> ## Documentation Index > Fetch the complete documentation index at: https://manual.voiceping.net/llms.txt > Use this file to discover all available pages before exploring further. # Endpoint monitoring and security operations > Monitoring and screen-recording development for DaaS, manual maintenance, human-error and malware response, and software supply-chain review. VoicePing combines automated monitoring with human review to catch configuration errors, unnecessary access and suspicious software. This guide covers day-to-day operations and monitoring and recording tools under development for DaaS. **Updated October 21, 2026.** This guide covers selected controls. Detailed endpoint configurations and detection rules are kept private. [日本語版](/ja/security-operations). ## Monitoring and recording development for DaaS DaaS (Desktop as a Service) provides remote access to a cloud-hosted desktop. This approach is also used in [virtual desktop environments such as those described by Google Cloud](https://cloud.google.com/solutions/virtual-desktops). We are developing process monitoring, alerts and screen recording for enterprise remote desktops. These tools help investigate what happened before and after a mistake or suspicious activity. ![Remote-desktop operations are the intended use; process monitoring, alerts and screen recording are being tested in a local implementation](https://mintcdn.com/test-cf63e467/qnYfqo34_6fjxGqk/en/images/security/illustrated/12-daas-development.webp?fit=max\&auto=format\&n=qnYfqo34_6fjxGqk\&q=85\&s=e49f11c25ae691ac841d98c28a1cb0dd) The tools are being tested on internal operational devices. Contact us about DaaS availability and deployment options. The tools are not automatically installed on customer devices. ## Monitoring processes, configuration and services Devices with monitoring installed report program launches and configuration changes for review. Checks on remote PCs and servers also cover service health and administrative access. Coverage depends on the environment. | Target | Review points | | - | - | | Running programs | Suspicious execution or operations that may copy or transfer credentials | | Startup and background settings | Unintended background tasks or additions/changes to startup configuration | | SSH and access permissions | Changes to authorized keys, configuration, ownership and permissions | | Monitoring tools themselves | Stops, recording errors, lost permissions and insufficient storage | | Services | Process health, responses, scheduled tasks and recovery state | ![Changes in processes, startup settings, access permissions and monitoring health lead to limited notifications and operator review](https://mintcdn.com/test-cf63e467/qnYfqo34_6fjxGqk/en/images/security/illustrated/13-endpoint-monitoring.webp?fit=max\&auto=format\&n=qnYfqo34_6fjxGqk\&q=85\&s=92e6ef6dc3c6083c47e37d1f362f2713) An operator compares alerts with work records to distinguish legitimate changes from suspicious activity. ## Screen-recording purpose and privacy The screen recorder under development saves work screens at regular intervals for review by date and time. Operators can compare changes or suspicious file access with process logs and alerts. Recording is designed to stop during inactivity, locking and sleep. The current implementation stores images on the device without uploading them. Alerts contain limited details, such as the reason and time, without sending images, private-key contents, command arguments or keystrokes. ![Screen recordings stay on the endpoint; only necessary detection metadata is sent to the notification destination](https://mintcdn.com/test-cf63e467/qnYfqo34_6fjxGqk/en/images/security/illustrated/14-recording-privacy.webp?fit=max\&auto=format\&n=qnYfqo34_6fjxGqk\&q=85\&s=2022765c8bce754e68e71420c07a43fc) Access to recordings is restricted, and older images are deleted according to retention and storage limits. Cleanup stops when the tool stops, and recording may pause if storage fills up. The recorder has no built-in encryption; protection must be provided by the device or storage system. Deployment requires explaining the recording purpose to affected people and defining who may view recordings and when they are deleted. Screens, device names and file paths may contain confidential or identifying information. Off-screen activity and short-lived processes may not be captured. Recording supplements dedicated endpoint detection and response (EDR) tools and tamper-resistant audit records. ## Manual checks and maintenance Operators compare monitoring results with actual settings and service health. Maintenance includes reviewing SSH keys and public access, removing unnecessary background or scheduled tasks, and checking behavior after each change. ![Inspect settings and runtime state, review scope and authority, perform targeted maintenance, and verify