Electronic Monitoring Policy Template

Draft for legal review, 12 October 2026. This is a template for a firm that uses SourceSecure to adapt and give to its staff. It is the template the Acceptable Use Policy refers to. It is not legal advice: have your own adviser read your version before you rely on it.

Why this exists

SourceSecure shows a firm's admins a record of what it caught on each person's browser and when a person paused it. That is a form of electronic monitoring, and staff should be told about it in writing before it starts.

In Ontario it is also the law for larger employers. Under the Employment Standards Act, 2000, an employer with 25 or more employees in Ontario on January 1 of a year must have a written policy on electronic monitoring in place by March 1 of that year. The policy must say whether the employer electronically monitors employees and, if it does, how and in what circumstances, and the purposes for which the information may be used; it must carry the date it was prepared and the date of any change; a copy must be given to employees within 30 days of it being prepared or changed, and to a new employee within 30 days of starting; and a copy must be kept for three years after it stops being in effect.

Other provinces have their own rules. Quebec's private-sector privacy law asks that a person be told before technology is used that can identify or profile them. If your firm has staff outside Ontario, ask your adviser what applies.

The sections below describe what SourceSecure does, as of the date at the top, and are written from how the product works. If your firm monitors staff in other ways (email, building access, devices), those belong in the same policy; this template covers SourceSecure only. Replace everything in square brackets.

The template

[Firm name]: Electronic monitoring policy, SourceSecure

Prepared on: [date] · Last changed on: [date]

1. Does the firm electronically monitor employees?

Yes, in the one way this policy describes. [Firm name] uses SourceSecure, a browser extension, on the work computers and browsers of the people named on the firm's SourceSecure team. [If the firm monitors in other ways, say so here and refer to the policy that covers them.]

2. What SourceSecure does on your computer

SourceSecure runs only on the AI chat sites it supports: ChatGPT, Claude, Microsoft Copilot, Google Gemini, Perplexity, Grok, DeepSeek, Meta AI, Mistral and NotebookLM. On those sites it reads what you are about to send, and the files you attach, on your own computer, looks for client details and other sensitive information, and offers to send a version with them replaced. You choose what is sent.

It does not read any other website, your browsing history, your email, your files or your screen, and it does not record keystrokes. [On a Guard Enterprise seat: it reads one other web page only when you pick a capture item from its right-click menu, to save that page to your own Living Vault.]

3. What is recorded about you, and what the firm's admins can see

The following is sent from your browser to SourceSecure's servers, and can be seen by the firm's SourceSecure admins [and team heads] on the firm's team page:

• That you have a seat: your work email address, the kind of seat you have, and whether you are an admin.
• Whether SourceSecure is connected: whether you have signed in to the extension, how many browsers you have connected, and when one of them last checked in. If none has checked in for several working days, or you have switched SourceSecure off, the admins are shown that.
• Each detail SourceSecure caught: when, on which AI site, what kind of detail it was (for example an account number or a client's name), whether it was in a message or an attached file, and what you chose to do (sent it redacted, sent it as typed, or marked it not sensitive). The detail itself is masked on your computer before it is sent, so the record shows only the last few digits of a number or the first letter of each word of a name, for example •••• 4242 or R••• C•••.
• When you paused SourceSecure or switched it off, and for how long.
• Daily counts: how many details were caught and of which kinds, how many messages were held for review, how many attached files were checked, and how often you used each feature. [On Guard Pro seats and above: how often prompt coaching was offered and used, how your prompts scored, and which habit, from a fixed list, you chose to work on. On Guard 360 seats and above: how many AI replies were checked and how many marks you opened, asked about or dismissed.] These are numbers only.
• A request you make: if you ask your admin for a better seat from inside the extension, your admin sees that you asked. You are told so before you ask.

The admins can see these for the whole firm or for one person.

4. What is never recorded or shown to the firm

• The text of your messages, the files you attach, and the AI's replies. They are checked on your computer. [On Guard Pro seats and above, with the optional AI features on, a copy with the names and numbers SourceSecure found replaced by stand-ins is sent to SourceSecure and its AI provider to write coaching and reply marks. It is not stored by SourceSecure and is never shown to the firm.]
• The full form of any detail that was caught.
• Anything you do on any other website.
• [On Guard Pro seats and above: your weekly coaching note, which is written for you alone and kept on your computer.]
• [On Guard 360 seats and above: the facts in your vault. If you choose to suggest one for the firm's profile, your admin sees the suggestion and how many people made it, never who.]
• [On Guard Enterprise seats: your Living Vault, which is encrypted on your computer. The firm cannot see what is in it or whether you use it.]

5. In what circumstances

SourceSecure works whenever you use one of the AI chat sites above in a browser where you have signed in to it, during and outside working hours. It does nothing on any other site. You can pause it for a set time or switch it off; the firm's admins can see that you did, and for how long. [Say whether pausing or switching off is permitted, and when.]

6. What the firm uses the information for

[Firm name] uses the information in section 3 to:

• keep client information out of AI tools, and confirm that the tool doing so is installed and switched on;
• understand where client details come up when staff use AI tools, so that training and guidance can be improved;
• show its regulators, auditors and clients that it has taken reasonable steps to protect client information.

[Say plainly whether the information may also be used in assessing performance or in discipline, and if so how. If it will not be, say so: "The firm will not use this information to assess performance or for discipline, other than where a person deliberately and repeatedly sends client information the tool warned them about." Delete or rewrite as the firm decides.]

7. Who can see it

The firm's SourceSecure admins: [names or roles]. Nobody else at the firm has access. SourceSecure (JOLIVE Labs Inc.) holds the records on the firm's behalf, in Canada, under a data processing agreement, and its staff access them only to run and support the service.

8. How long it is kept

The record of each detail caught is deleted 90 days after it is received. The record of each pause is deleted 90 days after the pause began. Daily counts are kept while the firm uses SourceSecure. If you leave the team, your catches and pauses are deleted at once and the counts stop being linked to you. If the firm stops using SourceSecure, everything is deleted within 30 days.

9. Your questions and your rights

Ask [name and contact of the person responsible] about this policy or about the information the firm holds about you. You can ask to see it and to have it corrected. SourceSecure's own privacy policy is at sourcesecure.ca/privacy.

10. Changes

If the firm changes this policy, it will give you the changed policy within 30 days of the change.

Notes for whoever adapts this

• Keep only the bracketed sentences that match the seats your firm has bought. The pricing page says what each seat includes, and sourcesecure.ca/privacy describes each feature in full.
• The purposes in section 6 are the employer's to state. The law asks you to say what the information may be used for; it does not decide that for you.
• Give the policy to everybody on the team before you invite them, and keep a note of when you did.
• If SourceSecure changes what it records or what admins can see, we email every firm's admins beforehand and update this template. Check your policy against it when that happens.