Grindr's £26M Settlement Is an Endpoint Visibility Problem — Can Your RMM Prove What's Running on Your Fleet?

This week The Register reported that Grindr agreed to pay £26 million to settle a UK privacy class action over allegations that it shared sensitive user data — including HIV status — with third parties. Grindr admits no liability, and the case is about a consumer dating app, not a data centre.

So why should a sysadmin, help desk lead, or MSP technician care?

Because strip away the headline and the underlying failure is one you own every day: an organisation could not produce a complete, trustworthy account of which third-party software touched its data, on which systems, and when. Swap user data for client data and swap the dating app for that obscure sync agent someone installed on a branch-office workstation in 2022, and you have the exact scenario that keeps compliance officers and IT managers awake at night.

Here is the question this settlement puts on your desk: if legal, an auditor, or a regulator asked you today for a full software inventory across your fleet — every installed application, version, and publisher on every endpoint — how long until you could answer with confidence? If your answer involves the words 'let me check a few tools' or 'give me a couple of weeks', your RMM and monitoring stack is part of the problem.

The Problem in Depth: Your Inventory Is a Snapshot, Not a Source of Truth

What your current tooling is actually doing

Most IT teams run some combination of:

• A standalone RMM or management tool — ConnectWise, NinjaOne, Datto RMM — for agents, scripting, and remote access
• A separate monitoring platform — PRTG, SolarWinds, Zabbix, Nagios — for up/down states and performance
• A separate helpdesk — Zendesk, Freshservice, HaloPSA — for tickets
• Patching handled by WSUS, Intune, or a module bolted onto the RMM

Each of these holds a partial version of the truth, and none of them agree. The RMM's inventory was last scanned three days ago on the 60% of endpoints that checked in on schedule. The monitoring tool knows the server is up but has no idea what is installed on it. The helpdesk knows the user is angry but has never heard of the app they are calling about. Patch state lives somewhere else entirely.

Why the gaps exist

This is not a skills problem — it is architecture. Most toolchains are acquisitions bolted together, connected — if at all — by CSV exports, half-maintained API scripts, and hope. Inventory in standalone RMMs refreshes on check-in intervals, so offline laptops, contractor machines, and anything behind a flaky VPN simply go dark. Scripting exists, but the results land in a log nobody reviews instead of appearing in the same timeline as your alerts and tickets. And there is no shared evidence trail: when someone asks 'who installed this and when?', the honest answer is 'nobody knows'.

What it actually costs you

Concrete scenario. A client's compliance team sends your MSP a questionnaire: list every endpoint with third-party messaging or file-transfer software installed, plus versions, within 10 business days. Across 400 Windows endpoints, the old workflow looks like this:

1. Export a stale inventory from the RMM and hope it is current
2. RDP or remote into the machines it missed, one at a time
3. Email end users asking them to check their own laptops (expect a 30% response rate)
4. Reconcile three partial lists in Excel
5. Repeat the whole exercise when someone spots a discrepancy

That is 30–40 technician hours for one question, and the output is a spreadsheet nobody fully trusts. Now multiply by every audit, every DSAR with its 30-day statutory clock, and every 'why is this on my laptop?' ticket the helpdesk cannot answer without asking the user for a screenshot. Add GDPR exposure — fines of up to 4% of global turnover and class actions like the one Grindr just settled — and unmanaged endpoint software stops being a hygiene issue and becomes a balance-sheet issue.

And there is a human cost. Your techs spend evenings doing inventory archaeology instead of engineering. Your IT manager cannot produce an accurate compliance report because the data lives in four systems that do not talk. That is how burnout and SLA misses actually happen — not from one big outage, but from a hundred small questions the tooling cannot answer.

How AlertMonitor Solves This

AlertMonitor was built on a different assumption: monitoring, RMM, helpdesk, patching, and network topology are one job, so they belong in one platform.

One agent, one continuously updated inventory. Every Windows workstation, Windows Server, and Linux endpoint reporting into AlertMonitor carries its current software inventory on its device record — visible next to its alerts, open tickets, patch state, and recent script runs. No stale exports. The inventory is live data, not a report you generate once a quarter.

Scripting at fleet scale, with results that stay visible. Select a device group — say, all Windows 11 endpoints at Client A — and run an audit script across the entire group in one action. Results feed back into the monitoring timeline, so what ran, on which devices, with what output, is permanently on the record. That timeline is your evidence trail when an auditor starts asking questions.

Remote sessions without the tab-switching. When an audit flags a device, you open a remote session from the same console — no second tool, no stored per-device credentials, no loss of context between seeing the problem and fixing it.

Patch management wired to inventory. AlertMonitor flags endpoints running outdated versions directly from inventory data, pushes the fix, and updates compliance status — closing the loop between what is installed and what is safe.

Helpdesk with full device context. When a user submits 'what is this program and do I need it?', the technician sees the device's complete software list and recent changes before replying. No asking the user for screenshots. No guesswork. The ticket, the device, and the remediation are all linked.

