Browsing of sites that aren't AI tools.
The browser extension acts only on the catalog's AI web domains, and only when human_ai_sharing is on.
Privacy statement
What Rune Gurd collects, and where it is processed.
Rune Guard monitors AI agents, not developers. By default it collects metadata about what agents do and never reads a person's chats or prompts. What people share with AI tools, and the content of agent sessions, are collected only when the organization turns on the matching opt-in.
What this page covers
The categories of telemetry Rune Guard collects, what each collector observes, every request a device makes to Guard Cloud, and what is never collected. The detail pages list every collector and every request.
Where telemetry is processed
Device-only categories never leave the device. Everything else goes only to the Guard Cloud the device enrolled with, and is processed where that Guard Cloud runs.
- Hosted Guard Cloud
- The EU.
- Self-hosted Guard Cloud
- The region you run it in.
Categories
Metadata by default; content only by opt-in.
Each category of telemetry, whether it is on by default, what controls it and where it is processed.
| Category | Default | Control | What it covers | Where it is processed |
|---|---|---|---|---|
| Agent activity | On | always on | What AI agents do on the device, as metadata: tool calls and the policy decision on each, process, file and credential events attributed to an AI tool, network destinations of AI processes, MCP servers and agent configuration posture. No prompt, chat, file or tool-output text. | On the device, then in the enrolled Guard Cloud's region. |
| Device operations | On | always on | Guard's own enrollment, device keys, certificates, coverage health and tamper signals, so the organization can tell whether monitoring works on the device. | On the device, then in the enrolled Guard Cloud's region. |
| Human ai sharing | Off | per-company opt-in: privacy.human_ai_sharing in the signed catalog | What a person shares with AI tools: screenshot, image paste and upload events from the browser extension on AI sites (kind, SHA-256 digest and AI destination only), daily counts of AI web apps opened (app ID, origin and count only), screenshots in a watched folder (hashed, never uploaded) and prompt scanning for secrets and custom data identifiers before a prompt reaches an AI tool. Off means the browser extension's events are refused, the screenshot watcher doesn't run and prompts are not inspected. | On the device, then in the enrolled Guard Cloud's region. |
| Session content | Off | separate per-company opt-in: privacy.session_content in the signed catalog, or a time-bound escalation an administrator requests for an incident, with a reason and, if the company requires it, a second approver | Redacted excerpts of agent session content: prompts, tool input, tool output where the harness hands it to a post-tool hook, the agent's replies where a stop or response hook delivers them, and the permission prompts a harness showed with the outcome where it can be observed, at most 2 KiB each, with secrets replaced before they leave the device. When an administrator includes content in a session replay, each step also shows the acting process's executable name and signer that Guard Cloud already holds from findings. Kept only for the opt-in's or the incident's retention period and never exported to a SIEM. | On the device, then in the enrolled Guard Cloud's region. |
| Never collected | Never | not configurable | Browsing of non-AI sites, processes that are not AI agents, file contents, keystrokes, and any content outside the two opt-ins. | Not collected, so not processed anywhere. |
Never collected
What Rune Gurd does not collect, and what enforces it.
Activity of processes that aren't attributed to an AI tool.
Sensors report events only for processes attributed to a catalog harness or discovered AI tool.
Prompt, chat, transcript, file and tool-output text, unless the session_content opt-in or an escalation covers it.
Field allowlists on the device and in Guard Cloud (findings, status, session steps), and the session content gate on both ends.
Keystrokes, screen recordings and screenshot images.
No collector reads them; screenshots are only hashed on the device, and only when human_ai_sharing is on.
Host names and operating-system user names.
The status validator refuses them; the device label is the one the operator set at enrollment.
Lookups of a customer's hosts, package names or file hashes at a third-party threat-intelligence service.
Guard Cloud and devices make no threat-intel request. The indicator set arrives in the signed catalog, and matching is an exact comparison against values Guard Cloud already stores (#614).