Privacy
Rize tracks time automatically from window metadata, not from what's on your screen. No keylogging and no screen recording. The one feature that reads window content, Vision, is off by default until an admin turns it on for the organization.
Out of the box Rize tracks which app or website is active — never what's inside. Active app name, window title, URL, timestamps. No keylogging, no screen recording, and no screenshots.
The one feature that reads window content is never on by default; it runs only if an admin enables it for the organization. Members are on by default and each can turn it off for themselves; their choice persists even if Vision is later turned off and back on. Password managers, banking, health portals, messaging, and sign-in pages are never captured — and images are stored only if an admin enables Save images, which is off by default.
Your raw activity is private to you. Rize generates time entry suggestions from it, but those remain pending — hidden from your team — until you approve them. You can edit, reject, or delete anything before it's visible to anyone else.
LLMs generate time entry descriptions from the data needed for the requested inference. Identifiable customer workspace data is not used to train shared third-party models.
One click pauses tracking. A configurable schedule keeps Rize off outside work hours. Employees can also reject individual entries or delete their underlying activity data at any time.
We're completing SOC 2 Type II certification, expected late 2026. GDPR and CCPA compliant today. DPAs available for enterprise customers.
From activity capture to the time entry your team sees — here's exactly what happens at each step.
Activity captured
Rize records which app or website is active: app name, window title, URL, timestamps. Nothing inside the window is read unless your organization has enabled Vision and you have not turned it off.
Suggestion generated
An LLM (Gemini, Anthropic, or OpenAI) uses this metadata — plus your Vision data, where it is enabled — to draft a plain-language description and tags. Your data is used only for this inference — never for training.
Employee reviews
The suggestion is pending and private. Only you can see it. Edit, reject, or approve — it's entirely your call.
Entry shared (if approved)
Once you approve, the description and tags are visible to your team. The raw activity data that generated it stays private to you.
Not by default. Standard tracking never takes screenshots, records video, or captures keystrokes — it reads only metadata: the active application name, window title, URL, and timestamps. Rize also offers an optional feature called Vision, which periodically captures an image of the active window to write more accurate time entry descriptions. It is never on by default: it runs only if an admin enables it for the organization; once enabled, members are on by default and each can turn it off for themselves, and that choice persists even if Vision is later turned off and back on. When Vision processes in the cloud (the default), the image is sent to Google Vertex AI for processing; in on-device modes it stays on the device. Save images is also off by default, so Rize stores the image only if a workspace admin enables it, and a saved image is visible only to the person it came from.
Not by default. Meeting transcription is optional and requires the user to enable it, connect a supported provider such as Zoom, Google Meet, Fathom, or Fireflies, or start an audio recording through Rize. Users are responsible for obtaining any consent required to record or transcribe a meeting. Rize uses the transcript to create time-entry suggestions and deletes raw meeting audio after transcription. Transcript-derived time entries remain subject to workspace retention and user controls.
By default, metadata about your active window focus: app name, window title, URL, and timestamps. If your organization has enabled Vision and you have not turned it off, Rize also stores text read from the active window of the apps and websites selected for Vision, plus the image itself if your workspace has enabled Save images (off by default). Vision data is kept for 30 days by default; your workspace admin can set a shorter window or keep it until deleted. Vision is never collected from password managers, banking or financial sites, health portals, messaging apps, private browsing windows, or any sign-in page — those are blocked on your device and blocked again on our servers.
No. Your raw app and website activity is private to you — it is never shared at the team level. The only data your team sees is what you explicitly approve: a short description of what you worked on and any tags you've added. Rize is not an employee monitoring tool.
No — this is the most common objection we hear in pilots, and the product is designed around it. Rize drafts timesheets for each person to review privately; nothing is visible to managers until the employee approves it. There is no keystroke logging, no screen recording, and no screenshots by default. What the team gets is aggregate — hours by client and project for burn and profitability — not a feed of anyone's activity. Rize exists so people stop doing timesheets, not so managers can watch them work.
Rize uses your activity metadata to generate time entry suggestions with a description and tags. These are pending — invisible to your team — until you review and approve them. You can edit, reject, or delete any suggestion before it's shared. There is a human in the loop at every step.
