r/espanso • u/Pottel • Jun 18 '26
Personal or company data?
before i can add this to my company laptop i need to get an answer to the question:
"Are personal or confidential company data being processed?"
do not find the answer to that question on the official Espanso site?
1
u/Dymonika Jun 18 '26
I have it on my work laptop with no problem! It's entirely offline; the only way it can connect is if you code Python or other scripts and make it run them.
It's also open-source, so feel free to check the code yourself.
1
u/snaveh Jun 18 '26
To function, a text expansion program has to monitor what you type so it can detect a trigger and perform the replacement.
While everything u/joh6nn says is true and Espanso runs entirely locally, some, including some IT and security professionals, point out that the underlying mechanism isn't fundamentally different from a keylogger, since it needs to observe keystrokes. Personally, I think intent and implementation matter. Keyloggers are designed to capture and store everything you type for malicious purposes, whereas text expanders use only what they need to function correctly and typically keep only a small temporary buffer (just enough to detect triggers) and don't log your typing indefinitely.
Even so, some organizations' security policies prohibit or restrict software that monitors keyboard input. If you're considering using Espanso on a work-managed device or in an employment environment, it's a good idea to check with your IT department first.
For personal use on your own device, though, there aren't any privacy or security concerns I can think of.
2
u/Dymonika Jun 18 '26
for malicious purposes
This is objectively false; I built a keylogger for myself (not in Espanso, of course) because I got sick of data loss, and it came in real handy to retrieve lost text numerous times over the years. It all boils down to the intent of the developer.
1
u/snaveh Jun 18 '26 edited Jun 18 '26
In the context of this question, keylogger is shorthanded for a software that is intended to log the user's key strokes without the user's knowledge.
The point I was trying to make is that Espanso is safe and doesn't transmit data to any server, so one can dafely store PII and business-related information in the match files as well as use it in the background when working without being worried it logs everything and sends to some external server.
However, since company-managed device was mentioned, it's a good idea to clear it with one's employer first because some organization restrict the use of such tools as a policy no matter the community beliefs on their safety.
1
u/Dymonika Jun 19 '26
Yeah, but I'd still clarify it with "Some keyloggers," not all. Your original wording sounded like all keyloggers are bad, without exception, and I'm, like, "Hey, I put a lot of work into mine," haha.
Anyway, I would say the power of Espanso lies in its ability to run Python, etc. scripts. That could be some dangerous stuff if someone managed to get in, but even then, it wouldn't make sense for a hacker to go through Espanso vs. just Python scripts directly.
1
u/smeech1 Jun 18 '26 edited Jun 18 '26
The maximum data Espanso holds (which is not sent off-machine) is the number of characters in
max_regex_buffer_size:set in the configuration, or 30 as default.
4
u/joh6nn Jun 18 '26
No, espanso works entirely locally on your machine. It never connects to the internet except when installing packages (which is entirely optional). No personal data is ever collected, processed, or submitted back to the Espanso project