Embodiments of the present invention provide for flexible monitoring of content. The content at a client device can be monitored based on the use and actions performed by the client. In order to monitor the content at the client, a dependency is created between any recipient of the content and a monitor installed at the client device. For example, the content may be encrypted and, when the content is accessed by a potential recipient, the recipient may be required to request a key from the monitor. This activates the monitor to begin recording transaction data and events about the content's use, such as the recipient's identity and the type of actions performed. The monitor can be configured to passively monitor and record the use of the content at the client's device. In addition, the monitor can be configured to provide audit data that indicates the transaction data recorded to a server.