Why interception

Clipboard and browser sensors see pastes and form fields. They do not see a file upload from a native app, a script pushing a client list to a file-sharing site, or a desktop sync client mirroring a folder into personal cloud storage. The only place all of that is visible is the network — and because essentially all of it is TLS-encrypted, “visible” requires the device to trust a local inspection point.

So each enrolled Mac runs a local proxy, supervised by the agent. Traffic to monitored destinations is decrypted on the device, classified by the same detection engine that scans the clipboard, and allowed or blocked by your policy.

Two boundaries worth knowing from the start:

• Nothing is decrypted off the device. The proxy is local; inspected traffic never detours through our servers or anyone else’s.
• The proxy is block-only by design. It never rewrites request bodies in flight — that kind of tampering is fragile and app-specific. Redaction happens at paste/submit time instead, where it can be done reliably. An upload either goes through or it doesn’t.

How the trust and containment work — per-device certificates, domain constraints, and the no-silent-green rule — is covered in How it works. What the proxy structurally cannot see (and what covers those gaps) is in Limitations.