Rize does not use identifiable customer workspace data to train shared third-party models. Rize may use aggregated, de-identified, or anonymized information to improve its own algorithms and models. Customer data sent to AI providers is used to provide the requested inference, not to train those providers' models.
The external systems that process your activity data are the LLM APIs used to generate descriptions (Gemini, Anthropic, and OpenAI). That means your activity metadata, plus your Vision data where Vision is enabled. If your workspace enables Save images (off by default), Vision images are also stored on Amazon Web Services. AI providers use this data for inference only, not training. Rize never sells data or shares it with analytics companies, advertisers, or other third parties.
Yes. Employees can pause tracking at any time with a single click. Rize also runs on a configurable schedule (default: 8 AM – 6 PM) so it doesn't track outside work hours. Employees can also reject individual time entry suggestions or delete the underlying activity data entirely.
Activity metadata is kept for as long as your workspace needs it to show your history and reports, and you can delete it at any time. Vision data is different: it exists only to describe what a time entry was about, so by default it is deleted automatically 30 days after capture by a job that runs nightly in every environment. Workspace admins can set a shorter window or choose Always keep. If you belong to more than one workspace, Always keep in any of them keeps your Vision data; otherwise the shortest window among them applies. You can clear yours sooner from the app, and deleting your account removes it immediately. Captured images are stored only if your workspace enables Save images, which is off by default, and they are deleted along with the rest of the Vision data.
Yes. In Settings, then Privacy, scheduled data redaction lets you retain only the previous week, two weeks, or month of app and website data. A nightly job permanently deletes everything older than that window — the deletion cannot be undone. Your time entries, labels, projects, and clients are not affected; only the underlying activity record is removed. A one-off Redact Tracked Data button is also available and clears everything tracked to date within about an hour, for a clean start or before a compliance review.
Yes, and you control how far it goes. Left at its defaults, Rize reads only metadata — app name, window title, URL, timestamps — so no document contents, financial records, or health information enter our system. If you want richer time entry descriptions, Vision can be limited to specific apps and each member can turn it off, and even then password managers, banking and financial sites, health portals, messaging apps, and sign-in pages are never captured. Firms handling regulated data commonly leave Vision off entirely; nothing else in Rize depends on it.
Rize offers controls an admin can enforce for everyone (or an individual can set for themselves): Do Not Track URLs disables all URL tracking so only app names are recorded; URL Host Only records just the domain (e.g. "google.com") and never the full path; and Strip Window Titles removes window title text so only the app name is kept. Enabling Strip Window Titles together with Do Not Track URLs reduces tracking to app names and timestamps only. Vision is governed separately: it is never on by default and runs only if an admin enables it for the organization. Members are on by default and each can turn it off for themselves; their choice persists even if Vision is later turned off and back on. Revoking the org-level grant stops capture for everyone.
Yes. In Settings, then App & Website Rules, set any app or website's category to Exclude From Tracking. The desktop app recognizes that window and drops it before anything is sent to Rize — no app name, title, or URL is ever recorded for it. That time shows up as a gap on your timeline rather than a hidden or mislabeled entry.
No. Rize runs as a visible desktop application with a menu bar icon (macOS) or system tray icon (Windows). There is no silent mode, hidden mode, or stealth install. The app is always visible, and users can open it at any time to see exactly what is being tracked on their live activity timeline.
Rize uses the operating system's idle detector — the same system-level signal a screensaver uses — not heuristics, AI, or behavioral analysis. If no keyboard or mouse input is detected for 5 minutes, the user is marked idle and tracking pauses; after 60 minutes of inactivity the session is treated as ended. Tracking resumes automatically when input returns. No input content is read — only whether input occurred.
Rize is currently undergoing SOC 2 Type II certification, expected to complete in late 2026. In the meantime, we can provide our current engagement letter from the certification agency on request.
Yes. Rize is GDPR and CCPA compliant. Employees can export or delete their data at any time. We offer a Data Processing Agreement (DPA) for enterprise customers. Contact us for details.
We're happy to answer anything your IT or legal team needs — DPAs, SOC 2 engagement letters, or a technical walkthrough.