Security & IT reference

Everything an application-control, endpoint-protection or firewall policy needs, on one page. It is written to be forwarded to whoever manages your endpoints without you having to edit it.

This describes the 20-20-20 Vision for Workplaces edition, which is the one deployed across company-owned machines. The Free and Pro editions differ and are not covered here.

What it is

A desktop reminder that prompts people to look away from their screen periodically, for eye strain. It is a tray application. It does not capture the screen, read documents, record input, or watch what anybody is doing.

The application id, the install path and the file names below still read Teams. That was this tier's previous name; the product is now 20-20-20 Vision for Workplaces, but the strings the build itself uses have not changed yet, and an allowlist rule has to match what is on disk rather than what the product is called. When a release changes them, this page changes with it.

Executables to allow

A small unfamiliar executable launched by a larger one is the kind of thing application control is built to stop, so it is worth setting out what this one does.

It is a precompiled, self-contained executable. It runs no scripts and loads nothing at run time, which is what lets it work under Constrained Language Mode where script-based tools do not. The application launches it at startup, it runs for the life of the session, and it talks to its parent over standard output.

It makes no network connections at all, opens no files, and writes nothing. It reads two things and only two: the per-application camera and microphone consent keys under HKCU, and the media session state Windows already exposes for whatever is playing. That is how "someone is on a call" is answered without touching a camera, a microphone or a file.

Network

One outbound destination. Nothing else.

No other host is contacted by the Workplaces build. There is no telemetry endpoint, no crash reporter, no analytics, no update server and no content delivery network at run time.

The table above is the application. If you take the optional route of syncing one security group, a scheduled task of yours reaches the same host on the same port, from a server you choose rather than from any desktop. Details under what is sent.

What is sent

On a licence check: an identifier for the signed-in account, the machine name, and the application version. That is the whole request. The identifier is the account's user principal name where the machine has one, and DOMAIN\user where it does not - taken from whoami, not from any directory lookup of ours.

The account identifier can be replaced with an unreadable digest by policy, if you would rather we did not hold readable account names - at the cost of making licences harder for your own administrators to manage.

Optional: syncing one security group. If you would rather not maintain the list of people by hand, you can schedule a script we generate on a server of yours that can read one security group you nominate. It posts that group's members to the same host over 443. Three things worth stating plainly, because they are what a review usually asks:

• Outbound only. Nothing is opened towards you, and no credential of yours reaches us. It is your scheduled task, on your server, under an account you choose.
• One group, never your directory. The script reads the group you name in it and is incapable of reading anything else. A company with 200 staff and 50 licences nominates a group of about 50, and that is all we ever hold. With manager sync on, it also looks up the one account each member's manager attribute points to, and reads only those two identifiers from it.
• Its own credential. The script carries a key separate from your organisation key, because your organisation key is deployed to every desktop and is readable there. Rotating the sync key touches no machine in your estate.
• Four attributes per person, and one more only if you ask for it. Display name, user principal name, DOMAIN\user and the account SID. If you turn on manager sync, the script also reads each member's manager attribute and, to match that manager to somebody on your list, the manager's user principal name and SID. Nothing about group memberships beyond the one you nominated, no department, telephone number, job title or mail attributes, and nothing whatever to do with credentials. It is a plain text file, so whoever runs it can read exactly what it collects before they schedule it.

It is optional. Pasting a list into the dashboard needs nothing from your directory at all, and is a perfectly good answer for a list that does not change often.

If adherence reporting is enabled, which is off unless you switch it on in two separate places: how many break reminders a machine showed in a week, how many were taken and how many were skipped. Three numbers and the week they belong to.

Nothing else goes with them: no licence identifier, no account, no machine name, no installation identifier, no timezone and no locale. We do not log the network address they arrive from. Submissions are added into a total on arrival rather than stored individually, so no per-person breakdown can be produced from them - by us or by anyone else.

What never leaves the machine, in any configuration: rest history, statistics, settings, and anything about which applications are in use. Camera and microphone detection is a yes/no answered locally; no audio or video is captured, accessed or transmitted.

