Audit history

Each detection is recorded in the extension on the device. The history captures metadata about the detection — the category, the action taken, and when it happened — without storing the sensitive content itself.

In standalone mode the audit history stays entirely on the device and is never uploaded. It’s there for your own visibility.

When a device is enrolled in an organization, privacy-safe metadata about detections can flow to the portal so administrators have fleet-wide visibility. Scanned prompt text, pasted content, and attachment contents are not uploaded — see Audit metadata for the exact fields.