Example reports

What Barry produces after a few weeks on a team: a workforce intelligence report built from a real deployment, with people reduced to ids and every group figure covering three or more of them. New versions appear here as they are published; the latest is first.

Videos

Short walkthroughs of installing and connecting Barry, for the people doing it. They play here; nothing is downloaded unless you choose to.

How Barry works

Barry Monitor is a lightweight background agent that observes work activity so your organization can understand how time is spent and surface opportunities to improve. It runs silently as a background process with no everyday window, menu-bar icon, or tray icon. Everything you see and configure lives in your organization's web portal at getbarry.ai.

Barry Monitor is deliberately invisible: the installer creates no shortcuts and the monitor has no everyday UI. Once configured it starts at login and records in the background. On first run it also installs the Barry Monitor browser extension so web activity can be captured.

Privacy by design, not surveillance

What the Monitor never does

• It does not take screenshots or record screen video.
• Password and secure-input controls are excluded from text capture.
• Excluded categories (for example Banking, Health, Adult), specific domains (such as password managers) and apps (such as Signal or 1Password) are completely ignored.
• Activity outside working hours can be dropped before it is recorded.

What your organization controls

Privacy controls are set by your organization and pushed to every device automatically — when an admin changes the policy, every Barry Monitor picks it up immediately over its hub connection. Controls include reducing URL paths to the host, dropping off-hours activity, disabling browser-history backfill, and personal-data pattern filtering for Custom Capture.

Every member can review the exact policy that applies to them on the portal's Privacy page. It is read-only there because it is set by the organization, not by the individual.

What is recorded, honestly

Text can be captured. Ordinary interaction events can include text from supported collectors, and Custom Capture rules (Appendix D) can save visible element text and values. Window titles are recorded as captured. On macOS, supported Messages capture can include visible messages and composer text — those captured-chat records carry a separate restriction: ordinary members and organization administrators cannot read them in the portal; only verified platform administrators can.

Who sees whose data

By default, members only see their own activity and anyone reporting to them. Administrators and platform staff see the whole organization's ordinary activity. This restriction is on for every organization from day one.

In a product that records what people do, everybody being able to read everybody else is the behavior that should require a deliberate decision, not the restriction.

Barry uses the reporting line from your directory, not a job title or a role set in the portal. Someone with no reports sees only themselves, and the roster shows only the people a member can open — no names, titles or departments outside their own line. Details and the admin setting are in Appendix C.

Security

Barry is designed, developed and operated under an ISO/IEC 27001:2022-certified information security management system. The certificate is held by CODERY AD, Barry's primary owner and investor, whose certified scope covers the design, development, implementation and maintenance of information and communication systems and software.

Statement of Applicability

All 93 Annex A controls of ISO/IEC 27001:2022 are declared applicable — 37 organizational, 8 people, 14 physical and 34 technological — each mapped to a documented policy standard (PS 5.1 Information Security Policy through PS 8.5 Security in Development). The full control-by-control statement is in the download above.

Controls you'll notice in the product

• Single sign-on through any OpenID Connect identity provider — Microsoft Entra ID, Okta, Google Workspace, Keycloak. With Require SSO on, password login is disabled entirely.
• Revocable device identity. Enrolled devices hold their own token; administrators see every enrolled Monitor and can revoke a token to cut off that device immediately.
• Least-visibility default. Members see only their own reporting line until an administrator deliberately widens it (Appendix C).
• On-device filtering. Excluded apps, sites, categories and off-hours activity are dropped on the device, before anything is sent.
• Separate credentials. The organization API key is distinct from member sessions and device tokens, and revoking it stops future access at once.
• Audit log in the web portal for administrators, plus per-device Monitor logs kept locally for 14 days.

Setup guide

Everything below mirrors the Barry Monitor User Guide (updated 15 October 2026). Most organizations deploy silently through MDM and never see a prompt — start with Appendix A if that's you.

01 · Installing Barry Monitor

Barry Monitor ships as a single background executable (Barry.Monitor). Windows organizations deploy one of three packages; the .msi is the one IT deploys via MDM/Intune and supports install-time provisioning.

02 · Connecting to your organization

Barry Monitor picks up its configuration automatically: a per-user settings file has the highest priority, and anything missing falls back to machine-wide provisioning written by the installer or an admin (MSI registry properties under HKLM\SOFTWARE\Barry, or a provisioning.json).

• Windows: %LOCALAPPDATA%\Barry\Monitor\settings.json
• macOS: ~/Library/Application Support/Barry/Monitor/settings.json

{
  "HubUrl": "https://getbarry.ai",
  "OrganisationCode": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
}

HubUrl is optional and defaults to https://getbarry.ai. OrganisationCode is the same for everyone in your organization — from your administrator or the web portal. Username is automatic: if none is configured, Barry Monitor identifies the person by their signed-in OS account using the UPN convention (user@domain). Add "Username" only to override it explicitly.

