The product is built so that we cannot see your data.
Not a promise in a policy — a consequence of where the work happens. Rules are patterns, card checksums, file types and domains, and they run inside the browser against text that stays on the device. What reaches our servers is the shape of an attempt, and this page lists it field by field.
If your review needs something this page does not cover, write to us and you will get it in writing.
What an event carries
- ruleMask — the name of the pattern that matched, never the text it matched
- trigger and action — paste, typing, upload or download, and what was done
- destination — the hostname it happened on
- url and pageTitle — the address without its query or fragment, and the tab's title
- matchCount and charCount — how many matches, and how long the text was
- fileName, fileType, fileSizeBytes — for uploads and downloads
- userEmail and the browser's id — who, and which Chrome profile
- os, browserVersion, extensionVersion, language, incognito
What it never carries
- The text that matched — not one character of it
- The file that was blocked
- The contents of the clipboard
- Anything from a whitelisted domain: nothing is checked there, so nothing is recorded
- Browsing history: a page only produces an event when a rule fires on it
How long it is kept
As long as the window your organization sets, and no longer. Past it, events are deleted, and browsers that have gone quiet with nothing left attached go with them.
What the extension asks Chrome for
- storage
- Keeps the rules and the device id on the machine.
- clipboardRead
- Checks what is on the clipboard before it can be pasted somewhere it should not go.
- clipboardWrite
- Replaces it when a rule says mask, or empties it when a rule says block.
- downloads
- Cancels a download whose file type a rule blocks.
- identity, identity.email
- Reads the work account the Chrome profile is signed in with, so events have a name on them.
- alarms
- Keeps the rules on the machine in step with the ones in your console.
Capsulla works on the page itself rather than between you and the network, which is what lets it check a paste before it lands and stop an upload before it starts. It runs on ordinary web pages only.
Who can see the console
Admins you invite, signing in with a one-time code sent to their work address. An organization sees only its own events, and the extension only talks to the console it was given a key for, through the policy your Google Admin console pushes.
Who else touches it
Two companies, for two jobs: the application and its database are hosted on Vercel, and email — sign-in codes, alerts and summaries — goes out through Resend. Neither is sent the text a rule matched, because the console does not have it either. If that list ever changes, this page changes with it.