permitted and rejected operations](https://mintcdn.com/test-cf63e467/qnYfqo34_6fjxGqk/en/images/security/illustrated/15-manual-maintenance.webp?fit=max\&auto=format\&n=qnYfqo34_6fjxGqk\&q=85\&s=9b40632a29f0bee779f8cbaad3c8a274) Before blocking access, lifting a restriction or suspending an account, operators check the target, the impact on legitimate users and previous exceptions. Sharing block information between services also requires manual review. Ordinary account closure and personal-data deletion follow separate procedures. ## Suspected human error or malware Operators compare timestamps, configuration changes, processes and, when needed, screen recordings to determine the cause and impact. This helps distinguish mistakes or legitimate maintenance from suspicious software activity. ![Notice an anomaly, preserve records, assess impact, contain as needed, and recover with preventive improvements; actions may proceed in parallel](https://mintcdn.com/test-cf63e467/qnYfqo34_6fjxGqk/en/images/security/illustrated/16-incident-response.webp?fit=max\&auto=format\&n=qnYfqo34_6fjxGqk\&q=85\&s=46e94e8b90f05ff3eff5e2f7ba01270a) Suspicious software is stopped and investigation records are preserved. Authorized operators assess service impact before disconnecting access, revoking permissions or changing credentials. After recovery, findings inform measures to prevent recurrence. ## Software supply-chain review ### Preparing for supply-chain attacks Supply-chain attacks introduce malicious code through software such as libraries and development tools. A familiar package can still be compromised through a publisher account or a tampered update. Our software review policy covers direct and indirect dependencies, build tools, extensions, executables and AI model-loading code. ![Review publishers, dependency graphs, artifacts, execution conditions, isolated testing and deployment decisions for libraries, tools, extensions and models](https://mintcdn.com/test-cf63e467/qnYfqo34_6fjxGqk/en/images/security/illustrated/23-supply-chain-controls.webp?fit=max\&auto=format\&n=qnYfqo34_6fjxGqk\&q=85\&s=80ae4af88653f4336a3b81aebc627140) ### What is reviewed before use | Risk | Policy and review points | | - | - | | Lookalike packages or publisher changes | Confirm official names, publishers and distribution sources; review release history and ownership changes, including configuration that prevents private packages resolving from public registries | | Unexpected dependencies in an update | Review direct and indirect dependency changes, record versions and artifact identities, and use fixed dependencies to avoid unintended updates | | Artifact tampering | Check hashes and available signatures/provenance against the expected source and build. Missing information remains unverified | | Malicious install or first-run behavior | Inspect automatic scripts, secondary downloads, network destinations, credential access and persistence. Review required scripts individually | | Known vulnerabilities or malicious releases | Check exact versions against vulnerability and malicious-package information; investigate usage and impact rather than updating automatically on a scanner result | | Execution during builds or model loading | Review bundled model code, build/CI configuration and development tasks. The baseline policy is validation in isolation without credentials or production data | Hashes check file integrity, signatures help verify the publisher, and vulnerability scans identify known issues. We combine these checks because no single one can detect all malicious code. ### Records and scope Completed reviews include dependency inventories, artifact checks, tests with install scripts disabled, vulnerability fixes and isolated regression tests. Some translation-model runtimes also pin model revisions and verify file hashes. Models that load custom code require review of both the model files and the loading code, alongside API input validation. AI output and instructions in external documents do not authorize code execution or permission changes. Coverage and rollout vary by service, and reviews of existing dependencies are ongoing. Our policy is to hold installation or execution when the evidence is insufficient or suspicious behavior remains, until further checks resolve the concern. If suspicious execution is detected, we stop further execution, preserve records and investigate the impact. ## Middleware vulnerability updates We monitor official advisories for web servers, runtimes and databases, assess their relevance to our services and apply updates. The workflow and examples below reflect our work as of October 21, 2026. ### Official sources used in recent reviews | Software | Websites and what we check | | - | - | | Nginx web server | [Security advisories](https://nginx.org/en/security_advisories.html) identify affected conditions and