Desks Professional and above or Dock Plus
This article is a transparency overview of deskbird Intelligence: what data is used, where it comes from, what happens to it, and every option you control. It is written for readers evaluating deskbird Intelligence for the first time, including legal, privacy, and works-council reviewers. It is informational and describes the product as of September 2026; contractual terms are governed by your agreement with deskbird and the deskbird Data Processing Agreement. Full compliance documentation is available in the deskbird Trust Center.
- What deskbird Intelligence is
- How detection works, step by step
- The data, in full
- What is never collected
- What we do with the data: processing, storage and security
- Your options: the two privacy modes, with pros and cons
- What you can influence and control
- Deployment: what it takes and what employees notice
- FAQs
1. What deskbird Intelligence is
deskbird is an all-in-one workplace management platform (desk and room booking, workplace scheduling, analytics), used by 10,000+ workplace teams. deskbird Intelligence is the analytics layer of the platform: it measures how offices, floors, areas, and desks are actually used, so workplace and real estate teams can make space decisions on evidence instead of estimates.
It works without any hardware: no sensors, no cameras, no badge integration. Instead, a lightweight desktop application called deskbird Dock (under 5 MB, runs in the background) recognizes two things on a company laptop: whether the device is connected to a registered office network, and whether it is plugged into a registered office monitor. From these two signals, deskbird computes occupancy analytics at office, floor/area, and desk level.
💡 The design principle: spaces, not people. deskbird Intelligence measures how space is used, never who is where. Depending on the privacy mode you choose (section 6), the system can operate fully anonymously, with no deskbird user accounts and no personal identity in the data at all.
2. How detection works, step by step
- Install: your IT team deploys deskbird Dock to company laptops, typically silently via MDM (Intune, SCCM, Jamf). Employees do nothing.
- Detect locally: Dock observes, on the device only, which network the laptop is connected to and which monitor is plugged in.
- Filter locally: detections are compared against the office rules you configured. No match (for example, home Wi-Fi): the data is discarded on the device and nothing is sent.
- Transmit on match: only detections matching a registered office network are transmitted, encrypted, to deskbird's EU backend.
- Analyze: signals become aggregate occupancy dashboards: attendance, floor and area utilization, desk usage, booked versus used.
⚠️ Two rules are absolute: first, if a detected network does not match an office rule you configured, nothing is transmitted; home and public networks never leave the device. Second, monitor data is only processed at all when an office network has been detected first; off-network, monitor information never leaves the device.
Data is transmitted when a relevant environment change is detected (connecting, docking, disconnecting), plus periodic heartbeats confirming a workstation is still in use. Desk-level detection relies on a monitor-to-desk mapping that your admins control: a monitor only identifies a desk because you linked that monitor's serial number to that desk on your floor plan.
3. The data, in full
Three categories of data exist. Every field is listed below; there are no other categories.
