Data access and privacy

What the proxy can access

The guardian proxy processes requests between the browser and your application. Browser HTTPS terminates at the public edge, and the proxy connects to your origin over a separate HTTPS connection. The proxy has access to decrypted HTTP content. Encryption in transit does not hide that content from the components processing it.

Configure supervision with that data access in mind. The proxy can see customer inputs, not just request metadata. API integration has a different data path: its client sends identity information, action arguments, and execution results to the authorization service.

Data processed during supervision

Component	Accessible or collected data	Persistence and downstream use
Browser adapter	Approved control labels, route templates, structural locators, match counts, and control state flags.	Sends structural observations to the guardian API. These observations omit input values, full page text, URL queries, and fragments.
Edge identity processing	Application cookies or bearer credentials selected by the identity configuration.	Derives a credential-context hash for supervision. Processing a credential to hash it still requires access to the credential.
Proxy request authorization	Request headers and, for supervised protected requests, buffered request-body bytes.	Compares an exact body hash and other request bindings. This is not proof that the proxy never received the body.
Proxy response processing	Supervised HTML for script insertion and protected response bodies for hashing, within configured size limits.	Records HTTP status and response-body hash. This record alone is not a copy of the response or a verified business receipt.
Guardian state service	Task instruction, observations, action proposals and arguments, clarifications, decisions, permits, and private model continuation.	Stores observations and proposals in PostgreSQL. Proposal events and permits can also contain action arguments. Evidence is signed and archived; signing does not redact it.
Model provider	The proposal, selected action, observation, policy, task instruction, clarifications, and recorded review/execution context when model review runs.	These fields are sent to the configured provider. Provider handling is a separate data boundary. Private continuation is retained by the runtime.

The structural control collector excludes password inputs and elements marked private. Action arguments and protected request bodies are separate data paths and can still disclose sensitive values. A masked password display does not make its underlying value unreadable to same-page code.

Raw cookies and authorization headers are not intentionally included as fields in the guardian model payload. That does not establish a general secret-redaction guarantee: credentials or personal data can appear in configured fields, page URLs, labels, instructions, or agent-authored proposals.

The current company API client also sends principal information, operation arguments, and returned execution results to its authorization service. Running the request handler inside a customer's infrastructure does not alone guarantee that data stays there. Model calls, audit export, application logs, database access, and retention all need to be considered separately.

Blocking an input is different from reading it

A script can cancel a click or typing event without collecting its value. Structural observations omit input values, but a proposed action or protected request can still include them. These are separate data paths.

Client-side event interception can help a cooperating agent use the approved interface. It cannot prevent a browser owner from inspecting the DOM, changing browser code, or sending requests directly. The server-side check is what blocks protected network effects.

Review your data requirements

Before enabling an operation, review the fields included in observations, proposals, and protected requests; the model provider receiving review facts; and how results and evidence are retained. Exclude sensitive fields from action arguments and request mappings unless their processing is explicitly permitted. Masking a field on screen does not remove its value from a submitted action or request.

If raw inputs must remain inside your infrastructure, the guardian proxy's normal data path does not meet that requirement. Confirm an appropriate deployment and review boundary with your integration operator before sending sensitive data. Installing an API handler locally does not alone prevent its authorization client from sending arguments elsewhere.

Redaction must happen before data leaves the approved boundary. Hashing after receipt does not undo disclosure, and predictable values can sometimes be guessed from a hash. A model cannot evaluate the meaning of content it has not received; any content-dependent review must run within your approved data boundary.

Read How Halfspan works for enforcement limits and Company setup for deployment responsibilities.

Ask AI about this page