Security at Enforce
Enforce sits inside your employees' browsers, so you should know exactly what it collects, where it goes and who can see it. This page answers that.
What Enforce collects
- Block events: the destination, the rule or category that blocked it, the user, the device and the time.
- Browsing and behaviour data used for reporting and the browser security score.
- Download decisions: file name, detected file type, the check that fired and the decision.
- Browser posture: browser version, update state, security settings and installed extensions.
- Session information only when an admin has enabled session detection and recorded an acknowledgement.
What stays on the device
The threat list ships down to the browser, so known bad destinations are checked locally. Browsing history is not sent to a cloud service to be checked against the list.
Where data is stored
- SaaS: an Enforce managed instance.
- On-premises: inside your own data centre or private cloud.
How long data is kept
| Data | Retention |
|---|---|
| Block history | 12 months |
| Browsing and behaviour data | 3 months |
Who can see it
- Strict tenant separation enforced in the database itself.
- Admin roles: owner, admin and read-only.
- Two factor authentication required for admin accounts.
- Every admin action recorded in the audit log with the action, target, admin and source address.
Deployment and integrity
- The extension deploys through Group Policy or device management.
- The agent ships as a signed installer for Windows, macOS and Linux and runs as a service that restarts itself.
- Policy is applied through a locked default that cannot be switched off on one machine.
Reporting a vulnerability
Email [email protected] with details and steps to reproduce.