Screenshot Security Considerations

Version: 1.0
Audience: Automize Clients, Administrators, Compliance Teams
Purpose: To explain the security implications, risks, and best practices associated with screenshots captured during Automize process execution.

1. Introduction

Automize may capture screenshots during bot execution to assist with debugging, exception handling, auditing, and process validation. These screenshots are extremely useful for resolving issues, but they may contain sensitive information.

This guide outlines how screenshots should be handled, stored, and protected within your organisation to ensure compliance with information security, privacy, and regulatory requirements.

2. What Screenshots May Contain

Screenshots capture the exact state of the screen at a given moment. This may include:

• Personal identifiable information (PII)
• Financial data (account numbers, invoices, quotes)
• Email contents or Outlook previews
• SAP transactions, ERP data, internal dashboards
• Customer or supplier details
• System credentials (if ever displayed on-screen)
• Business-critical information

Because screenshots can expose sensitive content, they must be treated as high-risk data assets.

3. Where Screenshots Are Stored

3.1 Local Storage (on Bot Machines)

Screenshots are normally saved in a protected directory on the local machine running the Automize Bot.

Important: Anyone with access to this folder can view the screenshot contents.

3.2 Cloud Portal (if enabled)

If screenshot syncing is activated, copies are stored securely on the Automize cloud platform.

Access is controlled via:

• Role-based portal permissions
• Encrypted storage
• HTTPS transport
• Audit logging

4. Screenshot Risk Areas

4.1 Sensitive Data Exposure

If a process handles PII, financial data, contract details, or HR information, screenshots may expose this content unintentionally.

4.2 Credential Leakage

If login windows or password fields are accidentally visible, screenshots may capture protected information.

4.3 Compliance Violations

Uncontrolled screenshot storage or sharing may violate:

• POPIA (South Africa)
• GDPR (EU)
• HIPAA (healthcare, US)
• Internal governance and policies

4.4 Insider Access Risk

Staff with access to bot machines or shared networks may view confidential screenshots.

5. Screenshot Security Best Practices

5.1 Restrict Folder Access

• Limit access to bot log and screenshot folders to authorised IT/admin users only.
• Disable inheritance and apply explicit permissions.
• Ensure NTFS or BitLocker encryption is enabled.

5.2 Avoid Storing Screenshots Unless Necessary

Enable screenshots only for:

• Debugging during development
• Error handling during testing
• Limited audits

Disable screenshot capture in production unless required.

5.3 Use Masked or Redacted UI Where Possible

When designing automations:

• Avoid having sensitive data visible on screen during automated steps.
• Use test accounts or dummy values where screenshots may be taken.
• Cover sensitive regions of the screen (e.g. minimise unnecessary windows).

5.4 Encrypt All Machines Running Bots

Use BitLocker or equivalent disk encryption on all bot hosts. Screenshots stored locally must always reside on encrypted volumes.

5.5 Store Cloud Screenshots Securely

Ensure user roles are correctly configured:

• Developers: Only access their assigned processes
• Auditors: Read-only access
• Business Users: No screenshot access by default

5.6 Do Not Email or Share Screenshots Informally

Always use secure, approved channels (encrypted email, internal ticketing systems). Never embed sensitive screenshots in Slack, Teams, WhatsApp, or shared drives without permissions.

5.7 Apply Retention & Secure Deletion

• Keep screenshots for the minimum period required.
• Automatically purge old screenshots based on your retention policy.
• Securely delete files (not simple delete).

5.8 Monitor Access

Use portal audit logs to check who viewed or downloaded screenshots.

6. Special Considerations for Regulated Industries

6.1 Financial Services

Ensure no account numbers, balances, or transaction histories are captured unless absolutely necessary.

6.2 Healthcare

Never capture patient records, diagnoses, or medical images.

6.3 Legal & Professional Services

Be cautious with contracts, case files, briefs, and privileged information.

6.4 Government

Avoid capturing ID numbers, passport numbers, tax records, or internal portals.

7. Responsibilities

7.1 Automize Responsibilities

• Provide secure cloud storage for screenshot syncing
• Provide encryption in transit (HTTPS/TLS 1.2+)
• Provide role-based access control
• Mask sensitive system-detected fields where possible

7.2 Client Responsibilities

• Secure bot machine storage and restrict permissions
• Define internal screenshot retention policies
• Configure Automize roles to prevent overexposure
• Avoid exposing sensitive data during automated execution
• Monitor and audit screenshot access

8. Summary

Screenshots play an important role in automation debugging and auditing, but they must be treated as sensitive information. By implementing the safeguards in this guide, clients can significantly reduce the risk of data leakage, maintain compliance, and ensure secure automation operations.

If you require help configuring screenshot policies or securing your Automize environment, please contact the Automize support team.