Privacy Policy — Protecio Guard

In short

• Everything is analyzed on the device. The content of pages, prompts, forms and files never leaves the browser.
• Nothing is transmitted before you activate Guard and the browser is linked (enrolled) to your organization's Protecio Engine.
• What is transmitted, and only when a decision is made: decision metadata — domain, recognized destination (catalogue identifier, or “browser”), detected category, action applied, severity, control identifiers, content size and an HMAC fingerprint specific to the installation. Never the text, never the detected value, never the full address.
• The recipient is your organization, which is the data controller. The Protecio Engine that receives this metadata is hosted and operated by Protecio on the organization's behalf (online offering), or by the organization itself on its own infrastructure. In the first case, Protecio acts as the organization's service provider and does not use this data for its own purposes.
• Protecio does not sell the data, and does not use it for advertising, commercial profiling or credit scoring.

What the extension analyzes, and where

Local analysis applies to the input fields of AI assistant sites, to web email composers (Gmail, Outlook) and to the composers of Teams, Google Chat and Slack. The list of recognized AI assistant sites is carried by the organization's signed policy (Protecio base catalogue, which the organization can extend with its own assistants); when no policy has been received, the extension applies the built-in base list.

The Copilot pane embedded in the Office web applications (Word, Excel, PowerPoint) is recognized as one of these surfaces: it is a frame served by Microsoft in which only the assistant's input field is analyzed, never the open document.

Recognizing a site is a local operation that produces no transmission by itself. The extension also recognizes, from the page's behaviour, an input field that presents itself as an AI assistant's without the site being on that list: generic labels on the field and its buttons (“prompt”, “AI assistant”, “send”…), the presence of a response area, the shape of the requests the page emits (when exfiltration observation is active) and resources loaded from a known AI provider. This recognition relies on no brand list; on such a page, Prompt Shield observes without ever interrupting — no card, no block, no warning — and files there are neither read nor held back; only an observation decision may be recorded, with the metadata described below.

On these surfaces the extension also observes the nature of the action (sending an email, posting a message, delegating to an AI agent) in order to apply the organization's signed policy; this observation is local, and only the resulting decision — never the text — may be transmitted in the metadata described below.

The signed policy may also name SaaS sites (for example a file-sharing service, or a portal specific to the organization): on these sites the extension recognizes the destination from the page's hostname and path — a local operation that produces no transmission by itself — in order to apply the setting the organization chose for file uploads to that destination (observe, warn or block).

On every page

Some analyses run on every page visited — which is why the extension requests access to all sites. They are local and produce no transmission by themselves:

• the assessment of the page's address and transport (encryption, internationalized domain name, IP address used as identity, brand impersonation) and the detection of manipulation tactics in the visible text, which feed the site's trust notice;
• the recognition, from the page's behaviour, of an input field that presents itself as an AI assistant's outside the sites named by the catalogue (described above);
• the detection of AI providers whose resources a page loads (“AI manifest” capability, when enabled);
• the analysis of forms that ask for a password and of the destination they are sent to (“Form Guard”, off by default), and of links on search engine result pages (“Links”, off by default);
• the observation, in the page context, of outgoing requests (fetch, XHR, sendBeacon) for sensitive patterns in their body; this signal is treated as untrusted, bounded, and stays on the device — it is never transmitted.

The controls that block, warn or redact (Prompt Shield, file uploads, site blocking) apply only to the surfaces and destinations described above, and a transmission happens only when an active capability makes an enforcement decision, or records a discovery observation described below. Ordinary browsing — visiting a page, reading, searching — produces no transmission.

Discovery of AI surfaces

When the “AI manifest” capability is active and a page absent from the organization's catalogue behaves like an AI assistant (at least two concurring families of cues, or all three cues from the page itself), the extension records it locally and, after enrollment, may transmit it to the organization under the reason ai_surface_discovered (low-severity alert).

