FAQ

Frequently asked questions

Everything you might want to know about agentless, CSP-based browser malware detection. Still stuck? Reach out.

Privacy & data

Do you monitor what your employees browse?: No. We only receive the CSP violation reports your own app generates, essentially the address of a script or connection the browser blocked. We never see browsing history, page contents, keystrokes, or anything your people do on other sites. This is not an employee-monitoring tool.
What data do you store, and for how long?: For each report we keep the raw CSP payload, its content type, the reporting browser's IP address, and a timestamp, plus any resulting detections. We do not store your users' request headers. Raw reports and their associated IP address are automatically purged after 30 days.
Where is my data stored?: In a managed database hosted on Supabase, in the us-east-1 region. Reports reach us over an encrypted HTTPS connection and are encrypted at rest.

How can you detect malware without installing anything?: Your app already sends a Content Security Policy header, and every browser enforces it and automatically reports the resources it blocks. We check those blocked hosts against commercial threat-intelligence sources and our own independent research into the browser-extension ecosystem. Nothing is ever installed on a device.
What do I need to change in my app?: One simple config change: point your CSP report-to / report-uri directive at the endpoint we give you. There is no SDK to embed and nothing to deploy.
Will this break my existing CSP reporting?: No. If you already forward CSP reports somewhere, set that as your upstream URL and we relay the original report to it unchanged, so your current pipeline keeps working.

What exactly do you flag?: CSP violations showing that a browser attempted to load a resource from, or send a request to, a known malicious host.
How am I notified of a detection?: Detections show up in your dashboard and are delivered to any webhook you configure, so you can route them straight into your existing security tooling.
Can I allowlist a host to avoid false positives?: Yes. Add any known-good host to your allowlist from the dashboard and we will never flag reports involving it. An entry also covers its subdomains, so allowlisting example.com covers cdn.example.com too.

Does this replace my EDR or WAF?: No. It is complementary. It covers a blind spot those tools cannot reach: what actually runs inside the browser. And because there is nothing to install on the endpoint, it can even catch compromised devices that have no EDR on them at all.
Can it run inside my own network?: If your users are on a network that restricts outbound connections, we can provide a lightweight proxy that runs inside your network and forwards reports to our detection backend. Get in touch if that is a fit for you.