The workflow comparison is stark. The old way: four tools, six steps, 30–40 hours per audit, unreliable results. The AlertMonitor way: pick the device group, run the script, review results in one timeline — minutes of work, with a defensible audit trail attached automatically.

Practical Steps You Can Take Today

1. Build a trusted baseline inventory

Run this on a Windows device — or push it through AlertMonitor's script runner to a whole device group — to capture installed software from the registry, including 32-bit applications on 64-bit systems:

$paths = @(
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

Get-ItemProperty -Path $paths -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName } |
    Select-Object DisplayName, DisplayVersion, Publisher, InstallDate,
                  @{N='Computer'; E={ $env:COMPUTERNAME }} |
    Sort-Object DisplayName -Unique |
    Export-Csv -Path (Join-Path $env:ProgramData 'software-inventory.csv') -NoTypeInformation -Force

2. Sweep the fleet for unapproved third-party software

This script is designed for remote execution via an RMM script runner: it exits non-zero when it finds an unapproved application, so your platform raises an alert automatically:

$unapproved = @('uTorrent', 'AnyDesk', 'TeamViewer', 'FileZilla Server')  # replace with your policy list

$paths = @(
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

$hits = Get-ItemProperty -Path $paths -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName } |
    ForEach-Object {
        $app = $_
        foreach ($name in $unapproved) {
            if ($app.DisplayName -like "*$name*") {
                [PSCustomObject]@{
                    Computer = $env:COMPUTERNAME
                    App      = $app.DisplayName
                    Version  = $app.DisplayVersion
                }
            }
        }
    }

if ($hits) {
    $hits | Format-Table -AutoSize
    exit 1   # non-zero exit: AlertMonitor flags this endpoint and logs the result to the timeline
}

Write-Output 'Clean: no unapproved applications found.'
exit 0

In AlertMonitor, schedule this weekly per client and configure exit code 1 to raise an alert that auto-creates a helpdesk ticket. The audit, the alert, the ticket, and the resolution all live on one timeline — which is exactly the evidence trail you will be asked for one day.

3. Remove unapproved software remotely — no site visit needed

$appName = 'AnyDesk'

$key = Get-ItemProperty @(
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
) -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -like "*$appName*" } |
    Select-Object -First 1

if ($key -and $key.PSChildName -match '^\{[0-9A-Fa-f-]+\}$') {
    $argLine = '/x ' + $key.PSChildName + ' /qn /norestart'
    Start-Process msiexec.exe -ArgumentList $argLine -Wait
    Write-Output ('Uninstalled: ' + $key.DisplayName)
} else {
    Write-Output ('No MSI uninstall entry found for ' + $appName)
}

Push it to one device from a remote session, or to the entire flagged group from the script runner. Either way, the action and its result are logged exactly where the alert was raised.

4. Keep Linux endpoints covered

# Debian/Ubuntu: full package inventory with versions
dpkg-query -W -f='${Package}\t${Version}\n' > /var/log/software-inventory.txt

# RHEL/Rocky/Alma alternative:
# rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n' > /var/log/software-inventory.txt

# Flag a specific package you do not allow
dpkg-query -W -f='${Package}\n' 2>/dev/null | grep -ix 'anydesk' && exit 1 || exit 0

5. Enforce version compliance, not just presence

Knowing an app is installed is half the answer; auditors want versions. This script fails closed when an endpoint runs an outdated version:

$appName    = '7-Zip'
$minVersion = [version]'24.08'

$key = Get-ItemProperty @(
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
) -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -like ($appName + '*') } |
    Select-Object -First 1

if (-not $key) { Write-Output ($appName + ' not installed.'); exit 0 }

if ([version]$key.DisplayVersion -lt $minVersion) {
    Write-Output ($appName + ' ' + $key.DisplayVersion + ' is below the required ' + $minVersion + '. Flagging for patching.')
    exit 1
}

Write-Output ($appName + ' ' + $key.DisplayVersion + ' is compliant.')
exit 0

6. Automate the entire loop

In AlertMonitor: schedule the audit scripts weekly per device group, route exit code 1 into alerts, let those alerts auto-create helpdesk tickets, and remediate from the same console with patch management or a remote session. Every step lands on one timeline per device.

When the next DSAR, client questionnaire, or — worst case — class-action letter arrives, the answer is a report you already have, not a three-week fire drill.

The Bottom Line

Grindr did not get to a £26M settlement overnight. That number is what it looks like when an organisation cannot account for what third-party software does with its data — discovered years after the fact, at class-action scale. Your defence is boring and effective: know what is installed on every endpoint, keep that inventory current, patch it, and keep the evidence in one place. That is exactly what a unified RMM is for — and exactly why bolting yet another console onto your stack is the wrong answer.

Related Resources

AlertMonitor RMM & Remote Management AlertMonitor Platform Overview Book a Demo RMM & Remote Management Resources