The Lansweeper Traffic sensor is an extension to Network Discovery. If you do not install it, no network traffic data is captured, transmitted, or stored by Lansweeper.
The sensor is a passive, receive-only software component that runs on your own infrastructure. It listens to the network traffic (via SPAN, RSPAN/ERSPAN, network TAPs, or a packet broker), and never injects, alters, or forwards production traffic. The only outbound activity from the sensor is throttled lookups against your own DNS servers, used to identify devices.
The traffic sensor extends your inventory with application-dependency visibility — which devices in your environment connect to which internal assets and which external services, such as sanctioned SaaS and AI tools. This capability is built around the same privacy posture with these additional safeguards:
Whitelist-only by default. Only connections to a curated list of well-known corporate-use applications (common SaaS, cloud, and AI services) are persisted in your inventory. Connections to private, personal, or unknown domains are filtered out before storage and do not appear in the platform. In practice, an employee’s personal browsing on a corporate device is not surfaced as inventory data.
No special-category data by design. External connections can in theory reveal GDPR Article 9 special-category data — for example, traffic to medical, political, or union-related domains. Lansweeper does not rely on “performance of contract” as a legal basis for such data, and consent is not considered reliable in an employer–employee context. The whitelist and exclusion-rules design is intended to keep this category of data out of your inventory in the first place.
All protections continue to apply: passive capture, no decryption or payload inspection, device-level display, customer-controlled scope and region, and the off switch.
Only the connection metadata needed to identify and place devices in your inventory: IP and MAC addresses observed on the network, source and destination IPs and ports of observed connections, the date and time of each connection, and a device identifier so observations can be linked to the right asset.
In encrypted traffic — the vast majority of modern network communication — Lansweeper does not capture, transmit, or store TLS payloads, HTTPS request bodies, URL paths behind a domain, query strings, prompts, file contents, passwords, chat messages, or anything inside encrypted tunnels. Anything on segments you do not mirror is also invisible to us.
Connection metadata is forwarded over TLS 1.2+ from your on-prem Network Discovery Hub to your Lansweeper Cloud site, hosted on AWS in the region you select (EU or US). Traffic data follows your asset-data retention policy and is fully deleted within 60 days of contract termination.
You are the Data Controller; Lansweeper is the Data Processor. You decide which segments are mirrored, traffic is shown at the device level (no user names), and your administrators can disable the sensor at any time — which immediately stops the flow of new data to Lansweeper.