NixGuard Browser Protection: what it does with your data

On your device only

Phishing shield. For each page it reads the address, the title, a few headings and button labels, and whether there is a password field. It decides there and then. None of this leaves the browser.

Password guard. When you sign in on your company's sign-in page, it keeps a one-way fingerprint of the password (PBKDF2-SHA-256, 150,000 rounds, a random salt made on this device). The password is never stored. The fingerprint is never sent. It is used only to notice the same password being typed on another site.

Sent to your NixGuard workspace, only when your browser is connected

• A page is flagged, or you continue past a warning
  the site's domain (for example example.com) and the reason codes
• Your company password is typed on another site
  that site's domain
• You press "Report as phishing"
  the site's host name
• Once in a while
  the extension version, which protections are on, and a random install ID
• App discovery, only if your workspace admin turned it on
  the domain of an app you sign in to, and how (password, Google or Microsoft)

Never sent: page contents, full addresses or paths, what you type, usernames, passwords, browsing history.

Connecting

You connect the extension from the NixGuard app, signed in as usual (Google, Microsoft or password). The extension never sees your password: the app gives it a one-time code, which it trades for a token that can only send browser protection reports. That token tells your workspace which person uses this browser, so your security team can act on a warning, for example by signing you out everywhere after your company password was typed on a phishing site.

Deep scan, only when you press it

"Deep scan with AI" sends a screenshot of the current tab to NixGuard, which has it analysed by the AI provider NixGuard uses, under that provider's terms for business customers. It runs only when you press the button, and only in a browser connected to a workspace. Do not use it on a page showing information you may not share.

Who sees it

Your organization's NixGuard workspace owners and admins. NEX Level Labs does not sell this data, does not share it with third parties (apart from the AI provider that analyses a deep scan you ask for), and does not use it for advertising or to build profiles of you. It is used only to protect your organization and to run the features above.

Disconnecting the extension in its menu, or removing it, stops all sending. To have the events stored for your browser deleted, ask your workspace admin or contact NixGuard.