Quillclock
Get started
Self-hosted

Self-hosted employee monitoring — your server, your data

Quillclock is a Next.js application and a MongoDB database. Deploy it on your own infrastructure and no third-party vendor ever holds your team's activity data, screenshots or hours.

  • Your database, your retention
  • Screenshots + activity levels
  • No per-seat vendor lock-in
  • Deploy anywhere Node runs
Start freeTry the live demo

Free to start · No credit card · Windows desktop agent

The gap in self-hosted time tracking

There are good open-source time trackers. Kimai is excellent for invoicing-grade timesheets, ActivityWatch is a strong privacy-first personal tracker, and TimeTagger and Solidtime both do clean manual tracking. What almost none of them do is the thing teams actually shop for when they compare against Hubstaff or Time Doctor: automatic activity levels plus optional screenshots, managed across a team.

That combination is why organisations end up on hosted SaaS even when their policy, their clients, or their regulator would rather they did not. Quillclock exists to close that gap.

What self-hosting actually gets you

Data residency. The activity samples and screenshots live in your MongoDB instance, in whatever region you choose. For teams under GDPR — or under a client contract that forbids sending staff data to a third-party processor — this is often the deciding factor.

Retention on your terms. Screenshots auto-delete after seven days by default, but it is your database. You set what is kept and for how long.

No per-seat meter. Hosted monitoring tools price per user per month, which is what makes them expensive for BPOs, agencies and call centres running large rosters. Self-hosting decouples headcount from cost.

What deployment involves

The stack is deliberately unexotic: Next.js 14 (App Router), MongoDB via Mongoose, and JWT auth in an httpOnly cookie. It runs anywhere Node.js runs — your own VPS, a container, or a managed platform if you prefer. Set three environment variables (MONGODB_URI, MONGODB_DB, JWT_SECRET), point the desktop agents at your server URL, and the first visit walks you through creating the admin account.

The Windows agent is a single Python-built executable. Employees install it, sign in, and accept their invite — there are no config files to distribute and no agent keys to copy around.

Self-hosted does not mean unmonitored consent

Running the server yourself does not let you switch off the consent gate. It is enforced in the ingest path: samples for an employee who has not accepted their invite are rejected, and revoking consent stops collection immediately. Self-hosting changes who holds the data, not whether the person generating it agreed to it.

See how consent is enforced for the detail.

Frequently asked questions

Can I self-host Quillclock on my own server?+

Yes. It is a standard Next.js application backed by MongoDB, so it runs on any host that supports Node.js — your own VPS, a container platform, or a managed Node host. You supply the database, so the data never leaves infrastructure you control.

Does the self-hosted version include screenshots and activity levels?+

Yes. Self-hosting is a deployment choice, not a reduced tier — per-minute activity levels, app and window tracking, optional per-employee screenshots, projects, tasks, alerts and chat all work the same way.

Is this an open-source Hubstaff alternative?+

It fills the same need: automatic activity tracking with screenshots, run on infrastructure you control rather than a vendor's cloud. Check the repository for the licence terms that apply to your use.

What database does it need?+

MongoDB. You can run it yourself or use a managed instance such as MongoDB Atlas — in which case allow your server's IP under Network Access.

Does self-hosting help with GDPR compliance?+

It helps with data residency and with avoiding a third-party processor, which are two common obstacles. It does not by itself make a monitoring programme lawful — you still need a valid basis, proportionality, and proper disclosure to staff. This is not legal advice.

Run it on your own infrastructure

Get started freeSee how it works