Security and privacy
Your profiles, proxies and settings are stored in a database on your computer. There’s no SoftGlaze account and no SoftGlaze server. The app does use some outside services, like IP lookups when a proxied profile launches, and every one of them is listed on this page.
How the app is put together
SoftGlaze is an Electron app. These are the window settings that matter for security, and you can check each one in the file named beside it.
| Setting | What it means |
|---|---|
| nodeIntegration: false | Page code can’t reach Node.js. |
| contextIsolation: true | The preload script and the page don’t share a JavaScript context. |
| sandbox: true | The window runs in Chromium’s sandbox. |
| setPermissionRequestHandler → callback(false) | Camera, microphone, location and notification requests from the app’s own window are all refused. |
| setWindowOpenHandler | The app window can’t be talked into opening arbitrary new windows. |
All five are in src/main/main.js. Every claim on this page is checked against the source at build time, so if a setting changes the page fails to build.
Where your data lives
Everything is under %APPDATA%\softglaze-browser on Windows. Nothing is copied anywhere else unless you set up sync yourself.
| What | Contents | Encrypted |
|---|---|---|
| softglaze.sqlite | Profiles, proxies, groups, members, macros, run history and the activity log. | Only if you turn on whole-database encryption |
| softglaze_profiles/ | One folder per profile: cookies, local storage, cache and extension data, exactly as Chromium and Firefox write them. | No |
| Your system keychain | 2FA seeds, proxy-provider API keys, the SMTP password, the sync token and the licence lease. | Yes, sealed by Windows through Electron’s safeStorage |
Encryption, stated exactly
2FA seeds and provider keys are sealed with your system keychain. Whole-database encryption is available and off by default. It encrypts the whole database with AES-256-GCM, using your workspace password as the key, and every field with it rather than a chosen few.
With the app closed, the file is ciphertext. While the app is running and unlocked there’s a decrypted working copy on disk, so it protects a stolen drive or a copied backup, not a machine someone is sitting at. Lose the password and the data can’t be recovered: there’s no reset and no backdoor.
Every outside service the app contacts
No telemetry and no SoftGlaze server, but the app is not silent. This is the whole list, what triggers each one, and whether it happens by default.
| Destination | When | What goes with it | Default? |
|---|---|---|---|
| googlechromelabs.github.io, storage.googleapis.com | On first run, and when you install another Chrome version | A download request. Google sees your IP address, as it would for any download. | Default |
| product-details.mozilla.org, ftp.mozilla.org | When you install or use a Firefox profile | A download request, and the SHA256SUMS file the installer is checked against. | Default |
| clients2.google.com | At startup, for the four bundled extensions | A request for each extension package. | Default |
| api.github.com, github.com | Only if you switch on the optional fingerprint-chromium engine | A release lookup and a download, checked against a pinned SHA-256. | Your choice |
| ipinfo.io, ip-api.com, get.geojs.io | When a proxied profile launches, to find where the proxy exits | The request goes through that proxy, so those services see the proxy’s address, not yours. | Default, can be turned off |
| ip-api.com, ipwho.is | When a profile opens the app’s start page | Same again, through the profile’s proxy. | Default |
| google.com, cloudflare.com | When you test a proxy, as two tiny “does real traffic work” requests | An empty response request, through the proxy. | When you test |
| Spamhaus, SpamCop, SORBS, Barracuda blocklists | When a proxy is checked | A DNS query containing the proxy’s exit IP address. | When you test |
| Your proxy provider’s API | When you connect a provider account | The API key you entered, to that provider. | Your choice |
| 2Captcha or Anti-Captcha | Only if you add your own solver key | The captcha challenge from the page being solved. | Your choice |
| Your SMTP server | When you invite a member by email | The invite email. If SMTP isn’t set up, nothing is sent and the code is shown in the app. | Your choice |
| Your own sync server | Only if you configure cloud sync | Encrypted ciphertext. Sync is off and has no endpoint until you set one. | Your choice |
| Another tool’s API | Only when you run an import from another anti-detect tool | The token you entered for that tool, to that tool. | Your choice |
| api.cryptomus.com, api.stripe.com, api-m.paypal.com | When you buy a plan inside the app | The payment request. Card details are handled by the provider, never by the app. | When you buy |
| The sites your profiles visit | Whenever you browse in a profile | Whatever that site sees: the profile’s fingerprint, and the proxy’s address if it has one. | You decide |
The geo lookups are what make a profile’s timezone and language match its proxy. You can turn them off in Settings, and profiles then use the values you set by hand.
