Trust and GDPR
Last updated 20 October 2026
For data protection officers, IT and procurement: who processes what, where it's kept, the services we use, and how Browser Rules fits with GDPR and works councils.
Browser Rules checks downloads, uploads, websites and the clipboard inside the browser, so very little leaves it.
Who is responsible for what
- Your organisation is the controller of the information your browsers send to the admin console: the audit log, enrolled browsers and their users. You decide, in your Privacy settings, how much detail is sent.
- We are your processor for that information. We process it only to run Browser Rules for you, as your instructions and our terms say.
- If an IT provider manages Browser Rules for you, it’s our customer for your organisation and uses us as its sub-processor, under its own agreement with you. You’re still the controller. You can take over your organisation at any time, and then you’re our customer directly.
- We are the controller for admin console accounts and, once paid plans launch, billing. Our privacy policy covers those.
- The provider is ProCo-STS Limited, trading as ProCo IT, a company registered in England and Wales (company number 05054551), Higher Buckland Farm, Farm Lane, Buckland St Mary, Chard, Somerset TA20 3QZ, United Kingdom.
Data processing agreement
Our Data Processing Agreement (GDPR Article 28) is part of our Terms of Use, so you accept it when you sign up.
What is processed
| Information | What it includes | Can you limit it? |
|---|---|---|
| Audit events | What a policy blocked, warned about or recorded: when, the file or website, the policy and why. Depending on your Privacy settings: the user’s email, the page and download addresses, and up to 80 characters of copied text that matched a malicious command. Changes made in the admin console, and who made them. | Yes: choose a privacy level, from websites only to full detail, or each detail. “Most private” sends no user names. |
| Enrolled browsers | The browser and its version, the operating system, the device’s name if your device management sets it, and the person using it. | The device name is optional. |
| Admin console accounts | Email address, sign-in details (passwords are stored only as salted hashes), two-factor settings, and which of our emails they chose. | |
| Never sent to us | File contents (files are checked inside the browser), what people type, keystrokes and mouse movements. A website visit is recorded only when one of your policies says to. |
Recording every download, or every upload, stays off unless you turn it on.
Where data is kept
- The admin console, its database and the browser API run on Microsoft Azure in the UK South region (London).
- Data is encrypted in transit (TLS, HTTPS only) and at rest, backups included.
- Access to each organisation’s data is restricted through organisation-scoped authorisation and data queries.
Services we use
Very few services handle your organisation’s data. They’re listed first. The second list is the services we use for our own data: admin console accounts, our email and this website.
For your organisation’s data (sub-processors)
Here we’re your processor, and these services are our sub-processors.
| Provider | What it does for Browser Rules | Where | Transfer safeguard |
|---|---|---|---|
| Microsoft Azure (Microsoft Limited) | Hosts the admin console, the browser API and the database, and monitors them for errors and performance (Application Insights) | UK (London) | Your data is stored in the UK. Any access from elsewhere, such as by Microsoft’s support, is covered by Microsoft’s standard contractual clauses and the Data Privacy Framework |
| Cloudflare (Cloudflare, Inc.) | Sits in front of the browser API, so browser traffic passes through it on its way to Azure | Global network | EU-US Data Privacy Framework and its UK Extension, with standard contractual clauses as the fallback, across its whole network |
Last changed: 20 October 2026 (first published).
Before a new service starts handling your organisation’s data, we email everyone with an admin console account, at least 30 days ahead, and update this list. These are service emails, so they can’t be turned off. To object, reply to that email. If you don’t have a console account, for example because an IT provider manages Browser Rules for you, email [email protected] and we’ll tell you about changes too.
