User Manual & Documentation

eWatch is a multi-tenant workforce-monitoring and analytics platform. A lightweight Windows agent runs on each employee's computer and streams activity, screenshots, screen recordings, app/website usage, location and data-loss events to a secure, real-time web dashboard.

Unlike tools that only log, eWatch also enforces policy — blocking websites, denying USB storage, stopping printing and closing risky apps — driven by a layered Organization → Team → User policy engine.

1. 1Create your workspace at /signup (14-day free trial, no credit card), or sign in if your admin already invited you.
2. 2As an admin, invite your team from Employees → invite, create Teams and assign each team a manager.
3. 3Install the Windows agent on each computer (see The Windows agent).
4. 4Watch data appear in real time on the Dashboard, and configure policies (DLP, screenshots, recording) under Settings and Data Loss Prevention.

Each tenant has three roles with a clear hierarchy:

• Admin — full access to the whole organization: all employees, teams, monitoring data, billing and configuration (DLP policy, alert rules).
• Manager — sees and manages only their own team members (timesheets, monitoring data, approvals). Managers never see an admin's data and can't change org-wide configuration.
• Employee — a self-service portal showing only their own overview, timesheet, requests and profile.

How mapping works: assign an employee to a Team, and give that Team a Manager — the employee's manager is their team's manager.

The agent is a visible system-tray application (never hidden). It installs with admin rights, auto-starts at every login and resists tampering.

Install & enroll

1. 1As a tenant admin, open Settings → Install monitoring agent; copy the Tenant Key and download eWatchSetup.exe.
2. 2Run the installer on the employee's PC (it self-elevates via a UAC prompt).
3. 3Enter the Server URL and Tenant Key, accept the monitoring (and optional location) consent, and install.
4. 4The device appears under Employees within a minute and begins streaming.

The dashboard shows real-time KPIs — tracked hours, productivity %, active-now count — a productivity trend, a team leaderboard and a live activity feed.

Activity % is how much genuine keyboard/mouse input occurred in a sampling window (100% = continuously active, 0% = idle). Productivity % is separate: it reflects whether the app/website used is classified productive, neutral or unproductive.

Screenshots are captured automatically on a configurable interval, with a viewer, flagging, privacy blur and date/user filters. Each screenshot shows the activity % at capture time.

Screen recording is a continuous low-fps timelapse, enabled per employee by an admin (plan-gated). It's compressed to stay light on CPU and disk, and plays back in the browser under the employee's Recording tab.

Every application and website used is tracked with duration and classified as productive / neutral / unproductive. Admins classify apps once (App & Web Usage → classify) and the change is backfilled across history. Filter by employee and date.

Attendance is built from the agent's Start day / End day plus breaks. eWatch computes net worked hours (present − breaks, counting only inactivity that overlaps a work session) and a payable amount, shown on a calendar with per-day detail.

When an employee is idle, they can submit a reason for the idle period. It goes to their manager (and admins) as a request.

• Employee → opens My Timesheet, picks a day, chooses Request approval on an idle period.
• Manager / Admin → the Approvals inbox lists pending requests; approve or reject with a note. Approved idle time is excluded from break deductions.
• Both sides get real-time notifications on submit and decision.

DLP goes beyond logging — it enforces. A layered Organization → Team → User policy controls:

• Website blocking — matched sites redirect to a branded block page (works over HTTPS). Employees can request access from that page.
• USB / removable storage — deny access.
• Printing — monitor or block.
• Blocked apps — automatically closed.

With consent captured at install, the agent reports GPS/Wi-Fi (or IP-based) location, plotted on a live map per employee and org-wide, with route history and geofences.

Alerts surface monitoring events — DLP breaches, tamper attempts, low activity, after-hours work, access requests — in real time, in-app and by email. Notifications are personal, in-app messages (e.g. an approval decision). Alert-rule management is admin-only; managers see alerts for their own team.

Employees get a focused, self-service portal — no admin pages:

• My Overview — this week's worked/active/idle hours and pending-approval status.
• My Timesheet — their attendance calendar; request approval for idle time.
• My Requests — every request they've raised with its status and the manager's note.
• My Profile — details, password and two-factor authentication.

• Row-level multi-tenant isolation enforced on every request.
• Secrets (SMTP, storage keys) encrypted at rest with AES-256-GCM.
• Two-factor authentication (TOTP) and automatic session expiry after inactivity.
• The agent is visible, not stealth, and stores metadata — consent is captured for location.