> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reclaimtime.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Code signing and tamper resistance

> How to verify an installer, what keeps the client running, and what your endpoint protection will see.

## Code signing

Every ReclaimTime executable we publish is Authenticode signed and timestamped.

| Property             | Value                          |
| -------------------- | ------------------------------ |
| Publisher            | **FocusMe (Reclaim Time Ltd)** |
| Signature and digest | SHA-256                        |
| Timestamp authority  | Sectigo                        |

Timestamping matters: it means a signature stays verifiable after the signing certificate expires, so an installer you archived last year still validates today.

### Verifying a download

Before trusting an installer, check the signature rather than the source it came from:

```powershell theme={null}
Get-AuthenticodeSignature .\ReclaimTimeSetup.exe | Format-List Status, SignerCertificate
```

`Status` must be `Valid`, and the certificate subject must read **FocusMe (Reclaim Time Ltd)**. Anything else, including `NotSigned` or `HashMismatch`, means do not run it and tell us.

<Info>The host an installer was downloaded from only says where the bytes were stored. The signature is what says the bytes are ours, and it is checkable without trusting the host at all.</Info>

### SmartScreen

Windows SmartScreen may warn on a newly published build even though it is correctly signed, because reputation is built from how many machines have run it. Choose **More info**, confirm the publisher reads **Reclaim Time Ltd**, then **Run anyway**. The warning stops once the build has been seen enough times.

## What keeps the client running

Tracking that stops when somebody closes a window is not tracking. The standard installer adds background components that start the client at logon and restart it if it is closed or ended. The non-admin installer does not include them, which is one reason to use the standard installer wherever you can.

If your endpoint protection or build process needs the component names, ask us and we will send them.

## What your endpoint protection will see

Three behaviours look unusual out of context and are worth exempting once rather than investigating repeatedly.

1. **A process that restarts when terminated.** The background components exist to do exactly this. Seeing the client return shortly after it was ended is correct behaviour, not persistence malware.
2. **A service launching a process into a user session.** This uses the standard Windows mechanism. It runs only our own signed executable from the installation directory.
3. **A download and silent execution of an installer.** This is the update path. The client fetches a signed installer from our download host and runs it silently.

If any of these are blocked, the visible symptom is usually not an error. It is machines that quietly stop updating, or a client that disappears after an endpoint tool removes it. If a group of machines stops reporting at once, check the allow-list and the exemptions before anything else. We send the exact names and hosts to exempt on request.

## What is not claimed

To be explicit, because these come up:

* The client does **not** attempt to hide from Task Manager, rename its processes, or disguise itself. Its processes are named, signed and visible.
* It does **not** modify or disable your endpoint protection, firewall or Windows Update.
* It does **not** require or use kernel drivers.
* It does **not** elevate silently. The standard installer asks for elevation once, at install time, through the normal User Account Control prompt.

***

*Checked against ReclaimTime client 8.0.0.9 and dashboard V3 on 5 September 2026.*