What leaves the browser, and what does not.

Our rule: send what an investigation needs, nothing more

• Page addresses without the private part. An event's address is sent without what follows "?" or "#" — no tokens, no search terms — unless your organisation chooses full addresses.
• Where a visit came from, as host names. The source of a visit and its redirects are kept as host names, not full addresses.
• Cookie values never leave the browser. At most the name of a cookie, when it tells which software a site runs.
• Evidence can be switched off. The evidence of an attack — for example the command a page put on the clipboard — can be switched off by your organisation. Its SHA-256 fingerprint stays, so the same attack is still recognised across devices.
• Minimised copies for other systems. Your SIEM receives the evidence only as its fingerprint, and an export for an AI assistant can mask user names, device names, e-mail addresses and address parameters.
• Optional telemetry is off until your organisation turns it on — the resources pages load, and the software of the sites your people use.
• Across organisations, only counts. When the same attack appears in several organisations, others see a count, never who you are; your organisation can opt out.

What we do not promise

Data about your people that is minimised and pseudonymised is still personal data under the GDPR. We do not call it "anonymous". That is why each organisation decides what is collected and for how long, why every export is recorded in the audit log, and why the console runs in the European Union or on your own server.

What to ask any vendor

1. Which fields leave the device for each kind of event?
2. Are page addresses sent in full, with their parameters?
3. Can we switch off the evidence and keep detection working?
4. What does the SIEM copy contain?
5. Where is the data kept, and can we host it ourselves?

If the answer is "we see nothing", ask again. Our full answers are on the Trust & Privacy page.