Security model
Security review starts with five facts: browser-path visibility, extension permissions, proxy credential handling, retention, and the boundary between browser proxy and Layer-7 private app access.
On the browser-proxy path, BusinessProxy does not decrypt HTTPS page content. Private App Access, if enabled, is a separate Layer-7 reverse-proxy path with different visibility.
Data table
| Data type | Why | Retention | Shared with |
|---|---|---|---|
| Account email | Account, verification, billing and support. | While account is active, then according to account deletion/legal retention process. | Authentication, email and payment services as needed. |
| Device ID and public key | Bind proxy-session requests to a registered device key. | While account/workspace device record is active, unless removed. | Infrastructure services. |
| Proxy session ID | Connect, heartbeat, revoke and session history. | While account is active today; not deleted by the 30-day usage cleanup unless a deletion policy is added. | Infrastructure services. |
| Raw proxy credential | Not stored. Used only by the extension/proxy flow during the active session. | Not retained as raw value. | Not shared as raw value. |
| Proxy credential keyed digest | Validate random short-lived proxy session credentials. | Retained with the proxy session record unless implementation changes. | Infrastructure services. |
| Traffic volume / usage event | Limits, usage reporting and capacity planning. | 30 days for usage events. | Infrastructure services; payment and accounting services when needed. |
| Destination domain / category for blocked events | Filtering, abuse prevention and policy review. | 30 days for blocked events. | Local versioned category list; external vendor only if added later. |
| Workspace audit events | Accountable administration and security review. | 180 days. | Infrastructure services. |
| Admin/audit source IP | Admin security, fraud/abuse investigation and audit logs. | 180 days when stored in audit logs; raw service-log rotation is documented separately (~14 days). | Infrastructure and security services if used. |
| HTTPS page content on browser-proxy path | Not collected or decrypted on the browser path. | n/a | n/a |
Account login and proxy access use separate secrets. Proxy credentials are random, short-lived session secrets issued to the extension. BusinessProxy validates them with a server-side keyed one-way digest and does not store the raw proxy secret or reuse the account password.
BusinessProxy is built for accountable work browsing. The gateway applies plan limits, session caps, category/domain rules, restricted ports, private/internal network blocking and device-signed session requests. It is not an anonymity, scraping or restriction-bypass tool.
The browser extension declares one content-protection script. It supports configured protected-session controls such as dynamic watermarks, copy/print controls, download deterrence, screenshot friction and private-app page controls. It is not an advertising script, not an analytics script and not a tool for arbitrary page-content exfiltration.
Logging
Privacy-first by design: we enforce policy at the domain and network-metadata level (SNI/DNS) and do not decrypt HTTPS. The deliberate trade-off is that the browser-proxy path provides no in-session DLP, no malware scanning of encrypted payloads and no content-level inspection — it is access governance, not a content security gateway. This keeps contractor and BYOD personal data private while corporate endpoints stay aligned to domain/category policy. For content-level controls, pair BusinessProxy with endpoint EDR/DLP.
We run a Responsible Disclosure program. Report suspected vulnerabilities to the contact in our security.txt; we aim to acknowledge reports within 24 hours and keep reporters updated through triage and remediation. Please do not run intrusive testing against shared infrastructure without prior written approval.
BusinessProxy has two access paths, and they don't see the same things.
| Browser-proxy path (Layer 1) | App Gateway path (Layer 2) |
|---|---|
| Does not decrypt HTTPS page content. | Terminates and relays HTTP for the App Gateway path. |
| Sees domain/network metadata needed for routing and policy. | Relays HTTP method, path, headers and request/response bodies in transit. |
| Domain/category filtering only; no page DOM or form inspection. | Processes web-layer metadata for routing, policy and audit. |
| Page content is not logged or retained because it is not decrypted on this path. | Request/response bodies pass through in transit and must not be logged or retained. |
App Gateway operates at the web layer: selected app traffic passes through the gateway and connector while the browser-proxy path stays domain/metadata based.
FAQ
Not on the browser-proxy path. BusinessProxy enforces browser policy using domains, network metadata, category decisions and allow/deny rules. It does not decrypt HTTPS page content, read the page DOM, or inspect form fields on that path.
Filtering is domain/category based. The gateway applies a versioned category list and your allow/deny rules before traffic leaves through the approved egress region. This is not content/DLP inspection and should not be described as reading the page.
Browsers require broad host access so the extension can receive proxy-authentication challenges for routed requests and run the declared content-protection script where a protected session requires it. The extension does not use a tabs permission or arbitrary page scripting permission.
No. Account login and proxy access use different credentials. Session credentials are random and short-lived. BusinessProxy validates them with a server-side keyed one-way digest and does not store the raw session credential or reuse the account password.
Yes, outside the managed browser path. On an unmanaged device, a user can use another browser, another unmanaged profile, or remove/disable the extension. If bypass prevention matters, validate the browser package through customer-managed browser or device policy before rollout.
See the security data table as the source of truth. Usage and blocked events are retained for 30 days, workspace audit events for 180 days, and proxy session records remain while the account is active unless a deletion policy is added.