Browser Extension Privacy

The Porcia browser extension adds usage and security context for applications that may not appear in your identity provider. This page describes the data categories and controls at a customer-relevant level.

​

Privacy-first design

​

What the extension can detect

Depending on the controls enabled for your workspace, the extension can provide categories such as:

• Domain-level SaaS login and authentication activity
• Whether a work account was used for an application signal
• Installed browser-extension inventory and its deployment context
• AI-tool usage and related security signals
• File activity or sensitive-data warnings where the corresponding control is enabled
• Password-health signals, such as strength or reuse across sites, without sending password values
• API-key, OAuth, or shared-account risk signals
• Sync status, timestamps, and device/enrollment context

The available categories depend on workspace policy, extension version, and browser support. The extension does not provide a general recording of everything a person does in the browser.

​

Settings your workspace controls

• Sign-in addresses. By default only whether a work account was used is recorded. If your workspace turns on shared-account detection, the sign-in address is also collected and stored encrypted.
• AI prompt evidence. AI prompts and uploads are checked on the device. By default only the types and counts of sensitive data are reported. Workspaces can choose to also keep masked examples, and optionally the prompt text with every detected value masked. Full sensitive values are never kept.
• Leaked-password check. When this check is on, the extension asks the public Have I Been Pwned service whether a password has appeared in a known breach. The password is hashed on the device and only the first five characters of that hash are sent, so neither Porcia nor the service can learn the password. The result is checked on the device.

​

What the extension does not collect

• Full page URLs. Signals are reported at the domain level.
• General page content or HTML
• Keystrokes or mouse movements
• Password values or authentication secrets
• A complete personal browsing history
• Bookmarks, cookies, or advertising data
• Screenshots or visual recordings

Common consumer sites are excluded from app discovery, and browser privacy settings can further limit detection.

​

How data is handled

1. The extension detects supported signals locally in the browser.
2. Exclusion, pause, and workspace-policy checks are applied. Nothing is kept while detection is paused.
3. Only the enabled signal categories and required context are prepared for synchronization.
4. Data is sent periodically when the extension is connected. Signals captured offline are kept on the device, up to a limit, until the connection returns.
5. Porcia uses the resulting application-level and security context in the workspace views where the related feature is enabled.

The extension is not a real-time recording tool, and the exact synchronization timing can vary with browser state, policy, and connectivity.

​

Privacy controls

​

Pause detection

Where your workspace allows it, pause detection from Porcia. Managed deployments may not offer pause.

​

Excluded sites

Common consumer sites are excluded automatically.

​

Incognito mode

Detection in private browsing is off by default. It can be turned on through the browser’s own extension settings or your organization’s browser policy.

​

Managed deployment

Workspace administrators may manage installation, enrollment, and policy controls through supported browser-management tools. Users should contact their workspace administrator about organization policy or opt-out questions.

​

Data storage and deletion

The extension stores its settings, pending signals, and limited on-device security state needed for detection. Porcia stores the enabled application and security-signal categories needed to provide the configured workspace features. Retention and deletion follow the applicable workspace, privacy, and product policy. To request access, export, or deletion, use the supported workspace controls or contact [email protected]. Uninstalling the extension stops future collection from that device. Historical workspace data is managed separately through the workspace’s data-management process.

​

How Porcia uses the signals

Extension signals help teams:

• Find SaaS and Shadow AI tools outside the identity provider
• Compare application activity with assigned access
• Identify browser-extension and account risks
• Prioritize findings and governance review
• Understand organization-level usage patterns

Individual-level visibility is controlled by workspace roles and data scope.

​

Common privacy questions

​

Privacy and security contacts

For privacy, export, or deletion questions, contact [email protected]. For security concerns, contact [email protected].

​

Next steps