> ## Documentation Index > Fetch the complete documentation index at: https://docs.sightlinebehavior.com/llms.txt > Use this file to discover all available pages before exploring further. # For district IT > Code signing, installation without admin rights, updates, network hostnames, Bluetooth, and data locations for a district security review. Student records stay on the computer Sightline runs on; Sightline has no server that receives them. [How Sightline handles student data](https://docs.sightlinebehavior.com/student-data.md) is the plain-language version of this page. ## Code signing | Platform | Signature | Publisher shown | | - | - | - | | Mac | Developer ID, notarized by Apple, hardened runtime | Developer ID Application: Christopher Ives (SJQ7XBC6W5) | | Windows | Authenticode through Azure Artifact Signing | Christopher Ives | Christopher Ives is the name on the signing certificates. Windows lists the installed app's publisher as Ethoseen LLC, the company that sells Sightline. Bundle identifier: `com.sightline.app`. To check a Mac copy, run `codesign -dv --verbose=4 /Applications/Sightline.app` and look for `TeamIdentifier=SJQ7XBC6W5`. On Windows, run `Get-AuthenticodeSignature` on the installer and expect `Status: Valid`. The Windows certificate is replaced daily and each one is valid for three days, so don't trust it by thumbprint. Every certificate carries the same Artifact Signing identity EKU, `1.3.6.1.4.1.311.97.93852484.924677978.522928787.809106358`. Microsoft Defender SmartScreen can still warn about a new installer; see [Install on Windows](https://docs.sightlinebehavior.com/windows.md). ## Installing without admin rights On Windows, `Sightline__x64-setup.exe` installs for the current user only, in `%LOCALAPPDATA%\Sightline`, and never asks for administrator rights. There is no MSI or machine-wide installer. If the WebView2 Runtime is missing, the installer downloads it from Microsoft; on restricted networks, preinstall the Evergreen WebView2 Runtime. * Deploy with Intune or Configuration Manager in user context, not system context. * AppLocker's default rules block programs in the user profile. Add a publisher rule for Christopher Ives. * With App Control for Business, use a signer rule that pins the EKU above together with the publisher name. A rule on the name alone would also trust any other Artifact Signing customer validated under that name. Bundled libraries signed by others also need allowing: `vulkan-1.dll` (LunarG) and the Visual C++ runtime DLLs (Microsoft). On a Mac, Sightline ships as a disk image. Install it to `/Applications` by MDM or by dragging, or to `~/Applications`, which needs no administrator password. ### District-managed Macs A standard account can't update an app in `/Applications`, so Sightline opened from there asks "Copy Sightline to get updates?". Copy and open copies it to the user's `~/Applications`, which updates itself. The original stays, and opening it later opens the user's copy. Inventory tools such as Jamf report the `/Applications` version, which may be older than the one the user runs. An older Sightline won't open data a newer version has already opened. Details for users: [Install on Mac](https://docs.sightlinebehavior.com/mac.md). ## Updates Sightline checks `updates.sightlinebehavior.com` when it starts and every six hours while it is open. It downloads an update in the background and installs it the next time the user quits Sightline, or sooner if they choose Restart now. It installs only updates signed with Sightline's updater key. On Windows, updates install per user, like the original install. There is no setting to turn update checks off. If you block the update host, Sightline keeps working, and after several days of failed checks it shows a banner saying it couldn't check for updates. ## Network connections Sightline works offline. These are the only hosts it contacts. None of them receives student records. | Host | Purpose | When | | - | - | - | | `api.keygen.sh` | License activation and validation | At activation and periodically | | `heartbeat.sightlinebehavior.com` | License check with a count of the AI model's completed generations, no text | At launch, at activation, and while AI is used | | `license.sightlinebehavior.com` | Pro trial start, checks, and extension; update access on Community | When a trial starts, at launch and periodically during a trial, after the welcome survey, before an AI model download during a trial, and at launch on Community until update access is granted | | `updates.sightlinebehavior.com` | Update checks and downloads | At launch and every six hours | | `models.sightlinebehavior.com`, `huggingface.co`, `*.hf.co` | AI and transcription model downloads | When the user sets up AI or transcription. On Pro or a Pro trial, Sightline also downloads missing AI files in the background at launch and after activation | | `billing.sightlinebehavior.com` | Gets a link to the subscription page by sending the license key and a device identifier. The browser then opens Stripe (`billing.stripe.com`) | When the user selects Manage subscription or a Starter upgrade | | `feedback.sightlinebehavior.com` | Feedback, with diagnostics if the user includes them | When the user sends feedback | | `tally.so`, `api.tally.so` | Optional welcome survey, an embedded Tally form | During a trial, if the user opens it | | `us.i.posthog.com` | Usage analytics | Only if the user turns it on | | `*.ingest.us.sentry.io` | Crash reports | Only if the user turns them on | The last four rows are optional or user-initiated and can be blocked without affecting recording. On Windows, Sightline sends its requests through the proxy Windows is set to use, including a PAC file or automatic detection. ## Where files are stored | | Mac | Windows | | - | - | - | | App | `/Applications` or `~/Applications` | `%LOCALAPPDATA%\Sightline` | | Data | `~/Library/Application Support/com.sightline.app/` | `%LOCALAPPDATA%\com.sightline.app\` | | Logs | `~/Library/Logs/com.sightline.app/` | `%LOCALAPPDATA%\com.sightline.app\logs\` | The data folder holds the encrypted database, automatic backups, downloaded models, and license files. If Companion is used, it also receives observations returned from the iPhone and deletes each one once it is saved. One that can't be imported yet stays there, encrypted with its voice-note audio, under Needs attention until it is imported or discarded. On Windows it is local, not roaming. Sightline keeps three secrets in the operating system's credential store: the database encryption key, the license key, and, once a phone is paired, the Companion pairing key. On a Mac they are Keychain items named `com.sightline.app` and `Sightline Companion`. On Windows they are generic credentials named `database-key.com.sightline.app`, `license-key.com.sightline.app`, and `pairing-v2.Sightline Companion`. A data folder can't be opened without its database key, so a keychain reset loses the records unless the user has a passphrase backup. The Windows uninstaller can delete the data folder but not these credentials; see [Install on Windows](https://docs.sightlinebehavior.com/windows.md). ## Bluetooth for Companion Companion, the iPhone app, connects to the computer over Bluetooth Low Energy, with no network involved. The link is encrypted, and messages are authenticated with a key exchanged at pairing. Companion makes no internet requests. An observation recorded away from the computer stays on the iPhone, in storage left out of device backups, until the computer confirms it has saved it. ## Diagnostics in feedback Send feedback attaches diagnostics only if the user selects Include diagnostics. They contain app and system information, license tier and status, AI and model state, database counts and size, selected settings, and filtered logs. They leave out student names, notes, observations, license keys, and the text of log messages. Log files themselves can contain student names and notes, so support asks for Send feedback with Include diagnostics instead of the log files. To report a security issue, email [support@sightlinebehavior.com](mailto:support@sightlinebehavior.com) with the subject "\[SECURITY] Private vulnerability report". Leave exploit details and student records out of the first email; we will arrange a secure channel. ## Related * [How Sightline handles student data](https://docs.sightlinebehavior.com/student-data.md) * [Install on Mac](https://docs.sightlinebehavior.com/mac.md) * [Install on Windows](https://docs.sightlinebehavior.com/windows.md) * [Contact support](https://docs.sightlinebehavior.com/contact-support.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.