Privacy Policy — SERIO Shield & SERIO Shield DLP Companion

1. Overview & Scope

This Privacy Policy explains how SERIO Shield and the SERIO Shield DLP Companion browser extension (collectively, the "Service") handle data when deployed on corporate endpoints managed by your organization (the "Customer" or "Data Controller").

The SERIO Shield DLP Companion browser extension operates strictly as a local companion to the SERIO Shield Endpoint Agent installed on your device. It is designed for enterprise Data Loss Prevention (DLP) and security policy enforcement as configured by your organization's IT or Security Administrator.

2. How the Browser Extension Works (100% Local Loopback Communication)

Unlike consumer browser extensions that transmit browsing activity to third-party cloud servers, the SERIO Shield DLP Companion browser extension communicates exclusively with the local SERIO Shield Endpoint Agent running on the same device (127.0.0.1 / localhost):

1. Local DLP Inspection: When you upload files or submit web forms (POST, PUT, PATCH requests), the extension forwards the outbound payload metadata and content to the local SERIO Shield service on 127.0.0.1 so it can be evaluated against your organization's active DLP policies before leaving the device.
2. No Direct Cloud Transmission from Extension: The browser extension itself never transmits data to external or third-party servers.
3. BEX Interlock Heartbeat: The extension maintains a local WebSocket connection to 127.0.0.1 to confirm to the local endpoint agent that browser DLP protection is active.

3. Data Processed on Behalf of Your Organization

Depending on the security and DLP policies configured by your organization's administrator, the SERIO Shield Endpoint Agent may process:

• Endpoint & Identity Metadata: Device hostname, operating system platform, authenticated corporate user identifier/email, and extension connection status.
• Policy Enforcement Events: Destination URL/domain, HTTP method, file metadata (filename, MIME type, file size), matched security policy name, matched DLP detector/rule name, and enforcement action taken (allow, monitor, or block).
• DLP Evidence (Optional / Admin-Configured): Only if explicitly enabled by your organization's administrator for high/critical-risk policy violations, redacted snippets or incident evidence may be recorded in your organization's isolated tenant storage for security review.

All policy evaluation is performed locally on the endpoint. Only policy telemetry and security events configured by your organization's administrator are transmitted from the local endpoint agent to your organization's isolated SERIO Security tenant.

4. Chrome Web Store Limited Use & User Data Disclosure

The use of information received from Google APIs and Chrome browser APIs by SERIO Shield DLP Companion adheres strictly to the Chrome Web Store Developer Program Policies, including the Limited Use requirements:

• Single Purpose: Data accessed by the extension is used solely to enforce enterprise Data Loss Prevention (DLP) policies configured by the user's organization via the local SERIO Shield Endpoint Agent.
• No Sale of Data: We never sell, rent, lease, or trade user data or browsing activity to any third party.
• No Advertising or Profiling: We never use or transfer user data for personalized, retargeted, or interest-based advertising.
• No Creditworthiness or Lending Use: We never use or transfer user data to determine creditworthiness or for lending purposes.
• No Unrelated Transfers: User data is never transferred to third parties except as strictly necessary to provide the enterprise security service to the Customer (the user's organization) or as required by applicable law.

5. Permissions Used by the Extension

The extension requests only the minimum browser permissions required to perform enterprise DLP inspection:

6. Data Security, Tenant Isolation & Retention

• Strict Multi-Tenant Isolation: All security telemetry managed by SERIO Security on behalf of an enterprise Customer is logically isolated per tenant and encrypted in transit (TLS 1.2/1.3) and at rest.
• Data Retention: Security logs and DLP policy events are retained only for the duration configured by your organization's administrator or as defined in your organization's enterprise agreement, after which they are automatically purged.

7. Data Controller vs. Data Processor (GDPR / UK GDPR)

For enterprise deployments, your organization (the Customer) acts as the Data Controller and determines which policies, rules, and logging settings apply to managed endpoints. SERIO Security acts as a Data Processor processing endpoint security telemetry solely on behalf of and under the instructions of the Customer.

If you are an end user on a corporate device and have questions about your organization's security policies or wish to exercise your data protection rights, please contact your organization's IT or Security Administrator in the first instance.

8. Contact Us

If you have any questions about this Privacy Policy or our security practices, please contact us at:

• Website: https://seriosecurity.com
• Email: privacy@seriosecurity.com / support@seriosecurity.com