--- title: "Security: what stays on your PC and what leaves it | Scalebrowser" description: "Scalebrowser keeps profiles, logins, workflows and browsers on your PC. Every item that reaches our servers, how the vault and updates are protected, where our servers are, what is not done yet, and how to report a weakness." canonical: "https://scalebrowser.net/security" last_modified: "2026-11-15T13:22:44.000Z" --- > ## Documentation Index > Fetch the complete documentation index at: https://scalebrowser.net/llms.txt > Use this file to discover all available pages before exploring further. Security # Your browsers and secrets stay on your PC. Profiles, logins, workflows and the browsers run on your machine. Under the line is everything that reaches our servers, and when. [Download free for Windows](https://scalebrowser.net/api/download/installer) [How agents use secrets](https://scalebrowser.net/secret-layer) Free plan with AI built in · No credit card · Your vault stays on your PC One email with the download link, nothing else. [Privacy](https://scalebrowser.net/privacy) [How agents use secrets](https://scalebrowser.net/secret-layer) Free plan with AI built in · No credit card · Your vault stays on your PC ## Always crosses5 While you have an account. Small, and on a timer you can read. * **License check**At most hourly A signed token that says your plan is active. Your PC is known only as a hash of its own key. Reaches usAccountMachine id, hashed * **Running browsers**Every 60 seconds One slot per browser that runs, with a heartbeat, so the limit of your plan holds. Reaches usA count * **Profile ids**On create or delete An opaque id per profile for your plan's profile limit, and nothing else about the profile. Reaches usRandom ids * **Your first agent run**Once One event when an agent first connects, with no profile, site or page in it. Reaches usagent.connected * **Browser engine**First start and updates Our Chromium comes down to your PC, signed, and is checked before it runs. Comes to your PCSigned files ## Crosses only when you turn it on5 Off on a new install. Each one is a switch at your PC. * **Profile sync**Off until you turn it on Profiles move between your PCs sealed with XChaCha20-Poly1305, under a key from your passphrase. Reaches usCiphertextIds, sizes, times * **Workflow sync and approvals**Off until you turn it on Workflows move between your PCs and approvals reach your phone or mail, sealed with HPKE. Reaches usSealed contentsRouting fields * **Remote access**Off by default claude.ai, ChatGPT or Grok drive your browser through our relay, which keeps no body, header or address. Reaches usA counterTimestamps * **Shared videos**When you share one Only the video you share, behind a link of 32 random characters that search engines skip. Reaches usThat one video * **Crash reports**Off by default Error type, message, stack, version and system, cleaned of secrets, to our own collector. Reaches usError details ## Locked where it lives. Signed where it travels. What stays on your PC is encrypted, what comes to it is signed, and your account asks twice. ### On your PC * **Vault encrypted at rest** Logins, keys and session bundles under XChaCha20-Poly1305, with a key from Argon2id. * **Proxy passwords stay inside** Decrypted only inside Scalebrowser. An agent never gets one in plain text. * **Local API on 127.0.0.1** REST and MCP answer on your machine only, with a token; TLS if you want it. * **You set the agent's reach** Read-only mode, the tool groups it sees, and pages on public addresses only. ### On the way to you * **Signed engine** SHA-256 and a minisign signature against pinned keys, plus a signed hash for every file. * **Signed app updates** The app checks each update's signature before it installs it. * **No signature, no release** A failed signing step publishes nothing. * **Signed license tokens** EdDSA with a fixed algorithm; a clock turned back is refused. ### In your account * **Two-factor codes** On every way in, Google and GitHub included. * **Passkeys** Sign in to the account without a password. * **Asked again before big changes** Sensitive actions want your confirmation once more. * **Sessions and machines** See every session; a machine you remove stops right away. ## Our side of the line. One production server in the EU, a few services around it, and a date on everything we keep. ### Who runs it * **Contabo** Our production server, in the EU * **Cloudflare** DNS, TLS, storage for backups and updates, the remote access relay * **Amazon Web Services** Sending our emails, from eu-central-1 * **Stripe** Payments and invoices * **GitHub** Sign in with GitHub * **Google** Sign in with Google, and Google Sheets in workflows ### How long we keep it * **A deleted account** Restorable until then, removed after 30 days * **Backups** Daily, encrypted, at a second provider 35 days * **Crash reports** Only if you turned them on 90 days * **Browser check results** Only with your consent, per purpose 90 days * **Invoices** Kept by Stripe for tax law 7 years The binding list of processors and periods is in the [privacy policy](https://scalebrowser.net/privacy). ## Not done yet, said plainly. * **No Windows certificate yet** Windows shows a SmartScreen warning before the first install: More info, then Run anyway. Every release is signed with minisign meanwhile, and the app checks it. * **No outside audit yet** No external audit, pen test, SOC 2 or ISO 27001 so far. This page says what the code does, nothing more. Windows protected your PC Microsoft Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk. More info Don't run 9:41 ## Found a weak spot? Tell us. Write what you found, how to repeat it and your app version, with “Security report” in the subject. Until security reports get an address of their own, support reads them. [Write the report](mailto:support@scalebrowser.net?subject=Security%20report) ## Keep your agents’ work on your own PC. The Free plan has the Secret Layer, the vault and the AI blocks. No card. [Download free for Windows](https://scalebrowser.net/api/download/installer) [Ask us a question](https://scalebrowser.net/contact) Free plan with AI built in · No credit card · macOS and Linux coming soon One email with the download link, nothing else. [Privacy](https://scalebrowser.net/privacy) [Ask us a question](https://scalebrowser.net/contact) Free plan with AI built in · No credit card · macOS and Linux coming soon