Notice for Your Staff

The notice

Subject: Vigilance on our computers

[Company] uses a program called Vigilance on our computers. It runs in the background. It starts when you log in and keeps running.

When you, or an AI tool on your computer, install a public software package from npm or PyPI, Vigilance checks the package against Vigilance's server. It compares the new version with the last safe one. For most packages, only a short 4-character code goes to that check, not the package name. If nobody has checked that version yet, the public package name and version go to the server. Your name, your code, your chats and the names of private packages stay on your computer.

To do this, Vigilance changes the settings of npm, pnpm, yarn, bun, pip and uv for your user account. It also adds a short note to each AI tool it finds. [Paid plan only: It also adds a hook to each AI tool it finds.]

Once, at install, Vigilance reads the package lists (lockfiles) in your code folders. It skips Desktop, Documents and Downloads unless you allow them. It sends only public package names and versions. It sends no folder or project names.

Vigilance keeps a list of the packages it saw on your computer for 180 days. The list stays on your computer.

During a free watch, Vigilance only counts. If [Company] keeps Vigilance on a paid plan, Vigilance swaps a risky update for the last safe version on its own, after a test. [Company] can set Vigilance to ask you first. If a package on your computer is later found to be an attack, Vigilance can show you a desktop notice.

[Done For You only: Vigilance also checks the apps installed on your computer. The report names only the apps it flags.]

Vigilance reports counts to [Company]. Each computer shows by a two-word name, such as "blue otter". The report shows counts for each computer. [Company] can link a computer name to a person. Vigilance cannot.

You get Vigilance only from vigihq.com/join, from the link that [Company] sends you. Vigilance never asks you to run anything after the first install. It never asks for a password.

If [Company] stops after the watch, Vigilance turns off within about 6 minutes and removes itself within 30 days.

[Company] uses these counts to protect its systems and clients from harmful software packages. Vigilance is provided by Modul4r Solutions of Edmonton, Alberta, Canada. Its servers are in Canada. Requests pass through servers in other countries, mostly the United States, on the way. The counts are kept for 2 years.

Questions: [contact]. Date prepared: [date]. Date changed: [date].

Before you send it

• Replace each [Company] with your company name.
• Replace [contact] with the person staff ask, and set the two dates.
• Keep the paid-plan line if you plan to say yes after the watch. Keep the Done For You line if you add the whole-computer watch. Delete the lines that do not apply.
• Send it before the first install. When you pick a plan or add the whole-computer watch, send it again with the new date in "Date changed".

Each person also sees a short consent screen at install, before Vigilance writes any file. On a computer that the person owns, that person agrees. Without a yes, nothing is installed.

The facts in the notice come from how the installer works. The full field list is on What Leaves the Computer.

Start the free 14-day watch