Security and data

ClearScreen filters at DNS on the device. It does not decrypt TLS traffic.

What is stored

In the workspace: your policy, enrollment records, device records and block events (device, domain, category, source and time).
On the device: the cache with the signed bundle and policy (%PROGRAMDATA%\ClearScreen on Windows, /var/lib/clearscreen on Linux), the device key and a JSONL audit file of local blocks.
Standalone devices send nothing to a workspace.

Where it is stored

Trials run in the EU. A paid workspace runs in the region chosen at purchase and its database is stored there. The regions are the European Union, United Kingdom (London), United States (Virginia), Canada (Montréal), Asia–Pacific (Singapore), Latin America (São Paulo) and Middle East and Africa (EU-hosted).

Whatever the region, the shared bundle files and the hourly backup dump are stored in Cloudflare object storage in Western Europe. ClearScreen is operated by Spot Cloud B.V.

How filtering works

The agent runs a local DNS resolver on 127.0.0.1:53 and sets the system resolver to it. It restores the resolver when it stops.
Blocked names resolve to the local block page. There is no TLS inspection, PAC file or network gateway.
Every bundle is verified against an Ed25519 signature before use.

The agent on Windows sets IPv4 DNS only, so IPv6 DNS and apps with their own DNS can bypass filtering.