If they own the laptop, they can request you to install anything they want on it, including spyware. If it's your own laptop, you don't have to do that. That'

If they own the laptop, they can request you to install anything they want on it, including spyware. If it's your own laptop, you don't have to do that. That's yours, not their property. They can provide you with one configured as they request, or provide it and ask you to configure it that way. Or you could set up a VM for it. Corporate spyware is kinda common nowadays. It's mildly annoying but mostly unlikely to be a problem in many/most places. Mostly just there to deal with problem situations. And you mention that your client wants SOC 2 certification - chances are they'll never actually bother hiring someone to watch what you do on your computer, they just want to be able to check off a box on a form that says "yeah we do this, and all our employees have this thing installed, so we have central control of our data." to get the certification. Because that's what it's about. But also it's just bureaucracy, and probably just checking that box is all they care about so they can tell their clients/customers that their solution is officially certified safe. A lot o' stuff like that is driven by, and ultimately, just feature checklists.