Privacy policy

Last updated: 19 October 2026

VigilSpan provides a browser security service for organisations: a browser extension for Google Chrome and Microsoft Edge, a dashboard for each customer organisation, and the cloud service that connects them. This policy explains what data we handle, why, and how it is protected. Contact: privacy@vigilspan.com.

1. Our website

This website does not use cookies, analytics or third-party trackers. When you submit the "Request access" form we receive your name, work email, company, and optionally your role, company size and message. We use them only to reply to you and set up your organisation. We keep requests that don't become customers for up to two years. Our hosting providers keep standard server logs, including IP addresses, for security.

2. The VigilSpan service

The extension is installed by an organisation (our customer) on browsers it manages. For that data the customer decides what is collected through its policy, and we process it on the customer's behalf. If you use a browser managed by your employer, please also read your employer's policies.

What the extension does on the device

It analyses the pages you open (address, content and behaviour) inside the browser to detect attacks. These checks happen on the device. Page content is not sent to us for this.

What is sent, and who can read it

• Security alerts (for example a blocked phishing page or download) and, only if your organisation turns it on, browsing history. These are encrypted in the browser with your organisation's public key before they are sent. We store them but cannot read them; only your organisation's administrators hold the key. A few unencrypted fields are needed to route and count alerts: alert type, attack category, severity, verdict, action taken, device and time.
• Device and enrollment data: a device identifier, a device name, extension version and when the device was last seen.
• Optional reputation look-ups, if enabled by your organisation: a domain (or URL, if your organisation chooses) is checked against third-party reputation services through our servers. Never for incognito windows.
• Optional AI analysis, if enabled by your organisation: for pages the extension finds borderline, a trimmed snapshot (address, title, form details and, depending on the policy, page text and script excerpts) is sent through our servers to the AI provider the organisation chose. That provider may be one the organisation contracts directly. We don't keep the snapshot.
• Password-reuse protection, if enabled: salted hashes of corporate passwords stay on the device. Passwords are never sent anywhere.

Data shared with VigilSpan to improve protection

Unless your organisation switches sharing off, we receive: the domain or address (never query strings or fragments) of pages the extension identified as clear attacks; when someone continues past a block, the reason they gave and the page address without query string; and suspicious or malicious AI verdicts about a page, with the AI's reasons. These are linked to an organisation only through a keyed hash, never to a person or device. Confirmed attack sites may be added to the threat intelligence we send to all customers.

3. How long we keep data

• Browsing history and AI scan logs: 90 days
• Security alerts: 365 days
• "Continue anyway" feedback and shared AI verdicts: 180 days
• Website access requests that didn't become customers: 2 years

Customers can ask us to delete their organisation's data at any time. When a contract ends, we delete it.

4. Security

Data is encrypted in transit (TLS). Customer alert and history content is additionally end-to-end encrypted as described above. Administrator accounts require two-factor authentication. Policies are signed by the customer's own keys, and our threat intelligence is signed. To report a vulnerability, see security.txt.

5. Where data is processed

Our service runs on Amazon Web Services in the Asia Pacific (Mumbai) region, behind Cloudflare. AI analysis, when enabled, is processed by the provider the customer selects, in that provider's regions.

6. Your rights

Depending on where you are (including under India's Digital Personal Data Protection Act and the EU/UK GDPR), you may have rights to access, correct or delete your personal data, or to object to its use. If your data reaches us through your employer's use of VigilSpan, contact your employer first. We will help them respond. For anything else, write to privacy@vigilspan.com.

7. Changes

We'll update this page when our practices change and change the date at the top. Customers are told about material changes in advance.