Contents
Contents
This FAQ provides a plain-language overview of the Level AI Watchdog and Screen Recorder (v5) for Windows. It is intended to support customer IT, security, privacy, legal, and compliance reviews. It describes the endpoint software, not the complete Level AI hosted-service architecture. Customer-specific data retention, hosting, and contractual commitments are governed by the applicable order form, Data Processing Addendum, and Level AI policies.
Ready to deploy? Return to the IT Deployment Guide for Windows installation, firewall, and security policy.
The Screen Recorder captures the desktop display while recording is enabled for the user and workflow selected by your organization. Depending on the endpoint setup, this can include the content visible on one or more monitors and the on-screen cursor. The recording policy is configured by your organization through the Level AI platform.
No. The Recorder is designed to capture the display output only. It does not operate as a keylogger, browser extension, DOM scraper, or network-packet inspection tool. As with any screen recording solution, information visible on a recorded screen may be included in the recording.
Recording follows the policy configured for the customer, such as activity-based recording or recording associated with selected interactions. Signing out, disabling recording, ending an interaction, or a recording-service failure causes the recording session to stop. The application does not intentionally save a local video file for later upload.
To operate, support, and secure the service, the endpoint may collect operational information such as application version, device name and technical identifiers, operating-system information, network connectivity details, recording status, and error or diagnostic logs. This information may include device and endpoint context, such as a workstation name, IP address, or Windows account context.
On Windows, the application may collect limited security-configuration information to help diagnose deployment and recording issues. This can include firewall status, installed endpoint-protection status, relevant Windows Defender settings, application-control status, and device-management policy indicators. This information is used for support and service reliability; it is not screen content.
Diagnostic and operational logs are intended to contain technical support information, not screen recordings or screenshots. Screen video is handled through the recording service when recording is enabled. Customers should nevertheless treat operational logs as potentially containing business and device information and protect them accordingly.
Yes. The endpoint may send limited product-usage and service-health events, such as sign-in, application launch, recording state, and error events. These events help Level AI understand service reliability and adoption. They may be associated with a tenant, authorized user, or device.
The Recorder is designed to stream recordings while they are captured and does not intentionally create local video files or a local recording queue for later upload. Video data is processed in memory during an active recording session. Customers that require protection for all data handled by an endpoint should use their standard device controls, including full-disk encryption and endpoint protection.
| Directory | Purpose | Security Consideration |
|---|---|---|
C:\Program Files\Level AI WatchdogC:\Program Files\Level Screen Recorder |
Installed application, service, and supporting files. | Managed by Windows installation permissions. Customers may validate release signatures before deployment. |
C:\ProgramData\Level AI Watchdog |
Watchdog service configuration, operational logs, and update-working files. | Access is restricted to the Windows service and administrators. Watchdog service credentials are protected using Windows data-protection services. |
C:\ProgramData\Level Screen Recorder |
Service-health and heartbeat information used by the Recorder and Watchdog. | This directory supports device-management functions and should be protected using standard Windows endpoint controls. |
%APPDATA%\Level Screen Recorder |
Application settings, session information, and local application logs for the signed-in user. | Access is governed by the Windows user profile. Customers should use full-disk encryption and their standard endpoint-access policies. |
Signing out clears the Recorder's active session information and stops recording. The Watchdog may retain limited machine-management and update-recovery information so that managed deployments can be repaired or re-enrolled. Customers with device-return, offboarding, or data-deletion requirements should include the Level AI uninstall process in their endpoint-management workflow.
The endpoint uses encrypted network connections for service APIs, secure video streaming, and supported operational telemetry. It uses the operating system and supported runtime trust stores to validate server certificates. Level AI does not use a custom certificate-pinning model, which allows customers to use approved enterprise TLS-inspection and private-root-certificate configurations where supported.
The Watchdog protects its service credentials with Windows data-protection services and restricted Windows permissions. The Recorder keeps session information in the signed-in user's Windows application profile so that the user can remain signed in. Customers should protect these endpoint files with their standard Windows account controls and full-disk encryption.
