Reference
What the agent does on the endpoint
What runs, what it talks to, and how often — so you can get the agent through a client's change control and egress filtering without guessing.
Outbound allowlist
The agent makes outbound HTTPS connections to exactly two hosts. It never accepts an inbound connection, so no firewall rule is needed in that direction.
| Host | Port | Purpose |
|---|---|---|
api.snitchos.com | TCP 443 | Enrollment, activity and screenshot upload, configuration |
cdn.snitchos.com | TCP 443 | Update manifest and signed installer downloads |
Both are plain HTTPS, so an inspecting proxy works provided it does not strip the certificate chain the agent uses to verify updates. If the client blocks by category rather than host, allow both by name — the IPs are not stable.
api.snitchos.com does not make the agent fail quietly — the device stops reporting and shows as offline on the tenant overview.What runs
SnitchOSAgent— a Windows service running as LocalSystem. Visible in Task Manager and inservices.msc; a local administrator can stop or uninstall it.- A per-session helper — the service cannot see a user's desktop from session 0, so it launches one helper process inside each interactive session. That is what captures screenshots and window activity.
How often it samples
| Activity sampling | Every 10 seconds |
|---|---|
| Screenshots | Every 60 seconds when enabled; visually-identical frames are discarded rather than uploaded |
| Upload | Batched every 60 seconds |
Events are buffered locally when the network is unavailable and sent when it returns, so a laptop offline for a meeting does not lose its day.
What it does not send
Input is counted, never captured — keystroke, mouse-click and mouse-distance totals only. Browser URLs are reduced to scheme, host and path; query strings and fragments are stripped before anything leaves the machine, because they routinely carry SSO tokens. See data handling for the full boundary.
Verify the binary before you deploy
The installer and service are code-signed. Confirm the publisher yourself rather than taking our word for it — the expected subject is CN=Shield Management Inc. The command and expected output are on the security page.
Uninstall
Removal is deliberately possible for a local administrator, because MSPs need it for support. The uninstall and repair commands live in deploying with your RMM so there is one copy to keep correct.