Security and privacy overview for IT
Sopycat is a Windows app. It records a task on the PC and writes the manual on the PC. There is no Sopycat server that holds customer data.
At a glance
- Where the data is
- In a folder the office chooses (Documents\Sopycat by default), as ordinary files. A network drive or a synced folder works for a shared library.
- What we can see
- Nothing. We never receive recordings, manuals or documents, and keep no copy of them.
- Accounts
- None. There is no sign-in and no cloud workspace.
- AI
- No AI writes the manuals, and nothing is sent to an AI service. Steps are named from what Windows reports about each click.
- Install
- Per user, with no administrator rights. For a silent install, run the installer with /S.
- Offline
- Everything works offline. A paid key needs to reach the store once every 14 days.
Every network connection the app makes
| What | Where to | When | What is sent |
|---|---|---|---|
| Key check | api.lemonsqueezy.com (Lemon Squeezy, our store) | When a key is entered, then every 3 days. Never during the trial. | The key and an anonymous ID for the PC, such as "Sopycat PC 7F3A21". Never the computer's name, the Windows user name or any document. |
| Update check | github.com and its download servers | Shortly after each start and every 4 hours. Off in Settings › App Updates, and always off in regulated-office mode. | A request for the latest version number, then the update itself if one is downloaded. |
| Speech to text (optional) | github.com, huggingface.co | Only when someone presses Download in Settings › Speech to Text. | A request for the program and the speech model. Speech is turned into text on the PC. |
| Office pack (optional) | download.documentfoundation.org | Only when someone presses Download in Settings › Office File Conversion. | A request for LibreOffice, used on the PC to convert Office files to PDF, open older Word, Excel and PowerPoint formats, and draw slides as designed. |
| Problem report | Email, sent by the person | Only when someone saves a report and emails it to us. | A text file they can read first: the versions, the settings (with the library's path left out) and the end of the log. |
Nothing else. The app has no telemetry, no analytics, no automatic crash reports and no AI service. A link in a manual opens only when someone clicks it.
The key check, offline
If the PC cannot reach the store, a paid key keeps working for 14 days after the last successful check. After that Sopycat is read-only until it can check again: everything still opens and nothing is deleted. The key is stored encrypted with Windows' own protection (DPAPI).
What a recording keeps
A video of the chosen screen, the clicks, what was typed, and your voice if voice is on. Passwords, card and account numbers, email addresses and anything typed into a field for private details are never kept, and those pictures are blurred. Typing can be left out entirely. Each step also keeps its original picture so a blur can be redone. The recording bar never appears in the recording.
Controls for the office
Regulated-office mode (Office plan) turns off saving manuals as web pages and automatic updates, and writes every view, edit, export, backup, redaction, signature and record to an audit log in the library folder, which saves as CSV. Pictures can be blurred automatically for emails and phone, card and social-security numbers.
Certifications
Sopycat has no SOC 2 report. SOC 2 audits a provider's systems that store customer data, and Sopycat has none: the review that applies is of the installed app, and this page lists everything it does on the network. We do not sign HIPAA business associate agreements. Sopycat never receives your recordings or documents.
Questions from IT are welcome at [email protected]. The full details are on Privacy and security and in the privacy policy.