This record carries the page's hostname and, under the attribute ai_surface_hints, the list of cues that fired, drawn from a closed enumeration of six values:

It carries neither the typed text, nor the full address, nor the body of any request. At most one record per domain, per day and per device. Two things differ from the other decisions described here, and are stated for that reason: this record is the only one to carry an attribute, and the set of domains it can name is no longer bounded to catalogue sites and flagged sites — it can name any site on which these cues concur. It serves a single purpose: letting the organization's administrator add the assistant to its catalogue (or ignore it) in the Control Center. Turning off “AI manifest” stops this discovery; the extension then keeps observing locally, transmitting nothing on that account.

What stays on the device

The extension keeps locally, in the browser's storage:

What may be transmitted, to whom, and when

When. Only after activation and enrollment, and only when an enforcement decision takes place.

To whom. To the user's organization's Protecio Engine — hosted and operated by Protecio on its behalf (default address enter.protecio.com), or by the organization itself when it has deployed its own Protecio Engine. The organization is the data controller; Protecio, when it hosts, is its service provider. Transport uses HTTPS.

What. The following metadata: the domain; the recognized destination, that is the identifier of the site in the catalogue the extension applies — the one from the organization's signed policy (for example dropbox or microsoft-copilot-office) or, when that policy names no AI assistant, the one from the built-in base list (for example openai); outside these sites the value stays browser, and the set of identifiers is closed; the detected category, action applied, severity level, control identifiers, content size and an HMAC fingerprint specific to the installation; and, for the single reason ai_surface_discovered, the attribute ai_surface_hints described above. This data is used exclusively to apply security policies, display the protection state and give the organization a decision trail.

Never. The raw content analyzed, passwords, files, detected values, the name of an inspected file, the full address of a blocked page.

Protecio does not sell the data, does not use it for advertising, commercial profiling or credit scoring, and does not transfer it to third parties except to the subprocessors expressly designated by the organization to operate its Protecio Engine.

Enrollment through “Connect to Protecio”

This button opens an authentication page in a browser window. On a managed device whose organization has configured the address of its Protecio Engine (managed policy), that page belongs to that Engine — hosted by Protecio for the organization, or deployed by the organization itself. Otherwise it is the page of Protecio's central Protecio Engine (enter.protecio.com), operated by Protecio, which then attaches the device to its organization.

Identity is confirmed by Microsoft on that page — the extension neither sees nor keeps any password and reads no data from the browser's Google account. What is exchanged during enrollment: the OAuth authorization code and, in return, the enrollment credentials (URL of the organization's Protecio Engine, single-use token, work identifier). The confirmed professional email address is used solely to attach the device to the right organization and the right protected work.

Optional capability: site blocking

Off by default. When enabled by the user or imposed by their organization, the extension prevents the device from reaching the destinations that the organization's signed policy forbids. These destinations come exclusively from that policy, cryptographically verified before enforcement — never from a list embedded in the extension nor from a third-party service — and each carries a security reason: AI service not authorized by the organization, data exfiltration destination, or phishing site.

A blocked navigation shows an extension page that names the destination, the reason and the requirement applied. The requested address is never transmitted: when a navigation is blocked, the record transmitted to the organization carries the host written in the policy, the reason and the control identifier — the same categories of metadata as the other decisions, with no new category. No content of the requested page is read, since the page is never loaded. Blocked sub-resources (data requests issued by a page) produce no record. The record of a block is emitted by the blocking page when it is displayed in a tab; it attests that display, not a decision of the browser's network engine, which the extension does not ask to read.

Optional capability: files inspected on the device

When the “AI files” capability is active and the user attaches or drops a file on an AI assistant site from the catalogue, in a web email composer (Gmail, Outlook) or on a SaaS site named by their organization's signed policy — never on a page recognized from its behaviour alone —, Guard reads the file's name and, for text formats only, up to the first 256 kilobytes of its content, to detect sensitive data before it is sent.