A. Network data: transmitted only when the device is on a registered office network.
| Data point | What it is | Example | Why it is needed |
|---|---|---|---|
| SSID | Wi-Fi network name | Corp-Main-5GHz |
Identify which office network |
| BSSID | Access point MAC address | 00:1A:2B:3C:4D:5E |
Identify the specific access point |
| Gateway MAC | Router / default gateway MAC | 00:11:22:33:44:55 |
Identify office network infrastructure |
| Subnet(s) | IP subnet(s) the device is on | 192.168.10.0/24 |
Verify the office network match |
| Public IP | IP address as seen by deskbird servers | 203.0.113.42 |
Identify the office location (for offices registered by public IP) |
| Timestamp | When the detection occurred | 2026-09-22T09:15:30Z |
Occupancy timing analytics |
B. Monitor data: transmitted only on an office network and when docked.
| Data point | What it is | Example | Why it is needed |
|---|---|---|---|
| Monitor serial number | Physical monitor identifier | ABC123XYZ |
Identify which desk, via your mapping |
| Monitor product code | Manufacturer product ID | DEF456 |
Identify the monitor model |
| Manufacturer ID | OEM identifier | GHI789 |
Identify the monitor vendor |
| Mapped desk ID | Which desk the monitor is linked to | desk-floor2-a15 |
Show which desk is occupied |
| Timestamp | When the detection occurred | 2026-09-22T09:15:30Z |
Occupancy analytics |
C. System and session data
| Data point | What it is | Purpose |
|---|---|---|
| Device ID | Identifier for the laptop, collected when an office network is detected. It never rotates. In Anonymous mode, it can be disabled entirely for full anonymization (section 6). | Recognize the same device over time for occupancy trends |
| Session ID | Rolling session identifier, rotated on a configurable interval | Group related detections into sessions; rotation limits linkability over time |
| Rotation period | How often session identifiers rotate, in both privacy modes: daily, weekly (default), or monthly | Anonymization across time periods |
⚠️ Employee identity: in Anonymous mode, no deskbird user accounts are required and no user identity exists in the data. In deskbird Intelligence standalone deployments, no user identifier is sent to occupancy analytics at all, even where an account exists. Only in User authenticated mode (an explicit choice, see section 6) are visits tied to deskbird accounts, to enable booking automations and user-level features.
4. What is never collected
Never collected, in any mode:
- Employee name, email, or identity (in Anonymous mode)
- Browsing history or application usage
- GPS or geographic location data
- Personal files, documents, or screen contents
- Keyboard or mouse activity
- Camera, microphone, or any biometric data
- Home Wi-Fi networks or personal device data
Why this holds technically: Dock has no capability to read files, capture screens, or log input; it only reads network identifiers and monitor hardware identifiers. On macOS, reading the Wi-Fi SSID/BSSID requires the operating system's Location Services permission. deskbird uses it exclusively to read the network name; no geographic coordinates are collected or transmitted. If the permission is denied, Dock simply operates without network detection.
5. What we do with the data: processing, storage and security
| Purpose of processing | Producing occupancy analytics: office attendance, floor and area utilization, desk usage, presence duration, and the comparison of booked versus actually used space. In User authenticated mode additionally: booking automations (automatic check-in, booking creation, booking swap). The data is not used for any other purpose, not sold, and not shared with other customers. |
| Form of the output | Aggregate dashboards and reports at office, floor/area, and desk level. Reporting is designed around spaces, not individuals. |
| Retention | In User authenticated mode, person-related data is anonymized on the same schedule as your company-wide anonymization period (180 days by default): usage data remains queryable, but is no longer associated with individuals. There is no separate retention setting for deskbird Intelligence. In Anonymous mode, no person-related data exists to retain. |
| Encryption | In transit: TLS 1.2 or 1.3. At rest: AES-256. |
| Hosting | Google Cloud Platform, region europe-west3 (Frankfurt, Germany). Data does not leave the EU. Single endpoint: api.deskbird.com (HTTPS, port 443). |
| Certifications | ISO 27001 and SOC 2 Type II certified; GDPR-audited. Full, current documentation (subprocessors, DPA, audit reports) in the deskbird Trust Center. |
| Client software integrity | Windows artifacts are Authenticode-signed (deskbird GmbH) via Microsoft's hardware-backed signing service; macOS artifacts are Developer ID-signed, notarized by Apple, and run under Apple's hardened runtime. Tampered artifacts fail signature checks and will not run. |
6. Your options: the two privacy modes, with pros and cons
The privacy mode is a single admin setting that determines whether any personal identity exists in the data. Both options:
| Mode | How it works | What you get | Trade-offs and requirements |
|---|---|---|---|
|
User authenticated Default for combined booking + Intelligence setups |
Presence events are tied to the employee's deskbird account (via MDM identity or login in the Dock app). | Full suite: user-level analytics, compliance reports, and all booking automations (auto check-in, auto-booking, desk swap). Employees stop doing manual check-ins. | Person-related data exists (mitigated by your company's anonymization period). Every employee needs a deskbird account. Typically requires works-council alignment in DACH. |
|
Anonymous Default for Intelligence-only setups; the most common choice |
Devices are tracked via a pseudonymous device ID; session identifiers rotate on a configurable interval (see below). The device ID itself never rotates. Names never appear, not in the UI and not in exports. No deskbird accounts needed, and employees don't sign in to Dock: deskbird knows the company, but not the user. | Full occupancy analytics and trends; aggregate frequency reports (for example, "are we meeting 3 office days a week?"); optional segmentation by department via directory attributes, without exposing persons. | No individual-level features: no booking automations, no user-level reports. A device (not a person) can be recognizable across rotation periods, which some works councils want reviewed; both settings below tighten this further. |
Identifier settings: two backend configuration settings. Admins can't change either setting in the web app; to change them, contact your Customer Success Manager or deskbird Support.