fixed versions; the [stable release changelog](https://nginx.org/en/CHANGES-1.30) describes the fixes | | Ubuntu packages | [Security notices](https://ubuntu.com/security/notices) and [OVAL vulnerability data](https://ubuntu.com/security/oval) help compare the exact distribution package with its security fixes | | Go runtime and build toolchain | [Go security guidance](https://go.dev/doc/security/) and [release history](https://go.dev/doc/devel/release) identify security releases; `govulncheck` helps assess whether vulnerable functions are reachable from the application | | Managed MySQL | Google Cloud's [major-version upgrade guide](https://docs.cloud.google.com/sql/docs/mysql/upgrade-major-db-version-inplace) and [restore procedures](https://docs.cloud.google.com/sql/docs/mysql/backup-recovery/restore) describe compatibility checks and recovery requirements | Distributions sometimes backport fixes to older releases. We check patch history and, when needed, source changes alongside version numbers, scan results and actual usage. ### From an advisory to a verified update ![Official advisories lead to impact assessment, artifact review, isolated tests, staged deployment and verification of live processes, with stopping or rollback if needed](https://mintcdn.com/test-cf63e467/oXIxCtOwGgfNzJzx/en/images/security/illustrated/24-middleware-updates.webp?fit=max\&auto=format\&n=oXIxCtOwGgfNzJzx\&q=85\&s=86846c47198073eba86803f5fca4601f) 1. **Read the official notice.** Identify the affected releases, triggering conditions and the published fix from the sources above. 2. **Assess impact.** Check the installed version, enabled features, exposure and application usage. Record whether action is needed and why. 3. **Review the update.** Check the official source, signatures, hashes, dependency changes and install behavior. Urgent fixes also go through [supply-chain review](#software-supply-chain-review). 4. **Test in isolation.** Without credentials or production data, test compatibility, affected features, persistent connections and rollback to the previous version. 5. **Deploy in stages.** Review test results and recovery steps before the authorized production rollout. Drain or reconnect long-lived sessions as needed, and stop or roll back if problems arise. 6. **Verify the running service.** Check that processes use the updated executable and that connections and affected features work correctly. Record the results and any follow-up work. ### Recent examples and their status * **Nginx — production update.** We updated the website and translation-service environments covered by this work to security release **1.30.6**. Review covered signed distribution metadata, source and package contents, install scripts and dependencies. Tests covered TLS, routing, persistent connections and rollback; post-update checks covered running master and worker executables, HTTPS responses and website or translation functions. * **Go — production update.** We rebuilt and deployed the speech service with **1.27.3** to address a runtime vulnerability. Checks covered unit tests, race detection, reachable vulnerabilities, the running executable, speech processing and reconnection. * **MySQL — upgrade preparation.** Before a major-version upgrade, we checked compatibility and data integrity in a test environment, and reviewed application-driver behavior and recovery procedures. Update scope and timing depend on the vulnerability's impact and the service configuration. ## Release and recovery verification Before a release, we review the changes, any data migration and the rollback procedure. After deployment, we check the running version, service health and affected features. ![Review changes and recovery procedures, test, deploy through the approved process, verify the live environment and roll back if needed](https://mintcdn.com/test-cf63e467/qnYfqo34_6fjxGqk/en/images/security/illustrated/18-release-management.webp?fit=max\&auto=format\&n=qnYfqo34_6fjxGqk\&q=85\&s=212ad8cd73ad74405822c812a1dab40f) Configuration reloads, service restarts and data restoration have different effects and need appropriate recovery steps. Production changes are approved and carried out separately from investigation. See the [Privacy Policy](/en/privacy-policy) for handling investigation records and customer data, or contact [support](https://voiceping.net/en/support/). > [!TIP] > > If you have any questions, please contact us via [this form](https://voiceping.net/en/support/). ## Official Links > **[Official Website](https://voiceping.net/)** > > Visit our official website > **[X (Twitter)](https://x.com/VoicePingMedia)** > > Follow us on X > **[Facebook](https://www.facebook.com/voiceping.inc)** > > Like us on Facebook > **[LinkedIn](https://www.linkedin.com/company/28684130/)** > > Connect on LinkedIn This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.