On a machine IT provisioned there is nothing for the employee to do — Barry Monitor starts recording as soon as it runs. Interactive installs ask for the organization code and hub URL once; silent/MDM installs never see that page.

03 · SSO organizations — how a device signs in

A valid organization code is always enough. SSO never blocks data collection; it only decides which identity activity is recorded under. Where SSO is required, Barry Monitor reads the signed-in OS account's UPN directly from the operating system at runtime and reports under it when the domain is one of your allowed email domains.

Optional device enrollment. A device can additionally enroll once, receiving its own revocable token (sm_radar_…) that takes precedence over the automatic identity. Useful for workgroup or standalone machines without a proper UPN, or when you prefer per-device revocable credentials.

:: Windows (machine-wide install)
"C:\Program Files\BarryMonitor\current\Barry.Monitor.exe" --enroll

Barry.Monitor --enroll --hub-url https://getbarry.ai --org-code xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

The Monitor prints a verification URL; the person signs in at your identity provider; the token is saved to device-token.json next to settings.json. Enrollment expires after about 15 minutes if sign-in isn't completed. Revoked or expired tokens fall back silently to the organization code.

04 · Granting permissions (macOS)

To record which app and page is in use, macOS asks for a couple of permissions on first run. Barry Monitor prompts, or they can be set in System Settings → Privacy & Security. Windows requires no special permissions.

After granting a permission, toggle Barry Monitor off and on in that list (or restart it) so it takes effect. Safari extension: in the setup window, open Safari → Settings → Extensions and enable BarryMonitor, allow access to the websites to capture, open an allowed site with the Monitor running, then click Continue once setup confirms Safari is connected.

05 · Viewing data

Barry Monitor itself has no dashboard — all reporting lives in the web portal. Open Data to inspect recorded activity and raw events, or Intelligence for analysis and workflow insights. Both show Digital Twin readiness from collected, accessible events across all stored dates: 125,000 events → 25%, 250,000 → 50%, 375,000 → 75%, 500,000 or more → 100% and Download Skill.md unlocks. The percentage rounds down, so 499,999 events still shows 99%.

06 · Starting at login and updating

Barry Monitor registers itself to start at login — a per-user Run key on Windows, a LaunchAgent on macOS — and the registration is self-healing, refreshing on every run. Updates are deployed by IT as new installer versions; the .msi upgrades in place and configuration, enrollment token and permissions survive.

07 · Troubleshooting

• Not recording (macOS): check Accessibility and Input Monitoring are enabled; toggle off/on, then restart the Monitor.
• Not recording (any OS): confirm a valid OrganisationCode and a nonempty username in settings or provisioning; check the Monitor log for the connection result.
• Safari setup won't continue: enable the extension, allow website access, and open an allowed page while the Monitor is running.
• Digital Twin export locked: it unlocks at 500,000 accessible stored events, regardless of the selected date range.
• "Another Barry Monitor instance is already running": normal — one instance per user.
• Wrong organization or username: edit settings.json and restart. An enrolled device token takes precedence over both; re-run --enroll to switch.
• Enrollment fails or times out: run --enroll again and finish within the time limit; confirm SSO is enabled and the email domain is allowed.

Appendix A — Deploying at scale

Barry Monitor supports silent, unattended installation and install-time provisioning, so it rolls out through any MDM (Jamf, Kandji, Mosyle, Microsoft Intune) with no end-user interaction.

Silent install and provisioning in one step (Windows)

msiexec /i "BarryMonitor-win.msi" /qn ^
  ORGANISATIONCODE=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx ^
  HUBURL=https://getbarry.ai

Every user on the machine picks these up as defaults; per-user settings.json values always win. With no BARRYUSERNAME, each user is identified automatically by their UPN — ideal for shared machines, terminal servers and VPSes. When the install runs as SYSTEM (Intune push) the Monitor starts at the next logon.

provisioning.json (non-MSI installs, macOS)

A machine-wide JSON file works as an alternative to the registry: %ProgramData%\Barry\provisioning.json on Windows, /Library/Application Support/Barry/provisioning.json on macOS. Same keys as settings.json; per-user files still override it.

Autostart on machine-wide installs

Either start the Monitor once per user (MDM policy or logon script), or register a single all-users HKLM Run entry pointing at C:\Program Files\BarryMonitor\current\Barry.Monitor.exe — scripts/set-organisation.ps1 -AutostartExePath can write it. Set BARRY_NO_AUTOSTART=1 to suppress autostart registration entirely.

Pre-approving macOS permissions

Push a Privacy Preferences Policy Control (PPPC) profile from your MDM for bundle identifier ai.getbarry.monitor: Accessibility (required), ListenEvent for Input Monitoring (required), SystemPolicyAllFiles for Full Disk Access (optional, Safari history only). PPPC requires a code-signed build — use the app's designated requirement / Team ID.

