Page execution moves off your device.
Shield opens a page in an isolated browser off your device. It changes the execution boundary. It does not replace account or endpoint controls.
Trust center
Security and isolation, by design.
Shield opens a page in an isolated browser off your device. Ghost gives your browser a private route. This page separates verified scope from controls you still own.
Compliance posture
One status, stated plainly.
SOC 2 TYPE IIin progress
Our SOC 2 Type II audit is in progress. Controls are tracked in Vanta. We share control detail and questionnaire responses on request for enterprise evaluation.
This is our only compliance claim. We do not list certifications we do not hold.
Isolation boundary
What isolation changes.
Two modes define the current extension. Each changes one boundary. Neither removes the need for account, endpoint, and data controls.
Your browser gets a private route.
Ghost changes the network path for your browser. It does not hide the identity of an account you sign into.
The boundary needs verification.
Test cookies, local storage, downloads, clipboard, logs, and support access. Record what persists and for how long.
Data handling review
Verify before production.
Do not infer retention from isolation alone. Test the current product. Document the result for your exact workflow.
Map every data path.
List inputs, outputs, logs, support access, and retained artifacts. Assign an owner and retention period to each one.
Close and verify.
End a test session. Then check accessible state, account activity, and retained artifacts. Use observed behavior in your review.
Responsible use
Consented access only.
Consented-access use cases.
Legba is built for access the end user has agreed to. Account access, authorized automation, and security testing on assets you own or are permitted to test.
The buyer holds the consent.
You hold explicit consent from the user whose access you drive. We enforce this at onboarding. Use outside that scope is not permitted.
Company
Who to reach, and how.
- Entity
- Legba, Inc.
- Location
- Phoenix, Arizona
Read our disclosure policy at /.well-known/security.txt. For security questions, reach us at support@legba.app or through contact.
FAQ
Common questions.
Where do sessions run?
Shield opens a page in an isolated browser off your device. Ghost provides a private route for your browser.
What is retained after a session?
Verify current behavior before production use. Test cookies, local storage, downloads, clipboard, logs, support access, and any retained artifacts.
How are credentials handled?
Treat credentials as sensitive. Use least privilege. Confirm input paths, logging, support access, and retention with the Legba team before deployment.
What is Legba’s SOC 2 status?
Our SOC 2 Type II audit is in progress. Controls are tracked in Vanta. We share control detail and questionnaire responses on request for enterprise evaluation.
Can session state persist between runs?
Confirm current persistence behavior with the Legba team. Do not rely on assumed cleanup or retention behavior.
Use the internet without the internet using you.
Legba is a Chrome extension with two modes. Ghost gives you a private browser route. Shield opens a page in an isolated browser off your device.
Free for 30 days. No card required.
Ghost. A private route for your browser. Shield. An isolated browser, off your device. Choose the mode. Close when finished.