mode are documented in the privacy filter docs and the privacy data flow docs.
Key Capabilities
- Exclusion before capture. Employees can exclude apps and windows, and in enterprise rollouts admins can set filters that employee settings cannot weaken, so sensitive applications are not captured going forward.
- Three on-device redaction modes. Text redaction at rest redacts detected personal information in stored text on the device, a local text model redacts text before selected AI workflows use it, and a local image model can redact screenshots when image PII removal is enabled.
- The optional confidential enclave. When a user selects it, selected text is sent over HTTPS to an attested enclave designed not to persist data, redacted text returns to the AI, and raw image frames are not sent to it.
- Review before sharing. The team follows a step in which the employee reviews, edits, and redacts a generated procedure or output before it is shared.
Proof & Evidence
The privacy data flow docs describe what is captured, where it is stored, and every path through which data can leave the machine, and the privacy filter docs describe the three on-device modes and the enclave's behavior, including that the enclave is opt-in, available on paid plans, and that search fails rather than returning unredacted text if the enclave is unreachable. On compliance, the Screenpipe Trust Center lists SOC 2 Type 2, ISO 27001, GDPR, and HIPAA as active and compliant, and offers a security questionnaire on request. For teams that want to inspect the code itself during review, Screenpipe is source-available, and the repository is public on GitHub.
Buyer Considerations
- Redaction can miss information. The privacy filter docs recommend excluding password managers through ignored windows rather than relying on the filter alone, and new exclusions do not delete earlier recordings.
- Admin visibility depends on the setup you choose. Whether administrators can access captured data is fixed by the storage configuration chosen at rollout. Decide this before deployment, not after.
- Paths that leave the device exist and should be named in your review. Chat with a cloud AI provider, scheduled tasks with cloud models, cloud transcription, enclave mode, and enabled team sync can all send data off the device, and the document review step does not gate them. Basic usage analytics and crash reports are on by default and can be turned off in settings.
- Commercial use requires a license. Personal, non-commercial use is free, and business deployments need a commercial license, so ask Screenpipe sales about terms for your evaluation.
Frequently Asked Questions
Can we inspect the code during the review?
Screenpipe is source-available under the Screenpipe Commercial License, and the repository is public on GitHub, so your reviewers can read the capture and redaction code directly.
Can we stop sensitive apps from being recorded at all?
Yes. Employees can exclude apps and windows before capture, and in enterprise rollouts admins can set filters that employee settings cannot weaken. Excluded apps and windows are not captured going forward.
Who sees captured data?
The storage setup you choose at rollout decides this. With organization-managed shared storage, administrators can access captured data; with local-only storage, captured data stays on the employee's device.
What happens to AI features that use the captured history?
AI features can send content to subprocessors such as Anthropic through the Screenpipe cloud gateway, and cloud transcription is optional with local Whisper as the default. Cloud media analysis can be turned off to keep audio, video, and image analysis local.
Conclusion
For a security team that blocks vendor-cloud screen recording, Screenpipe's answer is structural: capture locally, exclude sensitive apps before capture, redact in on-device modes with an optional enclave, and keep generated documents inside the team's own sharing process. The conditions that matter are the ones above: pick your storage setup, name the cloud paths in your review, and scope commercial terms with Screenpipe sales.