This reading happens entirely on the device, inside the tab, within a bounded time budget, and is never transmitted: neither the content nor the file name leaves the device. Non-text formats (PDF, office documents, images) are not opened; only their name is examined. A file whose content could not be read — format not opened, or time budget exhausted — is not held back: it goes through, and a notice “Content not fully verified” tells the person; no “safe” verdict is inferred from it. This tolerance never lifts a block decided by the organization's policy, nor an alert based on a signal actually detected (telling name, content read).

After enrollment, only the decision metadata already listed above may be transmitted — domain, reason, action and severity — which says that a file upload was examined, what the policy said about it and what the person decided, never which file nor what it contained. The name of the recognized destination stays local; only the page's hostname, already listed, is transmitted.

The possible reasons are, on an AI assistant site or an email composer:

On a SaaS site named by the policy, the same seven reasons are prefixed saas_: saas_file_upload_flagged, saas_file_upload_uninspected, saas_file_upload_warned, saas_file_upload_observed, saas_file_upload_policy_blocked, saas_file_upload_allowed and saas_file_upload_blocked.

Optional capability: files downloaded from a site named by the policy

When the “Downloads” capability is active — it is off by default, and turning it on separately requests Chrome's “Downloads” permission, which the user grants or refuses — Guard records that a file arrived from a destination that the organization's signed policy names and has set to “observe”.

The file is never opened, read or analyzed: the browser gives no access to its content before it is written to the device, and Guard does not read it afterwards. Only the hostname of the page the download starts from is read and, failing that, the hostname of the file's address. Neither read nor transmitted: the content, the file's name, its location, its size and its type.

The transmitted record carries the same metadata as the other decisions — domain, reason, action and severity, with the recognized destination — under one of the two reasons ai_file_download_observed or saas_file_download_observed. Without a setting on the destination, nothing is recorded. Turning the capability off stops the observation and returns the permission to Chrome.

Optional capability: local AI

Off by default. When enabled by the user or imposed by their organization, the extension may submit the text of the visited page or the content of a prompt to the AI model built into the browser (Built-in AI). This processing runs entirely on the device: nothing leaves the device, it adds no data to the transmitted metadata described above, and its results can only add local warnings — never lift a protection.

Your choices and your rights

• Decline activation at first launch: nothing runs until you have accepted the disclosure.
• Turn off each capability that is not administered by your organization, from Settings.
• Unlink at any time through “Unlink / reset” in Settings: enrollment, activation and local credentials are deleted.
• Export your preferences (local file, without credentials or tokens).
• Delete local data by removing the extension.
• Access, correction and deletion of transmitted metadata: it is held by the organization that deployed the extension (see below).

What is your organization's responsibility

The organization that deploys the extension is the controller of the transmitted metadata. It may impose certain settings on a managed browser; its notice to employees must then describe the legal basis, retention periods and the contact details of the person in charge of the protection of personal information. Requests for access, correction or deletion are addressed to it.

When Protecio hosts the organization's Protecio Engine, Protecio acts as the organization's service provider: it does not use this data for its own purposes, keeps it partitioned per organization, applies the retention period agreed with the organization [default period to be confirmed] and carries out its requests. When the organization hosts its own Protecio Engine, it has full control and Protecio has no access to any of this data.

Subprocessors

When Protecio hosts your organization's Protecio Engine, Protecio is its service provider and relies on the subprocessors below. [List and regions to be confirmed by the infrastructure team before publication.]

When the organization hosts its own Protecio Engine, its own providers apply and this list does not concern it. The full list of the platform's subprocessors is in our TPRM program (in French).

Publisher, contact and changes

Publisher of the extension: [legal name — to be confirmed]
Address: [full address — to be confirmed]
Person in charge of the protection of personal information (Quebec Law 25): [name and contact — to be confirmed]
Questions or requests about your rights: privacy@protecio.com

This policy is updated together with the extension. The date at the top of the page is that of the text in force; changes of scope (new analyzed surface, new metadata category, new subprocessor) are announced in the extension's listing and in its first-launch screen.