What the extension collects

The extension never reads what you type. It knows which site you are on, checks it on your device, and reports only sites that break a rule. You can see everything it reported about you.

This page is written for employees, works councils and security reviewers.

What it does

It checks sites on your device. Whether an address looks like a trusted brand or one of your company’s domains is decided in the browser.
It reports only a domain, and only when a rule fires. When a site triggers a warning, the report holds the type of event, the domain of the site (for shared hosting platforms like *.pages.dev, the full site address without the path, because the platform domain alone would be meaningless), the time, and what happened next (you were warned, continued anyway, were blocked, or the event was only logged). Never the full address, the path, the search terms, or the page title.
Domain age lookups are rare. A list of recently registered domains is downloaded to your browser and checked locally. Only when a domain is both suspicious-looking and possibly new does RansomLeak look up its registration date, using the public registry lookup service (RDAP, via rdap.org and the domain’s registry). Only the domain name is sent, with no information about you or your company. The result is stored for you alone and not shared with other people.
Consent screens are read for warnings only. On the Google and Slack screens where an app asks for access (and Microsoft’s authorization page, when Microsoft shows consent there), the extension reads the app name, whether the publisher is verified, and the permissions requested, so it can warn you about risky ones. It does not read anything you enter. When a consent warning is shown, and again if you choose Continue anyway, the report holds only the provider (Microsoft, Google or Slack), the domain of the consent page and that choice. App names, publisher details and permission lists stay in your browser and are never sent.
AI tools are counted, not watched. When you open a known AI tool (such as ChatGPT, Claude or Gemini), the extension adds one to that tool’s count for the day (UTC). It sends only the daily count per tool, updating the current day’s count about every 30 minutes. Never the address, what you type or paste, or the page content. By default these counts are stored without your name or user id: only a scrambled device code that lets RansomLeak count how many devices used a tool. They are stored with your user id only if your administrator turns on per-person attribution, and only from the day after it is turned on; earlier counts stay anonymous. The popup shows whether it is on, and when it is, you can see your own tools there too. Your administrator can also turn counting off.
Extra protection is optional. If you turn on extra protection in the extension (it asks your browser for one more permission), it can warn you when you download a risky file type from a site it has flagged. The download warning sends only the site’s domain and the file category (such as program, script or Office file with macros), never the file name or its contents.
Pastes into AI tools are checked in your browser. Only if your administrator turns this on and you have turned on extra protection: when you paste into an AI tool (one of the tools counted above), the extension looks at the pasted text on your device to see whether it looks like a password, API key or token, a payment card number, a list of email addresses, or a very large block of text. The pasted text is never stored, logged or sent. If you choose Paste anyway, the extension pastes the same text for you and then forgets it. The report holds only the AI tool’s domain, the kind of data (password or key, card number, email addresses, or large paste) and what you did (did not paste, pasted anyway, or the paste was blocked), at most once a day for each tool, kind and choice.
Short lessons record that you did one. When you finish a Learn why lesson, the report holds only the type of lesson and the site’s domain. It is sent at most once per type and site per day. Your answers are never sent, and a lesson does not change your risk score. Admins see it on the Activity tab, and you see it in What we know about you.
Your assigned training is fetched, not reported. To show the To do list and the count on the extension icon, the extension asks RansomLeak for the titles, due dates and links of your own open campaigns and learning paths, about every 30 minutes and when you open the popup. Nothing new is sent about you for this. The list is kept in your browser and removed when the browser is signed out.
Reminders are optional. If your administrator allows it and you select Turn on reminders, the extension asks your browser for permission to show notifications. Reminders are created in your browser from the same list. Nothing is sent when a reminder is shown or selected.
Site reports send only the site. When you report a suspicious site, the report holds only the site’s host name and the note you chose to add. The popup shows your own reports from the last 90 days and whether your admins confirmed or dismissed them. When a report is confirmed, it counts in your favour in your organisation’s risk score, where it is used.
You can see all of it. The popup’s What we know about you view shows every browser and identity signal recorded about you, from the extension and from connected identity tools, exactly as your admins see them. If a signal is hidden from administrators by your organization’s settings, it is hidden from you too.

Identity and browser integrations

If your administrator connects Microsoft or Google (see Browser & identity signals), RansomLeak also reads security events from them once an hour. These records follow the same rule as extension events:

Stored: the event type, the time, the domain only (never the full address) for password reuse and unsafe sites, the name of an app and the names of the permissions it was given, an extension’s id and name, and the browser version.
Never stored: full web addresses, paths or search terms, IP addresses, or device names.
People who are not users: events for email addresses that do not match a user in the workspace are discarded. Only the number discarded is counted.
Connection details. For Google we also keep the email of the admin who connected it and your Google customer domain, shown on the card. The Google access token (a refresh token) is stored encrypted and is deleted when you disconnect.
You can see them. They appear in What we know about you like any other signal.

What it does not do

No browsing history. Sites that did not break a rule are not reported (AI tools are only counted per day, as described above).
No page content.
No passwords, and no form fields or anything you type.
No clipboard reading. The extension never reads your clipboard on its own. The optional AI paste check only looks at text you paste into an AI tool, at the moment you paste it, and never sends it.
No file names or file contents. With extra protection on, a risky download sends only its file category.
No blocking by default. Out of the box it warns and records. Blocking is a choice your administrator can make for each detector.

Where the data lives

Region. Events stay in the region your workspace is hosted in. EU workspaces are served from the EU stack.
Retention. Browser events are kept for the same period as other risk signals in RansomLeak, and then deleted.
Who counts them. Browser events are stored for every workspace. They count toward the Human Risk Score only where the score is already in use.
Domain age data. The new-domain list is built from public sources, which receive no customer data.
Trusted-site lists. The extension also downloads a public list of popular websites and the domain lists Microsoft and Google publish for their own services. RansomLeak fetches these from the publishers without sending them any customer data.
Reported dangerous sites. The extension downloads a daily list of sites that security researchers have reported for phishing or malware (from the public OpenPhish and URLhaus research feeds). Checking a site against it happens on the device, and the feeds receive no customer data.

Source code

The extension’s source code is public at github.com/ransomleak/ransomleak-browser-extension, so you can check exactly what it does and what it sends. Your security team can read it and build it themselves.

The code is source-available under the Business Source License 1.1: you can review, audit, build and test it, including inside your organization, but not use it to build a competing product. Each version becomes Apache-2.0 four years after release. Please report security issues privately to support@ransomleak.com.

Browser extension overview
Deploy the extension (includes the full permissions list)