Privacy Policy — Layer Security

Last updated: July 5, 2026 · Applies to the “Layer Security” Chrome extension.

Layer Security helps organizations understand and govern how AI services are used on company devices. This policy explains exactly what the extension does and does not collect. The description below matches the actual behavior of the software.

What we collect (metadata only)

• The AI service (vendor) and model name detected
• The destination host name of the request
• The time of detection
• Risk level (high/medium/low), status (access/in-use), and the detecting process name
• Guard events (only when a guard is enabled by the organization):
  • Personal-information guard: the category label only of what was detected (e.g., “email address”), whether the user proceeded or canceled, and the time.
  • Unapproved-AI guard: the AI service name, whether the user proceeded or canceled, and the time.

What we do NOT collect

• Prompt content — the text you send to or receive from AI services
• The actual values matched by the personal-information guard (only the category label is recorded; the value is never stored or transmitted)
• Credentials, cookies, or passwords
• Browsing history of non-AI websites
• Full URLs, query strings, or request bodies (these are not stored)
• Names, email addresses, or other personally identifying information about the user

How detection works (why broad host access is required)

• AI usage is identified by the structure of the request (the LLM API schema), not by a list of domains — for example {"messages":[{"role":..,"content":..}], "model":..}. Because AI can be used on any domain or a self-hosted endpoint, the set of target domains cannot be limited in advance. This is why the <all_urls> host permission is needed.
• Outgoing requests are inspected in memory for their structure only. Prompt content may be read for that check but is never stored or transmitted.
• The extension does not decrypt TLS traffic (no MITM certificate is used).

Storage and transmission

The extension operates in one of two modes:

1. Standalone mode (default): detection metadata is stored only on the device (chrome.storage.local) and is not sent anywhere. Up to the most recent 500 records are kept (older ones are deleted automatically). The user can clear all records at any time.
2. Organization mode (only when connected to a console): if the organization deploys the extension and configures a “console URL and device enrollment key,” the metadata and guard events described above (metadata only, never prompt content) are sent to the organization’s own management console. That destination is a server operated by the customer organization — not a shared cloud operated by the developer. When no enrollment key is configured, organization mode is inactive and the extension runs in standalone mode.

Permissions

Guards (optional)

The personal-information guard and unapproved-AI guard operate only when enabled by the organization’s policy. All checks are performed on the device. The personal-information guard inspects content immediately before it is sent to an AI service and never stores or transmits the value itself — only the category label is recorded. In “warn” mode the user may choose to proceed; this is a safeguard against accidental disclosure, not employee surveillance.

Third parties

We do not sell data or share it with third parties. In organization mode, data is sent only to the management console of the organization that deployed the extension. The extension does not execute remote code — all scripts are bundled in the package.

Contact

Layer Security (Totsuka Tech LLC)
Email: contact@layersecurity.jp
Web: layersecurity.jp