A security product has to earn more trust, not less.
Browser extensions ask for powerful permissions. Here is exactly what ByteMantle does with them.
How the extension works with your data
- Detection is local. Pages, clipboard writes and network requests are analysed inside your browser. Protection works offline.
- You choose whether to connect. On the welcome page you decide. If you keep everything on the device, events stay in your browser’s local storage, where you can view, export or delete them.
- If you accept, a short record of each detection goes to the console the browser is connected to — the shared console for installs without an account, your free account’s console or your organisation’s (see the table below). You can sign out or disconnect at any time in Settings.
- Domain age is looked up by the console the browser is connected to, which sends only the domain name to public RDAP and WHOIS registries — never the page or who opened it.
- Smart-contract lookups (Web3 intelligence) send only a contract address or function selector to public verification services.
When a browser is connected to a console
| Sent to your organisation’s console | Never sent |
|---|---|
| Security events: type, severity, action, rule IDs, MITRE techniques, time | Your browsing history (except the site-by-day record of the optional site technology telemetry) |
| The page address where the event happened, without anything after “?” or “#”, and the sites that led to it: the search engine, mail service or site you came from and the redirects in between (site names only); which script on the page loaded another script (address and path) | Passwords or form contents |
| The evidence of the detection (for example the harmful command a page put on the clipboard), bounded in size, and its SHA-256; an organisation can switch the evidence text off | Clipboard contents that were not flagged as malicious |
| Device health: extension version, queue size, heartbeat, and the number of pages and interactions (counts only) | Cookies or session tokens |
| Optional, off by default: resource telemetry for investigations | Anything from pages you visit without a security event, unless your organisation turns on one of the two optional telemetries on the left |
| Optional, off by default, Enterprise organisations only: site technology telemetry — what the sites you open say about their own software (server and framework names and versions, cookie names, CMS, plugin and library versions, missing security headers) and on which day your browser opened each site | Cookie values, page text, addresses beyond the site name |
How long it is kept: each organisation sets its own periods, within its plan. By default, the raw resource telemetry is kept one day and its summary (which pages loaded which resources) 90 days; security events follow the plan’s retention.
Signing in to the console: failed attempts are recorded in the organisation’s audit log with the address they came from, accounts are locked for a short time after repeated wrong passwords, and an organisation can allow sign-in only from its own networks or countries.
Wallet requests: when a site asks your wallet to sign something, the extension records only what was asked (the kind of request, the spender and the token contract addresses, the network). It never sees your keys or seed phrase, and it never changes or blocks the request — your wallet still asks you.
Domain age: the age of a domain is looked up by your console, not by your browser; when our feed of newly registered domains already knows a domain, no outside service is asked at all.
With a personal account, we are the controller (see the privacy policy). With an organisation’s console, the organisation is the controller and we process the data on its behalf under our data processing agreement. When we host the console, data is stored in the European Union. You can also run the console on your own server. More: GDPR at ByteMantle.
How we keep data to a minimum
- Addresses without their secrets: the page address of an event is sent without anything after “?” or “#” (parameters, tokens, search terms), unless your organisation chooses full addresses; where you came from and the redirects before a page are host names only; the scripts that loaded other scripts are their address and path, never the parameters.
- Cookie values never leave the browser. Site technology telemetry records cookie names and flags, never their content.
- Evidence under your control: the evidence text of a detection can be switched off by your organisation; its SHA-256 always stays, so the same command is still recognised across devices.
- Your SIEM gets a minimised copy: events forwarded to Splunk, a CEF collector or a webhook carry the evidence as a SHA-256, never as text.
- Exports for an AI assistant can be masked: user names, device names, host names, e-mail addresses and URL parameters are replaced; the evidence is included only if you choose.
- Sharing threat intelligence without sharing people: STIX exports pseudonymise devices by default; attacker infrastructure seen by several organisations is shown to us only as counts or as anonymous organisations, and an organisation can switch this sharing off.
- Optional telemetry stays off until your organisation turns it on: resource telemetry and site technology telemetry are policy switches, never a user option.
What we send is still personal data in the sense of the GDPR when it relates to your people — minimised and pseudonymised, not anonymous. That is why each organisation decides what is collected and for how long.
This website
- No cookies, no analytics, no advertising or social trackers.
- Fonts and scripts are served from this domain — no third-party requests.
- Your theme choice is stored only in your browser.
- The contact form sends your message by email to us; nothing else is stored except a short-lived, hashed rate-limit counter.
Vulnerability disclosure
If you find a security issue in the extension, the console or this website, please email info@bytemantle.com. Include steps to reproduce and the affected version. We acknowledge reports within three business days, keep you informed, and credit researchers who want to be credited. Please do not access other users’ data, degrade service, or publicly disclose before a fix is available. Our security.txt has the same details.
Questions
Privacy questions: dpo@bytemantle.com. Full details are in the privacy policy.