What gets verified, and what doesn’t
The app downloads browser engines and extensions. Here is exactly how much each download is checked, because “verified” is a word worth being precise about.
Firefox
Checked against Mozilla’s own SHA256SUMS file. A mismatch stops the install.
fingerprint-chromium
Checked against a SHA-256 pinned in our source. A mismatch stops the install.
Chrome for Testing
Trusted on HTTPS plus a list of Google’s own hosts, and nothing more, because Google’s catalogue publishes no hashes for these builds.
Every download must be HTTPS and must come from a host on a per-vendor allowlist; a redirect to anywhere else is refused. Requests the app makes with a URL you typed, like a proxy rotation link, are refused if they point at your own machine or a private network address.
No telemetry, and one piece of history
The app collects no usage data and sends nothing to us. One earlier behaviour is worth writing down rather than leaving in the commit log.
What current builds do
Nothing is reported: no analytics, no crash reporting, no licence check-ins beyond the payment you make. The app has no server of ours to talk to.
What earlier builds did
Builds before September 2026 wrote a Windows registry policy that force-installed our recorder extension into every Chromium-based browser on the machine, so the Chrome Web Store would count those installs. That was wrong. The code is gone, and every launch now deletes the value if it finds it.
The source and the licence
You don’t have to take any of this on trust. The repository is public.
The source code is public under the Business Source License 1.1. You can read it, build it and test it for free. Using SoftGlaze for real work needs a paid licence, which is what the plans are. You can’t resell it or run it as a hosted service. This version becomes Apache 2.0 on 1 January 2030.
What we don’t have
A security page that only lists good news isn’t one. These are the gaps, and they’re the ones a careful buyer would find anyway.
| Gap | Detail |
|---|---|
| No SOC 2 or ISO 27001 | We don’t have either certification, and there has been no independent audit. What we can offer instead is the source and this page. |
| The installer isn’t signed | No code-signing certificate yet, so Windows SmartScreen warns about it. Check the SHA-256 on the download page before running it. |
| Windows only | No macOS or Linux build exists, so there’s nothing to review on those platforms. |
| Whole-database encryption is off by default | Until you turn it on, proxy passwords, per-profile account passwords and Data Vault passwords sit in plain text in the database on your computer. |
| One workspace, one computer | Members are accounts inside a workspace stored on one computer. There’s no hosted team server, so there is also no server-side audit trail beyond the app’s own activity log. |
| Local API keys aren’t scoped | A key for the local API can list and start every profile in the workspace, whatever role created it. |
Reporting a vulnerability
Email security@softglaze.com. You’ll get a first reply within two business days, then an update at least every seven days until it’s closed.
What to include
- What you did, on which version, and what happened.
- Enough detail to reproduce it, including a proof of concept if you have one.
- Whether you’ve told anyone else, and when you plan to publish.
There’s no bug bounty. It’s one person and $5 a month, so what you get is a fast reply, credit if you want it, and a fix.
Please don’t
- Test against anyone else’s workspace, accounts or proxies.
- Run denial-of-service tests or send spam through the app’s email settings.
- Publish before we’ve had a chance to fix it. Tell us a date and we’ll work to it.
Bugs that aren’t security issues are better as GitHub issues: they get a public record.
Read the rest before you install
What the app is for and what it isn’t, what we do with the little we hold about you, and the terms you’d be agreeing to.