Proctored decrypts AI traffic where it starts, on the device, under a certificate authority that belongs to that device alone. This page says what it touches, what it keeps, and what it sends home.
What goes through the agent is decided by the client's policy, visible in the console, and by nothing else.
The agent routes the AI services in the client's policy through its inspection, and nothing else. The list is visible in the console and changes only when the client changes it. Banking, email, the intranet and every other site are never seen.
None: findings and counts only. Redacted (default): a short excerpt with every finding replaced by its detector name; the console re-redacts as defence in depth. Full: a deliberate choice, visible in the client's settings and the audit log.
Exception requests carry the data types found and the employee's reason, never the content.
Each device generates its own certificate authority at install. The private key is stored on that device, never sent anywhere, and used only for the governed hosts. There is no shared root to steal and no central point that can decrypt a device's traffic.
A protected system service owns the enforcement on every platform; a standard user cannot stop it, reconfigure it or remove it. Any attempt shows as "enforcement degraded" in the console within minutes, and in your RMM probe.
Agents and installers are signed, and macOS builds are notarized by Apple. Every release is cryptographically signed with a key that never leaves the build environment; devices verify the signature before installing an update and never accept a downgrade, so a compromised download path cannot push a binary.
One small, self-contained agent, about 20 MB of memory. No kernel driver, no browser extension, no third-party runtime, and nothing reachable from the network.
Exception approvals are cryptographically bound to the one device that asked and re-validated by the console on every use. A claim from another device, or after expiry, is refused and raised as an alert.
Per client: if inspection fails, allow and log, or block until healthy. Files nothing can be read from (password-protected, scanned, archives) can be held. OCR of images runs with the device's own engine; images never leave the device for reading.
| What | Where it lives | Who can see it | How long |
|---|---|---|---|
| Events and alertsfindings, counts, redacted excerpts | The client's tenant, inside its service provider's | That client's admins and viewers; its service provider; the platform | Per-client retention, 7 days to 10 years, purged automatically |
| Exception requestsreason, duration, decision, uses | The client's tenant | As above | Closed requests purged with the retention window |
| Exact-match listscustomer identifiers | Hashed with a per-list salt at upload | Nobody; raw values are never stored or sent to devices | Until the list is deleted |
| Report snapshotsthe monthly report, frozen | The client's tenant, with a SHA-256 digest | As events | Kept; immutable |
| Audit logevery console and agent action | Hash-chained; verifiable in the console | Service providers and the platform, scoped to their tier | Kept |
| API keysSIEM and compliance tooling | Hashed; read-only, cursor-paged, per client or all clients | Whoever holds the key, within its scope | Until revoked |
If you find a security issue in the agent or the console, tell us through the contact form with "security" in the message. A person reads it within one business day, and we will tell you what we did about it. We ask only that you give us a reasonable time to fix before publishing.
Security reviewers at prospective partners are welcome to ask for the protocol documents and a walkthrough of the agent on a test device.
No. Only the governed hosts in the policy are routed through the agent; banking, personal email and every other site go direct and are never seen. What the console receives for governed traffic is the event shown at the top of this page, redacted unless a client deliberately turns on full capture, which is itself audited.
No. Each device generates and keeps its own CA key. The console sees the device's enrolment token hash, its events and its heartbeat, never key material. Compromising the console does not let anyone decrypt a device's traffic.
A heartbeat every few minutes with version, hostname, OS, proxy health, the installed AI apps and MCP servers it found (secrets masked), hourly usage counts, the signed-in account per AI app (address and work/personal), and the last requests it inspected as a trace (host, path, action, findings; no content). Plus events as they happen. All over TLS to the console, authenticated by a per-device token.
They cannot be decrypted by any on-device proxy, including ours. The catalog marks them, and the console's coverage column shows them as "seen, not inspected" so nobody believes a control exists where it doesn't.
No. Updates are accepted only when the release checksums carry a valid signature from the release key, which is embedded in the agent and never on the console. Each device also refuses to install below the highest version it has ever run.
Proctored hosts the console for partners. It can also run on infrastructure you control; ask us for the hosting guide.