Privacy

What is zero-knowledge monitoring (and why it matters)

SentinelMDM Team · Updated August 2026 · ~6 min read

Here's an uncomfortable truth about most monitoring apps: the company behind them can read everything they collect. Location data. Messages. Photos. Screen captures. It all sits on a server the vendor controls, in a form the vendor can open. "Zero-knowledge" monitoring closes that hole — and once you understand it, it's hard to accept anything less, whether you're supervising a child's phone or managing a fleet of company devices.

The problem with "trust us" monitoring

When a typical monitoring app captures data, it uploads it to the vendor's cloud where it's stored in readable form (or with keys the vendor holds). That means sensitive data — a child's location, an employee's on-screen activity, a company's device fleet — is exposed to three risks the account owner can't control:

• A data breach at the vendor exposes everything.
• An insider at the vendor can look at what they shouldn't.
• Secondary use — analytics, ad profiling, or "anonymised" data sales.

The monitoring tool meant to protect your devices becomes a new place sensitive data can leak from. This isn't hypothetical; the monitoring and "family tracker" category has a documented history of breaches.

What "zero-knowledge" actually means

Zero-knowledge means the service provider has zero knowledge of your data — it stores only ciphertext it cannot decrypt. The data is encrypted on the device before it's uploaded, with a key that only you hold. The server becomes a dumb, blind locker: it can hold the sealed boxes and hand them back to you, but it can never open them.

The result: at no point does readable data — or the key to it — touch our servers or logs. We physically cannot hand your data to anyone, sell it, or expose it in a breach, because we never have it in readable form.

The honest trade-off: no password recovery

True zero-knowledge has one real cost, and any vendor that hides it isn't being straight with you: we can't reset your password. Because the encryption key is derived from your password and never reaches us, there's no "email me a reset link" that could recover your encrypted data — if such a link existed, it would prove we held the keys all along. Losing your password means starting fresh with a new key. That's not a bug; it's the proof the system works as claimed.

Why this matters for families

A child can't consent to having their life mined by a company. The most respectful way to supervise a minor is to make sure the sensitive data exists in exactly one readable place: the parent's own screen. Pair that with a short 30-day retention window (data minimisation, aligned with COPPA's spirit), and you have monitoring that protects your child from the monitoring tool itself.

Why this matters for businesses

For a business, zero-knowledge solves a different problem: compliance risk. If your MDM vendor stores employee device data in readable form on their servers, that data is discoverable in litigation, subject to foreign-government data requests, and a liability if the vendor is breached. When data is encrypted with a key only your organisation holds, the vendor can't be compelled to hand over what it doesn't have — and a breach at the vendor exposes only opaque ciphertext. For regulated industries or privacy-conscious teams, that's a materially different risk profile.

Keep reading