- Session ID rotation (both modes). Session identifiers always rotate, in both privacy modes, on a configurable interval: daily, weekly, or monthly. The default is weekly. Shorter intervals reduce linkability over time; daily rotation makes cross-day linkage of sessions technically impossible.
-
Disabling the device ID entirely (Anonymous mode only) (
noDeviceId: true). The device ID never rotates. For full anonymization, the persistent device identifier can be switched off completely, leaving no stable identifier in the data at all. Pure occupancy measurement remains (how full is the office, which floors and desks are used, at which times); device-level trend analyses across periods are no longer possible, by design.
⚠️ Switching modes is deliberately protective: switching from User authenticated to Anonymous irreversibly anonymizes all historical events: occupancy data is preserved, all user-related information is removed, and a confirmation warning is shown before the change applies. Switching from Anonymous to User authenticated does not retroactively identify anything: data from the anonymous period stays anonymous forever.
For where to set the mode and what each mode enables in deskbird Dock, see Privacy modes and data handling for deskbird Dock.
7. What you can influence and control
Every consequential behavior of the system is under your control. The full list:
| Control | What it does | Default |
|---|---|---|
| Privacy mode | Selects User authenticated / Anonymous. One dropdown in Admin > deskbird Intelligence > Privacy. | Authenticated (combined) / Anonymous (standalone) |
| Office network rules | You define, per office, which networks count as "the office": SSID, access point (BSSID), gateway MAC, subnets, or public IP. Only detections matching these rules are ever transmitted. See Setting up office detection and network configuration for deskbird Dock. | Empty until configured: no rules, no data |
| Monitor-to-desk mapping | You decide which monitors are mapped to which desks on the floor plan. Unmapped monitors identify no desk. (Some older monitors without unique identifiers cannot be mapped.) See Resource detection. | Empty until configured |
| Identifier rotation | How often session identifiers rotate, in both privacy modes: daily, weekly, or monthly. In Anonymous mode, the device ID can additionally be disabled entirely for full anonymization. Both are backend configuration: request a change through your Customer Success Manager or deskbird Support. | Weekly rotation; device ID on |
| Booking automations (authenticated mode only) | A single toggle in Admin > Desks, parking & others: Booking settings > Automated bookings switches all booking automations on or off together: auto-update schedule status to "Office", auto check-in of existing bookings, auto-creation of bookings on docking, auto-swap when someone uses a different desk. You can run detection with automations off. See How deskbird Dock detects presence and runs booking automations. | On (one switch for all) |
| Directory attributes (anonymous mode) | Optionally sync organizational attributes (for example, department) from your directory for analytics segmentation, without exposing any person. | Off until configured |
| Anonymization period (authenticated mode) | Person-related data is anonymized after your company-wide anonymization period, the same setting that applies to the rest of your deskbird data. Aggregate usage data remains. There is no separate retention setting for deskbird Intelligence. | 180 days |
| Rollout scope | You choose which devices get Dock at all, via your MDM assignment: a pilot floor, one office, or the whole fleet. | Your MDM policy |
| Uninstall | Removing Dock (manually or via MDM) fully removes the application, autostart entries, and local cached state. No fragments remain. | n/a |
8. Deployment: what it takes and what employees notice
Three rollout options:
- MDM (recommended at scale): .msi for Windows (Intune, SCCM, …), notarized .dmg for macOS (Jamf, …). Silent install, no admin prompts for users, your MDM owns autostart and updates. See Deploying deskbird Dock via Microsoft Intune.