This section describes the security software and libraries used by the Level Screen Recorder and Watchdog installed on Windows devices. It does not describe the separate security architecture of Level AI's cloud services or other Level AI products.
| Component | Cryptographic library or platform capability | How it is used |
|---|---|---|
| Level Screen Recorder | Electron 43.1.0 and its bundled Node.js runtime | Provides the standard HTTPS/TLS capabilities used for service communication and the cryptographically secure random-value capability used for certain local operational identifiers. |
| Level Screen Recorder | Bundled GStreamer runtime with OpenSSL 3.4.0 (libssl-3-x64.dll and libcrypto-3-x64.dll) |
Provides TLS for secure RTMPS video streaming. The Recorder supplies a certificate-authority bundle that includes public certificate authorities and, where present, approved enterprise Windows root certificates. |
| Level Screen Recorder | Windows Crypt32 certificate-store APIs | Reads trusted enterprise root certificates from the Windows certificate store so supported enterprise TLS-inspection and private-root-certificate configurations can be trusted. |
| Level Screen Recorder | jwt-decode 3.1.2 |
Reads token claims, such as expiry information, for session management. This package does not perform JWT signature verification. |
| Level AI Watchdog | Windows Data Protection API (DPAPI: CryptProtectData and CryptUnprotectData) |
Protects Watchdog service credentials stored locally. Current Watchdog credentials are protected under the LocalSystem service context; the Watchdog refuses to persist a credential in plaintext if this protection is unavailable. |
| Level AI Watchdog | Node.js https / TLS runtime |
Provides HTTPS/TLS for Watchdog communication with Level AI management services and protected update downloads. |
| Level AI Watchdog | Windows Authenticode and WinTrust APIs (WinVerifyTrust) |
Validates downloaded MSI packages before installation. Production deployments can require a valid Authenticode signature and restrict approval to configured publisher-certificate thumbprints. |
Yes. The Watchdog uses standard HTTPS/TLS connections for its management and update communications; uses Windows DPAPI to protect its locally stored service credentials; and uses Windows Authenticode/WinTrust verification before installing managed MSI packages when signature verification is enabled for the deployment. It also uses standard runtime-generated random identifiers for operational purposes. The Watchdog does not encrypt or decrypt screen-recording video itself.
No endpoint setting allows a customer to select, replace, or supply cryptographic algorithms, cipher suites, or the underlying key-management implementation. These functions are provided by the supported Windows, Electron/Node.js, GStreamer/OpenSSL, and Authenticode stacks. Customers can apply their own endpoint controls, including Windows certificate-trust policy, approved TLS-inspection roots where supported, release-signature validation, firewall and proxy policy, and full-disk encryption.
The Windows Screen Recorder and Watchdog do not implement proprietary, unpublished, or custom cryptographic algorithms or cryptographic protocols. They use the standard platform and runtime capabilities identified above. This statement is limited to these Windows endpoint components; questions about cryptography used by Level AI's hosted platform or other products should be addressed through the formal security-review process.
No broad folder exclusion is normally required. Level AI recommends validating the signed release and using narrowly scoped publisher, certificate, hash, or application-control rules that align with the customer's EDR, AppLocker, or WDAC policy. Level AI can provide deployment guidance and release-signing details on request.
The Watchdog is a Windows service used to manage installation, health checks, repair, and approved updates of the Level Screen Recorder. It runs with the permissions needed to manage the application on a corporate endpoint. Its files and service data are protected with Windows access controls.
For production deployments, update packages are digitally signed and the Watchdog verifies the package before installation according to the deployment's signing policy. Customers may validate release signatures as part of their software-distribution process. Level AI can provide signing-certificate details and deployment guidance for review.
Updates are managed through the Level AI platform. Customers that need a staged rollout, maintenance window, paused update, or version-management plan should work with their Level AI contact before deployment. Availability of these controls depends on the customer's service configuration.
