Roll out the desktop recorder: IT and MDM guide

This guide is for IT administrators rolling out the Scalign desktop recorder to a team. It covers what the app does, where to get it, which permissions and network access it needs and what you can pre-approve with MDM. Setting it up on your own computer? See Install the desktop recorder. For who can open a recording once it's in Scalign, see Who sees your recordings.

What it is

Scalign Assistant is the desktop app that records meetings for Scalign. It detects when Zoom, Google Meet or Microsoft Teams starts a call and records it, or records an in-person meeting through the computer's microphone.

• It records audio only: the user's microphone and the other participants' audio. It never captures the screen and never asks for screen recording permission.
• macOS 13 Ventura or later, on Apple silicon (M1 or later). Intel Macs aren't supported.
• Windows 10 or later, 64-bit.

Download

• macOS: https://github.com/Scalign/desktop-releases/releases/latest/download/Scalign-Assistant.dmg
• Windows: https://github.com/Scalign/desktop-releases/releases/latest/download/Scalign-Assistant-Setup.exe

Users can also download it in Scalign under Settings → Recording → Desktop recorder.

App identity (macOS)

• Name: Scalign Assistant
• Bundle ID: com.scalign.desktop
• Team ID: PZY49ZZN8C
• Signed with a Developer ID certificate, hardened runtime, and notarized by Apple.

To check a copy yourself, run codesign -dv --verbose=2 "/Applications/Scalign Assistant.app" and look for the bundle ID and TeamIdentifier.

Install

macOS

The DMG contains the app; it belongs in /Applications. Deploy the .app there with your MDM, or let users drag it across. Updates only work from /Applications: started from Downloads or the disk image, the app asks to be moved.

To uninstall, delete Scalign Assistant from /Applications. The user's session is stored in the login keychain and settings under ~/Library/Application Support/Scalign Assistant; remove those too for a clean wipe.

Windows

The installer is a standard NSIS installer (not one-click). It installs for the current user by default, under %LOCALAPPDATA%\Programs\Scalign Assistant; the user can pick all users and change the folder. For a machine-wide silent deploy, run Scalign-Assistant-Setup.exe /S /allusers (/D=C:\path to set the folder).

There's no auto-start policy: the app starts when the user opens it, or at login if they switch on Open at login in the app's Settings. Uninstall through Settings → Apps or the Uninstall Scalign Assistant entry in the install folder.

Network access

Allow outbound HTTPS (port 443) to:

• engine.scalign.ai — the Scalign API: sign-in, settings, and the upload tokens for each recording.
• workspace.scalign.ai — Scalign in the browser, where the user signs in.
• eu-central-1.recall.ai — Recall.ai, our EU recording sub-processor; the recorder uploads audio there.
• github.com and objects.githubusercontent.com — updates, from the Scalign/desktop-releases repository.
• *.ingest.de.sentry.io — crash reports (Scalign's Sentry, EU). Recall.ai's own diagnostics go to *.sentry.io and *.datadoghq.com; optional, but we can't debug upload problems without them.

Updates: the app checks shortly after launch and then every 30 minutes, downloads new versions in the background and installs them when it restarts. If only GitHub is blocked, the app keeps working but stops updating.

Offline and VPN

The recorder needs a connection while it records: if the network drops mid-meeting, the recording ends and the user is told; it isn't resumed. A VPN is fine as long as the hosts above are reachable through it.

Where recordings go

Audio is captured on the computer during the meeting and uploaded to Recall.ai (Frankfurt) when the recording ends; the recorder keeps no library of recordings on the computer. Recall.ai transcribes it, and Scalign stores the recording and transcript in the EU, encrypted at rest (AES-256). See the security overview and sub-processors for retention and processing details.

macOS permissions

On first launch the app walks the user through three permissions, in this order. Recording pauses if any of them is later turned off.

• Accessibility: to detect when Zoom, Meet or Teams starts a call, and who is speaking. No other apps are read.
• Microphone: to record the user's side of the conversation.
• System audio recording: to record what the other participants say.

One more is optional and not part of setup:

• Full Disk Access: to read the meeting link of Microsoft Teams meetings, and of Google Meet in Safari, which macOS keeps behind Full Disk Access. Without it those recordings are still made but can't be matched to calendar events. The app asks for it the first time it detects such a call without it (notification plus an in-app banner), and it can be granted from the app's Settings. Teams-heavy teams should pre-approve it with MDM (below) so users never see the prompt.

Pre-approve permissions with MDM

A Privacy Preferences Policy Control (PPPC) profile can pre-approve Accessibility and Full Disk Access, so users skip the Accessibility step and never see the Full Disk Access prompt. Create one entry for the app:

• Identifier: com.scalign.desktop, identifier type Bundle ID
• Code requirement: identifier "com.scalign.desktop" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "PZY49ZZN8C"
• Services: Accessibility (Accessibility) and Full Disk Access (SystemPolicyAllFiles), both set to Allow.

To print the code requirement from an installed copy, run codesign -dr - "/Applications/Scalign Assistant.app".

Deploy the profile before users first open the app. If it lands while the app is running, have them quit and reopen it so the wizard picks Accessibility up.

Microphone and system audio can't be granted through MDM: macOS only lets the user allow them, so each user clicks Allow once during setup. MDM can only deny them.

Optionally, add a Notifications payload (com.apple.notificationsettings) for com.scalign.desktop with NotificationsEnabled true and AlertType 1 (banners), so the app's "Meeting detected" prompts show without asking.

Windows

There's nothing to pre-approve through MDM on Windows. Make sure Windows privacy settings let desktop apps use the microphone (Settings → Privacy & security → Microphone).

After installing

Each user opens the app, clicks Sign in and signs in with their Scalign account. In Scalign, Settings → Recording → Desktop recorder then shows "Signed in and ready to record", or that microphone or system audio access is missing. In the app, Settings → Permissions shows the same per permission.

Questions from your security review? Email support@scalign.ai, or see our security overview and sub-processors.