Deploying employee device monitoring legally requires three things: a clear policy, employee consent, and proper scoping of what is monitored. Here's how to build a compliant monitoring deployment with XeraX.
Why Transparency Matters
In most jurisdictions — including the EU (GDPR), US federal and state law, and UK (RIPA) — monitoring employees' devices without their knowledge is illegal. The safest and most defensible approach is written consent combined with a clear acceptable-use policy (AUP).
Build a Written AUP
Your acceptable-use policy should state: (1) company-issued devices are subject to monitoring; (2) the types of data collected (location, app usage, communications on company accounts); (3) the purpose (compliance, security, productivity); (4) the retention period; (5) employee rights to request a copy of their data.
BYOD vs Company-Owned Devices
For BYOD (bring your own device) programs, the legal bar is higher. You should monitor only company accounts and apps — not personal calls, personal email, or personal browsing. Restrict XeraX to company-owned device identifiers and document the scope clearly in your policy.
Data Minimization
Only collect what you need. If your goal is location tracking for a fleet, disable SMS and call log features. XeraX lets you enable or disable each feature independently via the Telegram bot or the admin portal.
Doze and Battery Optimization Exemption
XeraX exempts itself from Doze mode using Android's power management API, ensuring heartbeats and command polling continue even when the screen is off and the device is stationary.
Sample Consent Language
"I acknowledge that this company-issued device is subject to monitoring including GPS location, app usage, SMS messages on the company SIM, and remote management capabilities. I consent to this monitoring as a condition of device use."
Data Minimization
Only collect what you need. If your goal is location tracking for a fleet, disable SMS and call log features. XeraX lets you enable or disable each feature independently via the Telegram bot or the admin portal.
Inform Without Revealing Details
You are not required to reveal the specific software in use — only that monitoring is in place. Many companies include monitoring disclosure in their employment contracts and device policies without naming the vendor.