For our own data
Here we’re the controller: admin console accounts, our emails, support and this website. These services never receive your organisation’s browser data.
| Service | What it does | Where |
|---|---|---|
| Microsoft Azure | Hosts admin console accounts, with the rest of the console | UK (London) |
| Twilio SendGrid | Sends the console’s emails: invitations, email confirmations, password resets, and our emails to console members | United States (Data Privacy Framework, UK Extension) |
| Microsoft 365 | Our email, including support@ and security@ | UK and EU |
| Crisp | Live chat on this website, only after you accept its cookies | France (EU) |
| Cloudflare | Hosts this website | Global network |
| jsDelivr | Delivers parts of the admin console’s pages, so it sees your IP address | Global network |
| iubenda | Hosts our privacy policy | Italy (EU) |
| Paddle | Takes payments for paid plans, as our reseller, once they launch | United Kingdom |
Neither list includes the Chrome Web Store, which delivers the extension, or Have I Been Pwned, which the console asks about new passwords using only the first five characters of the password’s hash. They receive nothing about you or your users.
International transfers
Your data is stored in the UK. The European Commission recognises the UK’s data protection as adequate (renewed in December 2025, until December 2031), so data from customers in the EU comes to the UK without extra safeguards.
Microsoft keeps your data in its London data centres. Any access from elsewhere, such as by its support staff, is covered by its standard contractual clauses and the Data Privacy Framework.
Cloudflare and Twilio SendGrid, in the United States, are certified under the EU-US Data Privacy Framework and its UK Extension, which covers transfers to them. Their agreements with us fall back to standard contractual clauses if that certification ever lapses. If any safeguard we rely on is struck down, we move to another without undue delay and tell you. Ask us for a copy of the safeguard for any service.
How long data is kept
- Audit events: 30 days on the Free plan, a year on paid plans, then deleted automatically.
- Enrolled browsers and their users: until your organisation removes them.
- Backups: 35 days, then gone.
- Deleting your organisation: an owner can download a copy of its data, then delete the organisation and everything in it, in All settings, Organisation. Backups expire within 35 days.
- If we end your service (for example, under our Terms of Use): owners can have a copy for 30 days, then the data is deleted. Backups expire within 35 days after that.
- Deleting your own account: your account goes, and your organisation keeps its data. The last owner of an organisation makes someone else an owner, or deletes the organisation, first.
Requests from your users
As the controller, your organisation answers requests from the people using your browsers, such as a request for their data. We’ll help: the audit log can be searched by user, and enrolled users can be removed from the admin console. Contact [email protected] for anything else.
Works councils and employee monitoring
In many countries, a tool that looks at how staff use their browsers needs the agreement of a works council or employee representatives. Browser Rules is designed for security, not for watching staff, and is built to make that conversation easy. What you choose to record can still show browsing activity, so it belongs in that conversation:
- Checks happen on the computer. Files and what people type are never sent anywhere.
- Only what policies act on is recorded: a blocked download, a warning, a recorded visit. An Audit policy can record visits to the websites you choose, even every website, and that is browsing activity: record only what you need.
- No productivity features: no screenshots, no time tracking, no activity scores.
- You choose the detail, down to websites only with no user names (“Most private”).
- People can see it’s there. Messages carry your organisation’s wording, the extension’s toolbar button shows who manages it, and its settings page shows the policies in effect on that browser and what it recorded.
- Access is controlled. Read-only roles, two-factor sign-in for everyone, and our support team can open your admin console only when you allow it, for a set time. Otherwise our staff see only the account details needed to run the service: your organisation’s name, plan and limits, how many users, browsers, members and policies it has, and the email address, role and sign-in settings of each member and person invited.
Points a works agreement can settle:
- The privacy level, and whether names are recorded.
- Whether every download or upload is recorded.
- Which websites, if any, have their visits recorded.
- Who has access to the admin console, and with which role.
- Whether people may pause protection on a website for a while, giving a reason.
- How staff are told about Browser Rules and its policies.
- That events are used for security, not to assess performance.
If you carry out a data protection impact assessment (DPIA), this page and our DPA give you the facts for it. We’ll answer any questions it raises.
Security
How we protect your data, and how to report a security issue: Security.
Contact
Questions about data protection: [email protected].