The whitepaper is for users and organizations that need implementation detail: what the browser does for process isolation, site blocking, download scanning and encryption, and which parts you must configure yourself.
Process isolation and sandboxing
Renderer and plugin processes run in a restricted sandbox with no direct access to system files or another site data; the browser process coordinates and decides permissions.
- Renderer sandbox isolation
- Site data isolated by origin
- Plugins run in separate processes
- Sensitive operations decided centrally
Site blocking and download scanning
URLs are checked against a risk service before navigation, and a warning page appears for phishing or malicious hits. Downloaded executables are scanned locally and in the cloud before prompting.
- Risk lookup before navigation
- Warning page offers back or continue
- Executables scanned after download
- Second confirmation before opening risky files
Data encryption
Synced data is encrypted in transit and at rest; passwords use a separate key so the service cannot read them; local data is protected by the system account.
- TLS for transport
- Synced data encrypted at rest
- Passwords under a separate key, unreadable by the server
- Local data protected by system account rights
FAQ
Is the whitepaper updated?
Yes. It is revised whenever a major security mechanism changes or a capability is added, and noted in the release log.
How do enterprises get more detail?
Request the full security description and compliance questionnaire support through the contact page for internal security review.