Workstation checks (if your organisation uses them)

Workstation checks run in the browser, not on the desktop. Nothing about them is installed, and the application above is the same whether you use them or not. What they do for health and safety and HR is on the workstation checks page.

• If your mail gateway pre-opens or rewrites links (Safe Links, Mimecast, Proofpoint and similar), nothing breaks. Opening a link changes nothing; it is used only when the person presses Send. Links are stored only as a one-way hash and expire after 30 days.
• If you filter by sender, allow no-reply@20-20-20-vision.com.
• If you give us a logo, the check pages load it from the address you give, without sending a referrer.
• What is recorded, who sees it and for how long is in our data processing agreement. In short: answers are choices from a list, health information is limited to yes or no plus body areas and eye-test dates, nothing is ever linked to break data, and every opening of a person's record is logged.

Files and registry

The application reads its policy at launch and never writes to that HKLM key. That is deliberate: it is what makes a locked setting a lock, since the application runs unelevated and could not modify it even if it tried.

Application control

Both executables need permitting under AppLocker, WDAC, ThreatLocker, Airlock, Carbon Black or equivalent. Publisher-based rules are the ones to prefer: a hash-based rule has to be reissued at every release and generates a fresh block and a fresh approval request each time.

A default-deny product will block this application on first run, as it would any application it has not seen before. There is nothing specific to us in that, and nothing we can do from our side inside your tenant.

Our setup script is a separate question. For organisations with neither Group Policy nor Intune, the dashboard generates a small script that writes the configuration and calls msiexec. Application control commonly blocks script interpreters and what they launch, so if you run ThreatLocker or similar, deploy through your existing tooling instead. The MSI and the ADMX template are all you need; the script is a convenience for organisations with no tooling, not the intended route for one that has it. Both routes are set out step by step in the deployment guide.

Questions we are asked

Does it monitor employees? No. Nothing records how anybody works: rest statistics stay on the machine and are visible only to the person using it, and adherence figures, where enabled, carry no identifier and are added into a total on arrival, so no per-person figure exists to be produced. If your organisation uses workstation checks, those are named records, because the law requires you to keep them: whether each person's workstation was assessed, what was fixed, what training they completed and whether an eye test was offered. They are compliance records, not monitoring, and they are never joined to break data.

Does it need administrator rights? To install, yes, as any per-machine MSI does. To run, never.

Does it check for updates, or phone home for configuration? No. The consumer builds fetch a small configuration document at startup; the Workplaces build skips that call entirely, which is why the network table above has one row rather than two. It never downloads anything and never updates itself - your existing tooling deploys the MSI, on your schedule. The application version is sent on the licence check, and the only thing it is used for is telling your administrators, by email, that some of their machines are behind a release you have not deployed yet.

Does it need Active Directory or Entra ID? In practice, yes. A licence belongs to a person rather than a machine, and matching a person across their laptop and their desk PC needs a directory-backed account: the SID, user principal name or DOMAIN\user the machine reports. An estate of standalone machines with local accounts has nothing stable to match on, and Workplaces is not the right product for it.

Do users need an account with us? No. Users don't sign up, set a password or enrol in anything. A licence is picked up from the Windows account somebody is already signed in to.

Can the user uninstall it? The application can be closed by the user unless your policy says otherwise. Uninstalling requires administrator rights.

What happens offline? It keeps working for up to 14 days from its last successful licence check, or until your licence expiry if that comes first, then stops reminding. A machine that is on a network at all renews that window daily, so it only applies to one genuinely away.

Is there a data processing agreement? Yes. Your organisation is the data controller and 20-20-20 VISION LTD is your processor. Ask and we will send it. If you use workstation checks, we also give you our DPIA and a staff privacy notice template.

Ask us something specific

Technical and security questions go to dev@20-20-20-vision.com and reach the people who write the code.

If your estate enforces application control or egress filtering, tell us how it is managed and we will make sure you get a build that fits it.