This policy covers the ConfigShield Browser Inventory Chrome extension, published by Center for Internet Security, Inc. ("we").
Who the extension is for
The extension is for organisations that manage Chrome centrally. An organisation's administrator installs it on managed browsers through Google Admin, Group Policy, Intune or Jamf, and configures it through Chrome enterprise policy.
Until an administrator configures it, the extension collects nothing and sends nothing. On a browser without that configuration, it stays idle.
What it collects
When configured, the extension reads the following from the browser it runs in and sends it to the console:
- Browser and platform: browser brand and version; operating system, architecture and OS version.
- Privacy settings: the value of 20 Chrome privacy settings, and who controls each one (enterprise policy, another extension, or the user). The extension only reads these settings and never changes them.
- Installed extensions and apps: for each one, its ID, name, version, type, whether it is enabled, its permissions and host permissions, how it was installed, whether the user may disable it, and whether it comes from a store. The administrator can limit this to policy-installed extensions or turn it off. The extension never enables, disables or removes another extension.
- How this extension was installed.
- Hardware manufacturer and model, only where the administrator's Chrome policy allows it.
- On ChromeOS only: the device's Google directory ID, which links the browser to the organisation's own device record. The serial number, asset ID, administrator-set location label and hostname are collected only if the administrator turns them on.
- When it enrols: this extension's version and a random identifier for this installation.
- With each report: this extension's version, a report ID, the time the report was collected, a digest of the report, and which extensions the administrator chose to include. Between reports, the extension sends only the digest. The console records when the browser enrolled and when it last checked in.
In the browser, the extension keeps only the console address, its console credential, the console's ID for its record, its installation identifier, the digest of its last report, when it last reported, and its retry state.
What it never collects
The extension never reads user names, email addresses or the signed-in Google account; open tabs; browsing history; cookies; page content; form data; passwords; keystrokes; or IP or network addresses.
Like any web service, the network infrastructure in front of the console sees the IP address each request comes from. The console's load balancer keeps it in access logs for 30 days, for security and operations.
Where the data goes
Reports are sent over HTTPS only to the ConfigShield console address the organisation's administrator configures. The extension contacts no other server.
In the console, each organisation's data is kept separate from every other organisation's. It is available to that organisation's authorised administrators, and to authorised CIS staff who operate and support the service. It is used only to show the organisation its browsers' security configuration and extension inventory.
We do not sell this data. We do not use or transfer it for advertising, for creditworthiness or lending decisions, or for any purpose unrelated to the extension's single purpose described above.
Retention and deletion
- The console keeps only the most recent report from each browser. Each new report replaces the previous one.
- An organisation's administrator can delete a browser's record from the console's Browsers page. If the extension is still installed and configured, the browser enrols again at its next check-in; remove the extension or revoke its enrolment token to stop that.
- When an organisation leaves the service, deleting the organisation deletes all of its data, including every browser record.
- Deleted data remains in encrypted backups for up to 14 days, after which it expires.
- An administrator can stop collection at any time by removing the extension or its policy configuration.
Your choices
The extension is controlled by your organisation's administrator, not by individual users. If you have questions about what your organisation collects, contact your IT administrator.
Changes to this policy
We will update this page when the extension's data handling changes, and change the effective date above.
Contact
Questions about this policy: [email protected].