Skip to main content
The Coverage tab (/enterprise/orgs/{org_id}/coverage) is the admin view of enrolled developer devices, live coverage percentage, and DLP / heartbeat policy. For concepts, detectors, and privacy boundaries, see Coverage Alerts.

​
What you’ll see

  • Coverage header — percent covered, covered/expected developer counts, and a 30-day sparkline from daily snapshots.
  • By team — horizontal bars for each team’s coverage when teams exist.
  • Device table — user, editable alias (or hashed hostname), client status chips, DLP, heartbeat, routing class, rclm version, last seen, open findings.
  • Filters — All, Uncovered, DLP off, Silent, Direct routing.
  • DLP exceptions — active exceptions with reason and expiry.
Device rows show a gateway-vs-direct routing class only — never URLs or keys. Hostnames are hashed; aliases are admin labels only. No keystrokes, process lists, or file contents are collected.

​
What you can do

​
Coverage settings

Admins can configure:
  • Require DLP — overrides local --no-dlp at runtime unless an unexpired exception applies
  • Require heartbeat — installer enables the OS timer (rclm-heartbeat) on next install/repair
  • Gateway hosts / required providers — used for AD-013 routing checks
  • Silence threshold — business days before AD-012 considers a device silent
  • Provider reconciliation (Enterprise) — encrypted provider usage credentials for AD-013c
Settings writes are frozen while an organization subscription is inactive; existing Require DLP enforcement continues from cached policy.

​
Who sees it

Admins and team leads can view coverage and devices (scoped appropriately). Only admins change settings, aliases, retirement, and DLP exceptions. Developers see their own machines under User Settings → Device health. Coverage-driven findings (AD-010…AD-013) appear on the Signals tab. SIEM-bound audit names include coverage.hooks_tampered, coverage.dlp_disabled, coverage.device_silent, coverage.gateway_bypass, and policy events for settings/exceptions — see Audit.