The Windows endpoint uses standard application, service, installer, and screen-capture mechanisms. It is not designed to use custom kernel drivers, hidden process injection, or techniques intended to evade endpoint-security monitoring. Customers should validate behavior in their own endpoint-security environment before broad rollout.
For the Windows v5 endpoint covered by this FAQ, Level AI distributes the Level Screen Recorder Windows installer and, where endpoint management is enabled, the Level AI Watchdog Windows installer. These installers include supporting runtime components required for their operation. They are not separately installed customer SDKs or browser extensions.
| Distributed component | Purpose |
|---|---|
| Level Screen Recorder Windows MSI | Installs the Recorder desktop application, its bundled GStreamer recording runtime, bundled OpenSSL libraries, and the native LevelScreenRecorderProcessRunner.exe helper used for Windows-specific operations. |
| Level AI Watchdog Windows MSI | Installs the Watchdog service, the Watchdog executable, the WinSW service-wrapper executable, Watchdog service configuration, and a native LevelScreenRecorderProcessRunner.exe helper. |
| Recorder hosted user interface | In a standard deployment, the installed Recorder renders this Level AI-hosted web user interface within its application window over HTTPS. It is not a separately installed executable, SDK, agent, or browser extension. The installed application includes a local user-interface fallback for cases where the hosted interface is unavailable. |
| Agent Assist user-interface component, when enabled | Loaded within the Recorder from a Level AI-hosted service. It is not installed as a browser extension or a separate endpoint agent. |
This inventory is limited to the Windows v5 endpoint in this FAQ. Level AI can provide a release-specific software-component inventory for a formal review; questions about other Level AI products or downloadable components should be directed to the Level AI security contact.
No inbound firewall rule or port forwarding is normally required. The endpoint initiates outbound connections to Level AI services for authentication, recording, application management, and, where enabled, operational support and product analytics.
Deployments normally use outbound HTTPS and secure video-streaming connections, commonly over TCP port 443. The exact hostnames and ports depend on the customer environment and enabled Level AI services. Level AI should provide a customer-specific network allowlist before production rollout, especially when a proxy, TLS inspection, or restricted egress policy is in use.
The Recorder does not store customer CRM or service-account credentials for third-party integrations. It does store Level AI session information needed to authenticate the user and provide enabled Level AI features. Where Agent Assist is enabled, the application may use a Level AI authorization session to connect the user to that Level AI service.
Yes. In a standard deployment, the installed Recorder application uses a Level AI-hosted web user interface configured for that deployment. This interface is rendered securely inside the Recorder's native application window over HTTPS. If the hosted user interface cannot be reached, the installed application automatically falls back to its bundled local user interface. Loading the hosted interface does not install a separate native executable, driver, SDK, or browser extension on the customer device.
When Agent Assist is enabled, the Recorder can load the Level AI Agent Assist user-interface component from a Level AI-hosted service. This component runs within the Recorder's restricted application window and uses the Level AI session required for the feature. It is not a browser extension and does not install into the customer's browser.
If a required network connection is unavailable, the recording service cannot continue streaming and the application will stop or recover the recording session according to its health checks and the configured recording policy. The Recorder does not intentionally keep a local video queue for later upload.
Upon request, Level AI can coordinate the appropriate materials for a customer review, such as deployment guidance, a network allowlist, release-signing information, a software-component inventory, architecture information, and applicable privacy and contractual documentation. Requests for formal attestations, data-processing terms, subprocessors, data-retention commitments, vulnerability-management information, or security-test summaries should be directed to your Level AI account or security contact.
Customers should review their recording policy and employee-notice obligations, confirm the required network destinations, validate the signed installer through their normal software-distribution process, and test the endpoint in their EDR, proxy, and application-control environment. Customers should also apply their standard Windows disk-encryption, identity, endpoint-protection, and offboarding controls.