Privacy policy

Last updated: 26 October 2026

VigilSpan provides a browser security service for organisations: a browser extension for Google Chrome, Microsoft Edge, Brave, Firefox and other Chromium browsers, a dashboard for each customer organisation, and the cloud service that connects them. This policy explains what data we handle, why, and how it is protected. Contact: [email protected].

1. Our website

This website does not use cookies, analytics or third-party trackers. When you submit the "Request access" form we receive your name, work email, company, and optionally your role, company size and message. We use them only to reply to you and set up your organisation. We keep requests that don't become customers for up to two years. Our hosting providers keep standard server logs, including IP addresses, for security.

2. The VigilSpan service

The extension is installed by an organisation (our customer) on browsers it manages. For that data the customer decides what is collected through its policy, and we process it on the customer's behalf. If you use a browser managed by your employer, please also read your employer's policies.

What the extension does on the device

It analyses the pages you open (address, content and behaviour) inside the browser to detect attacks. These checks happen on the device. Page content is not sent to us for this.

Some phishing pages draw their sign-in screen or their instructions as a picture so there is no text to check. When a page looks like that (mostly images, little text, and a login box or a fake CAPTCHA), the extension takes a screenshot of the visible part of that tab and reads the text in it with OCR on the device. The screenshot is never saved and never leaves the browser; only the result of the check (for example "phishing page blocked") is reported, like any other alert. Your organisation can turn this off.

If your organisation turns on logo recognition (it is off by default), the extension also takes a screenshot of the visible part of a tab that shows a login box on a site it doesn't recognise, and compares the logo above the login box with the logos of commonly impersonated companies (for example Microsoft or Google), on the device. The screenshot is never saved and never leaves the browser; only the result is reported.

What is sent, and who can read it

• Security alerts (for example a blocked phishing page or download) and, only if your organisation turns it on, browsing history. These are encrypted in the browser with your organisation's public key before they are sent. We store them but cannot read them; only your organisation's administrators hold the key. A few unencrypted fields are needed to route and count alerts: alert type, attack category, severity, verdict, action taken, device and time. Alerts include the choices you make on a warning: when you continue past a block (with the reason you give), when you ask your IT team to review a block (the page address and any note you add), and when you choose to use your work password on a site that isn't approved for it (the site, never the password).
• Threat-intelligence updates: the extension regularly downloads signed threat updates from our servers. These requests contain no browsing data. A browser that isn't connected to an organisation downloads the same public update as everyone else, about once an hour. So that updates arrive within seconds, Chrome and Edge also register a push address with their browser vendor's push service (Google or Microsoft); we store that address and use it only to signal that a new update is available. The signal itself carries no content.
• Device and enrollment data: a device identifier, a device name, extension version and when the device was last seen.
• Optional reputation look-ups, if enabled by your organisation: a domain (or URL, if your organisation chooses) is checked against the third-party reputation services your organisation turns on (for example VirusTotal, Google Web Risk or Safe Browsing, abuse.ch, AlienVault OTX or IBM X-Force), through our servers, using your organisation's own accounts with them. Only look-ups are made; nothing is submitted for scanning. Never for incognito windows.
• Optional AI analysis, if enabled by your organisation: for pages the extension finds borderline, a trimmed snapshot (address, title, form details and, depending on the policy, page text and script excerpts) is sent through our servers to the AI provider the organisation chose. If the organisation also allows it, the snapshot can include a screenshot of the visible part of the page, never of incognito windows. That provider may be one the organisation contracts directly. We don't keep the snapshot.
• Password-reuse protection, if enabled: a short, keyed fingerprint of your work password stays on the device, made with a key that can't be read out of the browser; it can't be turned back into the password. Passwords are never sent anywhere. A browser removed from its organisation deletes it.

Data shared with VigilSpan to improve protection

Unless your organisation switches sharing off, we receive: the domain or address (never query strings or fragments) of pages the extension identified as clear attacks; when someone continues past a block, the reason they gave and the page address without query string; and suspicious or malicious AI verdicts about a page, with the AI's reasons. These are never linked to a person or device. Our team can see which organisation sent a report, so we can follow up on false positives; other customers never can. Confirmed attack sites may be added to the threat intelligence we send to all customers, without saying who reported them.

Requests your administrators send us

Administrators can send us requests from their dashboard: a custom detection rule to review, an integration they'd like, or a page they found wrongly blocked. We receive what they type or choose, including the page address (without query string) for a wrongly blocked page, and the sending administrator's email address. Nothing from encrypted alerts is included.

3. How long we keep data

• Browsing history and AI scan logs: 90 days
• Security alerts: 365 days
• "Continue anyway" feedback and shared AI verdicts: 180 days
• Requests administrators send us: while the organisation is a customer
• Website access requests that didn't become customers: 2 years

Customers can ask us to delete their organisation's data at any time. When a contract ends, we delete it.

4. Security

Data is encrypted in transit (TLS). Customer alert and history content is additionally end-to-end encrypted as described above. Administrator accounts require two-factor authentication. Policies are signed by the customer's own keys, and our threat intelligence is signed. To report a vulnerability, see security.txt.

5. Where data is processed

Our service runs on Amazon Web Services in the Asia Pacific (Mumbai) region, behind Cloudflare. AI analysis, when enabled, is processed by the provider the customer selects, in that provider's regions.

6. Your rights

Depending on where you are (including under India's Digital Personal Data Protection Act and the EU/UK GDPR), you may have rights to access, correct or delete your personal data, or to object to its use. If your data reaches us through your employer's use of VigilSpan, contact your employer first. We will help them respond. For anything else, write to [email protected].

7. Changes

We'll update this page when our practices change and change the date at the top. Customers are told about material changes in advance.