The Monitor log

Diagnostics go to a per-user log file, one per day, kept for 14 days: %LOCALAPPDATA%\Barry\Monitor\logs\monitor-YYYYMMDD.log on Windows, ~/Library/Application Support/Barry/Monitor/logs/ on macOS. Every start appends version, user and executable, then the hub connection result — e.g. Hub: Authenticated successfully (organization code). When a machine doesn't show up in the dashboard, this file is the first thing to send to support.

Appendix B — Configuring single sign-on

SSO is configured in the web portal under Single sign-on (Account section). Barry connects to any identity provider speaking OpenID Connect. Register the platform at your IdP using the redirect URI shown at the top of that page — it looks like https://<your-portal-host>/api/Sso/callback. Scheme, host and path all matter; a mismatch is the most common cause of a redirect_uri error.

Directory sync — departments and reporting lines (Entra ID)

Set this up first. It populates job titles, departments and who reports to whom, and the reporting line decides who may read whose data. Barry reads your directory from the server, once for the whole organization, rather than from each machine.

1. In entra.microsoft.com → App registrations, open the app whose client ID you entered in Barry.
2. API permissions → Add a permission → Microsoft Graph → Application permissions (not Delegated).
3. Select User.Read.All and add it.
4. Click Grant admin consent for your tenant. The permission does nothing until this is done.

Sync runs hourly for the whole organization, in the background for each person who signs in, and immediately via Sync now. It maps given name and surname → name, mail/UPN → email, job title → position, department → department (created if missing), manager → reporting line. It only updates employees that already exist in Barry — nobody is created from your directory, so Barry never appears to monitor more people than it does. Entra's Employee type field is not used; someone is a manager because other people point at them.

Silent device enrollment (Entra ID, Windows)

On an Entra-joined Windows machine, Barry Monitor can prove who is using it with no browser, no code and nothing on screen. Two changes to your app registration, once per tenant: under Authentication → Add a platform → Mobile and desktop applications, add the redirect URI ms-appx-web://microsoft.aad.brokerplugin/<your-client-id>; then set Allow public client flows to Yes. Keep the existing Web platform and client secret — you are adding a second platform, not replacing one.

Success looks like SSO: enrolled silently as someone@yourdomain.com followed by Hub: Authenticated successfully (device token) in the Monitor log. If it fails, nothing breaks — the Monitor falls back to the organization code and the log says why: broker unavailable (check redirect URI / public client flows), no silent sign-in available on this machine (not joined to your tenant), organization has no identity provider configured (SSO is off).

For security reviewers: allowing public client flows also permits other secret-free flows on that registration — standard for desktop apps using the Windows broker. To keep them separate, register a second application used only by Barry Monitor, with the broker redirect URI and no secret.

Appendix C — Who can see whose data

The setting lives under Organization → Data visibility → Restrict members to their own reporting line, and it is on for every organization. Somebody can see a colleague's data when that colleague reports to them, directly or further down the chain.

• Marking a person as a Manager in the portal, or setting Employee type to "Manager" in Entra, grants nothing. Only the Manager field on other people does.
• Set up directory sync (Appendix B) first. Without a reporting line, every non-administrator sees only themselves.
• A member whose account hasn't been matched to an employee record sees nothing at all, including their own data. Monitor-reported identity alone does not grant portal access — check their sign-in identity and employee record.
• Switching the restriction off returns to every member being able to open every employee. It takes effect on the next page load.

Appendix D — Custom Capture

Under Account → Custom Capture, choose specific visible elements whose text or values should be recorded. Rules are separate from the Privacy page and are pushed to connected Monitors when saved. Add a rule, pick a source — Browser DOM (exact host plus a CSS selector such as #invoice-total), Windows UI element (app name plus AutomationId or element name) or macOS accessibility element (app name plus AXIdentifier or element name) — set the matching fields, then Save and push to Barry Monitor.

Up to 50 rules per organization. Password protections, excluded apps and sites, and working-hours restrictions take precedence. Captured text and values are bounded to 2,000 characters each, appear in the raw event log and do not add active time. The Capture activity panel shows totals, unique users and per-rule counts for the last 1, 7 or 30 days.

Appendix E — API access and exports

Open API keys in the portal to manage an organization API key. Treat it as an organization-wide credential, separate from a member's login session or a Monitor's device token. The full guide is at /docs/api on your portal, the interactive reference at /api/docs/index.html, and the OpenAPI spec at /api/openapi/v1.json.

Exports provide a full-organization feed, not the employee-scoped dashboard response. Use Bearer authentication, UTC date boundaries, cursor pagination and updatedSince checkpoints; overlap checkpoints and reconcile periodically, since the feed does not supply deletion tombstones. Revoking a key stops its future API access.