Browser Security Privacy Policy

1. Scope and responsibility

This policy describes the information handled by the ComplianceOS™ Browser Security extension, published by CyberSecurity Doctors, and the portal services that receive its assessments. Its purpose is to give authorized organizations visibility into browser configuration and extension inventory for security oversight and compliance-readiness review.

Enrollment requires an authorized ComplianceOS portal account and an available licensed Browser Security seat. Your organization determines which browsers are enrolled and how authorized personnel use the resulting records. Website inquiries and other portal features have separate data flows; this policy specifically covers Browser Security.

2. Information the extension handles

• Browser and extension versions: browser name and version exposed through the browser user agent, and the ComplianceOS extension version.
• Enabled third-party extension inventory: extension identifiers, names, versions, and installation types. Inventory evidence is limited to 50 enabled third-party entries per assessment. Assessments also include counts and indicators for development-mode and administration- or policy-installed extensions. Manual assessments may include up to 25 development-mode extension names.
• Supported settings: Safe Browsing, autofill, and password-saving settings, including their reported values and control information where the browser exposes them. Unavailable settings are recorded as unavailable. The extension reads these settings without changing them.
• Assessment records: check identifiers and versions, categories, titles, severity, findings, recommendations, supporting configuration evidence, assessment times, upload status, and readiness results. Background requests also identify the assessment trigger, such as a scheduled assessment or an extension change.
• Enrollment and authentication information: a registration identifier, a one-time enrollment token supplied in an enrollment code, and the device token received in exchange. Older enrollments may use a legacy registration credential during upgrade. These are extension enrollment credentials, not your saved browser passwords.

The portal associates registration and assessment records with the relevant organization and enrolling portal user. Information entered separately in the portal, such as a browser label or account details, is not obtained by reading webpages.

3. Information the extension does not read

The extension code does not read general webpage content, browsing or search history, saved passwords, patient records, email or message contents, form entries, or browser cookies. Reading the password-saving or autofill setting does not read the passwords or form values themselves. The extension does not scan files or the full workstation.

Do not place patient information, protected health information, or unrelated secrets in portal labels or support requests. Browser Security does not certify HIPAA compliance or guarantee protection against every threat.

4. When collection and reporting occur

After enrollment, assessments run when you select the manual security-check control, approximately every six hours through a browser alarm, and after supported extension installation, removal, enable, or disable events. Browser availability and scheduling can affect the timing. Background and manual assessments inspect the same categories of browser security information.

An enrollment code is sent to the portal to obtain a device token. Assessment requests send the registration identifier, device credential, browser/version information, and assessment checks to https://portal.cybersecuritydoctors.com over HTTPS. The packaged extension does not load executable code from a remote server.

5. How the information is used

Browser Security uses this information to enroll and authenticate a browser, associate results with its organization, enforce enrollment and seat eligibility, record security assessments, display readiness states, and support review of configuration findings. The visible states include NOT CONNECTED, AWAITING CHECK, PROTECTED, REVIEW REQUIRED, and ACTION REQUIRED. A PROTECTED result describes the assessed indicators; it is not a guarantee of complete security.

Under this policy, use of Browser Security data must remain limited to providing, maintaining, securing, or improving these disclosed features. This policy prohibits selling Browser Security user data, using it for personalized or interest-based advertising, unrelated profiling, or determining creditworthiness or lending eligibility. These restrictions apply to raw data and data derived from it.

6. Recipients and access

The extension sends its data to CyberSecurity Doctors’ production ComplianceOS portal. The inspected production backend uses Vercel to host the portal/API and Supabase for the database and authentication services. These providers process information needed to operate their services. Hosting and network infrastructure may also process ordinary connection information, such as IP addresses, request metadata, and diagnostic logs; this is separate from reading browsing history.

Assessment records are intended for authorized personnel in your organization and CyberSecurity Doctors personnel providing the requested security, administration, or support service. Access must be limited to the relevant organization and authorized duties. Human review must be supported by the consent and authorization applicable to the service, a specific support request, a security investigation, or a legal requirement.

This policy permits disclosure to service providers only when necessary for the disclosed Browser Security purpose, to meet applicable law, or to protect against fraud, abuse, or security threats. It does not authorize unrelated third-party transfers. Any transfer associated with a merger, acquisition, or sale of assets must meet applicable law and the Chrome Web Store’s prior-consent requirements.

7. Local storage and security

The extension uses the browser’s local extension storage for enrollment credentials, extension version, recent checks, readiness state, and assessment or upload timestamps. These values allow the extension to remain enrolled and show its latest assessment. Local browser storage is not a claim that the data is encrypted at rest.

The inspected API hashes device credentials before database authentication. Credentials must be treated as secrets even though the server uses hashes. Do not share an enrollment code or device token in a screenshot or support message. Assessment transmission uses HTTPS. No system can promise absolute security, and this policy makes no certification or independently audited encryption claim.

8. Retention, removal, and your choices

Local enrollment and assessment state persists in the browser until it is replaced or removed. You can stop the extension’s future assessments by disabling or uninstalling it. Your organization can revoke a browser registration through the portal’s authorized administration flow.

Uninstalling the extension or revoking a registration does not itself delete assessments already sent to the portal. Server-side assessment records are stored separately from local extension state. The extension does not define a server-side retention period or automatic deletion schedule.

For the retention period applicable to your organization, or to request access, correction, deletion, or a review of permitted access, contact your organization’s administrator or info@cybersecuritydoctors.com. The applicable service arrangement and legal obligations determine how a request is handled. This policy does not promise immediate deletion, a fixed response deadline, or removal from backups on a particular schedule.

9. Chrome Web Store Limited Use

The use of information received through Google and Chrome extension APIs must adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Collection, use, and transfer must remain necessary for the disclosed Browser Security purpose and related operational functions. This policy does not permit targeted advertising, unrelated use, or human access outside the permitted exceptions.

10. Changes and contact

CyberSecurity Doctors may update this policy as Browser Security changes. A change in collected data, recipients, or use must be reflected in the public policy and store disclosures before relying on the revised practice, with any additional consent required by applicable law or Chrome Web Store policy.

Privacy and support: info@cybersecuritydoctors.com
Website: cybersecuritydoctors.com
Support page: cybersecuritydoctors.com/contact