- Installer with auto-update: users install once (.exe / .pkg); updates apply silently. Good for pilots.
- Manual installer: classic .exe / .pkg, updates shipped the same way. Requires local admin rights, as any per-machine installer does.
Recommended path: IT testing with your security review, then an MDM pilot group, then org-wide rollout.
What employees notice:
- Nothing to install or configure when deployed via MDM; no new app to learn.
- Ongoing operation requires no elevated privileges; footprint is under 5 MB.
- On macOS, a one-time Location Services prompt (pre-approvable silently via MDM profile), used only to read the Wi-Fi name, never coordinates.
- On Windows, no runtime permission prompts at all.
- In combined setups with automations on: fewer manual actions (check-ins happen automatically).
9. FAQs
Questions legal and works-council reviewers ask first:
It depends entirely on the mode you choose and how it is configured.
- Anonymous: no person is identified and names never exist in the data. A pseudonymous device ID enables trends, session identifiers rotate on a configurable interval (daily, weekly by default, or monthly), and the device ID can be disabled entirely for full anonymization. In that strictest configuration, linking visits across days is technically impossible, even for deskbird.
- User authenticated: yes, by design. Visits are tied to accounts to enable automations and user-level features, mitigated by your company's anonymization period.
The mode is your decision, and the strictest configuration is genuine and fully supported.
No. Detections are filtered locally against your office network rules. A network that matches no rule (home Wi-Fi, café, hotspot) is discarded on the device; nothing is transmitted. Monitor data additionally requires an office network to be detected first, so a home monitor is never processed.
On Google Cloud in Frankfurt, Germany (europe-west3), encrypted in transit (TLS 1.2/1.3) and at rest (AES-256). Access is governed by deskbird's ISO 27001 and SOC 2 Type II certified controls; your data is never shared with other customers or used for any purpose other than providing the service. Subprocessor list and audit documentation are in the deskbird Trust Center.
Typically three things: the chosen privacy mode (section 6), the complete data list (section 3), and the anonymization period. Many customers in DACH adopt Anonymous mode, which requires no employee accounts and contains no names. Organizations with active works councils can tighten Anonymous mode further with daily identifier rotation or by disabling the device ID entirely, under which even device-level linkage across days is impossible. deskbird supports works-council reviews with documentation on request.
Yes. Rollout scope is controlled by your MDM (a single pilot floor is a normal starting point), booking automations can be switched off with a single toggle, and the privacy mode can be changed later. The system is deliberately conservative on switches: moving from authenticated to anonymous irreversibly anonymizes history, and moving from anonymous to authenticated never retroactively identifies past data.
Uninstalling Dock (manually or via MDM) removes the application, its autostart registration, and all local cached state completely. Contractual data deletion on offboarding follows your agreement and the DPA.
Summary for the first-time reader. deskbird Intelligence measures how office space is used, using only two signals from company laptops: connection to office networks you registered, and connection to office monitors you mapped. Everything else, from whether any personal identity exists in the data, to which networks count, to how long anything person-related is retained, is your configuration choice, with a fully anonymous, works-council-grade option available. Data is EU-hosted, encrypted, and certified under ISO 27001 and SOC 2 Type II.
Contact: your deskbird account team. Trust Center and compliance documentation are available on request and at deskbird.com/security. This overview is informational; the agreement and Data Processing Agreement govern.