Employee notice template

Last updated: September 20, 2026

Telling your people before you deploy Openwake is good practice everywhere and a legal requirement in many places. This template is a starting point that you can adapt and send, add to your acceptable use policy, or post on your intranet. It is not legal advice. The rules on workplace monitoring differ by country and by state, and some require more than a notice, such as consent or consultation with employee representatives. Check what applies to you before you deploy.

Replace the text in brackets, and delete the options you have not turned on.

The template

Subject: How we are managing the use of AI tools at [Company]

Team,

AI tools are now part of how we work, and we want you to use them. We also have to protect [Company]'s data, our customers' data and our credentials. From [date] we are using a service called Openwake on company-managed [computers and browsers] to help with that.

What it does

• It shows [the IT / security team] which AI tools, coding agents and related services are in use on company devices.
• In company-managed browsers, it notes visits to AI websites and other software providers, by domain only. [If you

have chosen to include all sites: It notes the websites the browser reaches, by domain only.] On AI websites it notes whether a personal or a company account is being used and what kind of data you paste, attach or submit, for example a password or API key, customer contact details or source code. A large paste, or one that contains something like a password, is noted when you paste it, even if you do not send it. For attached files it notes the name, type and size, never the contents.

• [If you have turned on warnings or blocking:] If you are about to send a credential such as a password or API key

to an AI tool, you may see a warning, or the submission may be stopped. The message will tell you why.

What it does not do

• It does not log your keystrokes or take screenshots. Nothing is read while you type.
• It does not read your email, and it does not record the content of the websites you visit.
• On AI websites, what you paste, attach or submit is checked on your own device, so that things like credentials

can be recognized. By default only a label for the kind of data is kept, not what you wrote.

[Include only if you have turned on the Evidence Vault:] When content is kept

If something you paste into or submit to an AI tool matches our data protection policy, [an excerpt / a copy] of it is kept so that we can investigate. It is encrypted, only [named roles] can view it, they must record a reason each time, and every view is logged.

Why we are doing this

To protect company and customer data, to keep credentials out of tools where they do not belong, and to meet our security and compliance obligations. It is not used to measure productivity or performance.

Who can see the information, and for how long

[The IT / security team] can see it. It is kept for [30 / 90] days, and longer only where it is part of an open security investigation.

Personal use

[State your policy. For example: Please use personal devices for personal matters. Openwake is installed only on company-managed devices and browsers.]

Questions and your rights

Our [acceptable use policy / privacy notice for staff] explains this further: [link]. If you have questions, or want to exercise your data protection rights, contact [name or team, email].

[Name] [Title]