The notice for your employees

Use this page to prepare the notice your employees receive before you deploy discovery, and the facts your works council or your data protection impact assessment (DPIA) needs. Your organization decides whether, where and how to deploy discovery, and is the controller of the data it produces. OpenLatch processes that data on your behalf, under your agreement with OpenLatch.

What discovery is for

Discovery finds the AI agents installed on the machines your organization manages, so that each one is brought under the policies your organization sets for AI agents. It replaces asking each employee to install the client. It is not a tool to watch employees: it looks for agent software, not for what a person does.

Facts for the notice

Question	Answer
Who deploys it	Your administrators, through the fleet tool they already use to manage the machines
Where it runs	On the machines your fleet tool manages, in each user’s own session, as that user. It never scans with system privilege
How often	Once a day by default; your administrators set the interval
What it looks at	A fixed list of places where AI agents leave a trace: their configuration folders, their programs and install folders, and whether an agent process is running. It never searches the disk
What it does when it finds an agent	Installs the OpenLatch client for that user and enrolls it in your organization, with no action from the user
What stays on the machine	The result of the last scan, a log of changes and a log of each run, in a discovery folder in the user’s home
What it sends	Nothing, unless the client is installed. The client then sends which catalog agents were found for that user on that machine, how and when the agent was enrolled, the scan privilege and the time of the last scan
What it never reads or sends	Prompts, file contents, documents, browsing history, keystrokes, screen content, file paths and account numbers
How it shows itself	Its schedule, script and log all carry the OpenLatch name, and it shows no window. It does not hide from the user and does not resist removal
Who sees the result in OpenLatch	People of your organization with access to the OpenLatch console, according to the roles your administrators assign
How to stop it	Your administrators remove it through the fleet tool, or keep it from enrolling on a machine. Removing discovery leaves enrolled clients in place

Once the client is enrolled, it works as on any machine where it was installed by hand: for each AI agent the client supports, it records each action and decides it against your organization’s policies before it runs. An agent the client does not support yet is only listed as present, at the control level Known: none of its actions is recorded or decided. Data handling and security describes what the client records and where it is kept.

A notice you can adapt

Adapt this text to your organization, your language and the consultation your works council requires.

Our organization uses OpenLatch to apply its rules for AI agents, such as coding assistants, to the work computers it manages. To do this, our IT team deploys a discovery script that, once a day, checks whether an AI agent is installed for your account on your computer. It checks only fixed locations where these agents keep their files, and it does not read your documents, your messages, your browsing or the content of your work.

When it finds an AI agent, it installs the OpenLatch client for your account. From then on, the actions of the AI agents the client supports are checked against our rules before they run, and are recorded. An agent it does not support yet is only listed as present. The schedule, the script and the log are named OpenLatch, and you can see them on your computer.

[Name of your organization] is responsible for this processing. For questions, or to exercise your rights, contact [contact].

For your data protection impact assessment

Topic	What to record
Purpose	Applying the organization’s policies to AI agents that act on company systems
Data subjects	Employees who use a managed machine where an AI agent is installed
Data	The machine’s name and network addresses, the operating system user, the agents found, enrollment and scan times; once the client is enrolled, the records it keeps for each agent action
Minimization	The scan checks a fixed list of locations, keeps path templates rather than expanded paths, and sends nothing from a machine with no client
Transparency	The notice above; the OpenLatch name on the schedule, the script and the log
Retention	The machine’s discovery folder keeps size-capped files. What the console holds follows the retention windows of Data handling and security
Removal	Discovery is removed through the fleet tool. A removed agent keeps its history in the console
Roles	Your organization is the controller; OpenLatch processes the data on its behalf

Related pages

• Discovery explains how a scan works and what it records.
• Deploy discovery has the commands and the fleet recipes.
• Data handling and security covers what the client records.