Offscript Security
FAQ

Frequently asked questions

Can’t find your answer? Ask us.

Privacy & data

Do you monitor what your employees browse?
No. We only get the CSP reports your own app sends, which are basically the address of a script or connection the policy didn't allow. We never see browsing history, page contents, keystrokes, or anything people do on other sites. This is not an employee-monitoring tool.
What data do you store, and for how long?
For each report: the raw report, its content type, the IP address of the browser that sent it, and when it arrived. We also keep any detections, with the address of the page (without its query string) and the IP addresses of the browsers that reported the malicious URL, so you can find the affected devices. We don't store request headers. Raw reports and their IP addresses are deleted after 30 days. For the IP addresses on detections, you choose: keep them, delete them after a set number of days, or delete them as soon as the alert is sent. Anything we delete stays in our nightly backups for up to 15 more days.
Where is my data stored?
In a managed database on Supabase, in the us-east-1 region. Reports reach us over HTTPS and are encrypted at rest. Nightly backups of that database are stored encrypted in Google Cloud Storage, in the us-central1 region.

Setup & how it works

How can you detect malware without installing anything?
Browsers already support Content Security Policy reporting. When a page loads a script or opens a connection its policy doesn't allow, the browser sends a report to the URL in the policy. We receive those reports and check each URL against several threat-intelligence sources. Nothing is installed on any device.
What do I need to change in my app?
Add one response header: a report-only CSP that sends reports to us. Your dashboard has it ready to copy. If you already have a CSP, it's a copy of your policy with our URL added. If you don't, use the starter policy from the dashboard. No SDK, no code changes.
Why a report-only header, even if I already enforce a CSP?
Some malicious extensions delete your enforcing CSP header before the page loads, so the browser never sees a policy and never reports anything. The ones we've looked at leave the report-only header alone. A report-only header also never blocks anything, so it can't break your app. Keep enforcing your policy as you do today. Just don't put our URL on both headers, or you'll get every report twice.
I don't have a CSP. Can I still use this?
Yes. Use the starter policy from your dashboard. It only watches scripts and connections, so images, styles and fonts don't generate reports. It allows your own domain and inline scripts. Add the other domains your app loads scripts from or talks to, or add them to your allowlist.
Will this break my existing CSP reporting?
No. Set your current collector as your upstream URL and we forward every report to it unchanged.

Detections & alerts

What exactly do you flag?
A script load or connection to a URL that at least one of our threat-intelligence sources reports as malicious: malware, phishing, or infrastructure named in threat reports. We check several sources and flag as soon as one of them reports it. You can allowlist any host you know is safe.
How am I notified of a detection?
On your dashboard, by email, in a Slack channel, and through a webhook if you set one up. Emails go to the addresses you list on the dashboard. If you haven't listed any, they go to the contact address we captured when your organization was set up, if there is one. Email and Slack alerts go out within about 30 minutes of a device reporting a malicious URL. Each alert names the device's IP address and the page it was on. The same device won't trigger another alert about the same URL for 24 hours, but every new device does.
Can I allowlist a host to avoid false positives?
Yes. Add it on the dashboard and we'll never flag it. Subdomains are included, so allowlisting example.com also covers cdn.example.com.

Deployment & fit

Does this replace my EDR or WAF?
No. It covers what they can't see: what runs inside the browser. It also works on devices that have no EDR at all.
What can't it catch?
Anything that never touches your page. An extension that sends data out from its own background process doesn't trigger your CSP, so we never hear about it. A lot of real malware does run in the page, because that's where the data is, and that's what we catch.
Can it run inside my own network?
If your users’ browsers can’t reach the internet, we can give you a small proxy that runs inside your network and forwards reports to us. Get in touch if you need it.

Pricing & contact

How much does it cost?
Prices aren’t public yet. See the pricing page.
How do I get in touch?
Use the contact form. We usually reply within one business day.