Proving consent without recording the screen
Last updated 21 September 2026
An IT company that touches a customer's computer has to be able to show, afterwards, that it was allowed to. The usual way to show it is to record the session, which means keeping a video of somebody else's screen. This page is how the same thing is proved here without keeping the picture, and what that record does and does not cover.
1. Who decides whether a screen is shared
The program on the customer's own computer decides, and it decides again every session. Our server passes the question along and writes down the answer. There is no instruction we can send that turns sharing on, and no support request we could be talked into that would do it either.
This is the difference worth checking in any product in this category, including ours. If consent is a setting on a server, then the honest description of it is that somebody with access to that server can turn it off, and the list of people with that access includes the vendor. If it is enforced by the software on the machine being looked at, there is nothing to turn off from anywhere else.
2. Does letting a technician look also let them take control
No. Looking and controlling are two permissions, granted separately and recorded separately, and a request for control before looking has been allowed is refused outright. The customer can grant both on the one prompt, or looking alone and control later, and the record tells the two apart either way.
It matters for the record as much as for the session. A log that cannot tell the two apart can only say that somebody connected, which leaves the most common real question, did anyone type on this machine, unanswerable after the fact.
3. What the record proves
Who asked, who allowed, whether control was granted and when the session ended, written as they happen and attributed to a named person. Nobody using the product can change or remove any of it, including the organisation that owns the account, and including us through the product.
Accounts belong to named people and an address is confirmed before one can sign in, which is what makes a record of who did what mean anything. A log naming a shared login proves that the login was used.
4. Is there a video of the session
No. Sessions are not recorded, and screen contents are never stored anywhere, by anyone. Screen images and the input sent back travel directly between the technician's browser and the customer's computer, encrypted end to end, and where a direct connection cannot be made the traffic is relayed by us as ciphertext we hold no key for.
A recording is evidence and it is also a copy. An IT company that records its sessions in a dental practice is holding pictures of patient records in order to prove it was allowed to look at them, and it now has to keep those pictures safe, decide how long to keep them, answer for them if they leak, and hand them over if anyone asks.
The permission and the contents are separable, and only one of them is the evidence. This product keeps the first and never has the second.
5. Can the customer see the session and stop it
Yes, for the whole of it. A banner names the technician and the company they work for, cannot be dismissed, minimised or hidden behind another window, and Stop ends the session from their side at once.
6. What is left on the machine afterwards
Nothing, after a one off session. The tool the customer runs removes itself when the session ends, so nothing stays running or listening on a machine that was only visited.
A device the organisation has enrolled for unattended access is the deliberate exception, and a visible one: it was enrolled on purpose, it is listed in the console, and what a technician may do with it is fixed by the organisation's policy.
7. Is this enough to satisfy the GDPR or the Swiss FADP
It is evidence, not a lawful basis. The record is designed to be the evidence you need, but having the permission of the person responsible for a computer before you connect to it remains your obligation, not ours.
On the roles: when you use LiveDesk to support your customers you are the controller of the personal data in those conversations and sessions, and Maxapp GmbH is your processor. Conversations, session records and account data live in Postgres in Zurich. The compliance page sets out the rest, including sub-processors and the data processing agreement.
8. What can you not evidence
We hold no SOC 2 report, no ISO 27001 certificate, no independent audit and no third party penetration test. If your procurement process requires one of those today, we are not yet a supplier you can use.
It is written here rather than discovered in the fourth week of a questionnaire. When any of it changes, the security page will say so with the date it changed.
Where the detail is
Nothing above is new. How a session is encrypted and what the server holds is on the security page, the legal side is on the compliance page, and the eight questions worth asking any vendor in this category, us included, are on how to compare.