← Device security

Your devices stay yours.

IRIS guardian companions are open-source applications with Free and Pro service plans from HANS Society Foundation. This page explains the browser guardian companion, the Mac guardian companion and their connections to the IRIS web dashboard.

Your browser guardian companion

The browser companion uses the management permission to list installed extensions and explain their reported permissions. You can turn off extensions you do not need and restore supported changes from the companion. Removing an extension requires the browser’s confirmation and may erase that extension’s settings. It cannot change an extension’s individual site permissions; those remain in browser settings. Permissions indicate possible access and are not a malware verdict.

Storage in this browser profile remembers your trust choices for 30 days and resets them when an extension version or reported permissions change. It also records changes needed for restoration. Use Forget saved review choices to clear trust decisions. Removing the browser companion removes its local storage. IRIS does not request access to page contents, clipboard contents, passwords or wallet secrets. In companion version 0.2 and later, you can optionally grant history access to check up to 5,000 entries from the last seven days against a packaged crypto-phishing list. History is read only when you start the check. Raw URLs are not saved or uploaded; the companion stores matched hostnames locally. Saved checks expire after seven days and are removed when the companion next runs. Use Forget check & remove history access to clear the result and revoke access immediately. A link check also runs locally and does not save the entered link.

Official companion scans in version 0.4 and later require a connected IRIS account. Free includes one manual scan per companion per calendar month (UTC); Pro includes unlimited scans and background monitoring. Reviewing saved findings, supported quarantine and recovery, and updates remain available on both plans. When you choose Connect to IRIS, app.undercoveriris.io can read this browser’s extension names, versions and permission summaries directly for 30 days. If you enable extension-change watch or run a recent-browsing check, monitoring status, check date and aggregate counts can also be displayed. Matched hostnames from the optional history check stay in the extension. Live scam-warning hostnames and times can be displayed after you enable scam protection, as disclosed by its toggle. These browser reports are displayed directly in the website and are not uploaded to the IRIS server. Separately, the server stores your account association and a hashed companion credential for up to 30 days, five-minute pairing invitations, rate-limit counters, and the month and random identifier of a Free scan attempt for up to 40 days. Plan checks contain no history, extension list or wallet secrets. Disconnect removes the companion credential; the monthly usage record remains to enforce the allowance. Anyone using this browser profile can open its local review. Disconnect in either interface to stop web sharing. The website cannot directly enable or disable another extension; you choose changes inside the companion.

The browser companion uses extension metadata, your saved review choices and optionally selected browsing checks only to provide these security reviews and the optional IRIS dashboard connection. Extension-change watch uses browser events and a toolbar badge. Separately, optional known-scam protection uses the browser’s declarativeNetRequest API to block top-level navigation to listed hostnames and their subdomains. The optional webNavigation permission allows IRIS to show a warning and check up to 100 already-open tabs when you enable it. Page contents and normal browsing history are not saved. Warning hostnames, times and blocked/already-open status are retained for up to 30 days (at most 100 events), pruned when the companion runs, and shared with the connected dashboard. Clear scam warning activity removes that local activity. Navigation permission can be revoked in browser settings; IRIS then disables protection. We do not sell this data, use it for advertising or credit decisions, or make it available for staff review. Its data use follows the Chrome Web Store User Data Policy, including its Limited Use requirements.

Browser installation links to the official Chrome Web Store listing. New companion features become available after the corresponding store update is approved. The browser companion can work independently of the Mac app and Apple’s release process.

Your Mac guardian companion

What is checked

KnockKnock reviews software that can start automatically. ClamAV checks accessible startup files, Downloads and Desktop against malware definitions. A keyboard privacy check adapted from ReiKey lists active CoreGraphics keyboard listeners and the apps responsible. It does not record keystrokes, inspect clipboard contents or install a keyboard listener. This is an on-demand snapshot, not continuous monitoring or a complete detector of all keylogging methods. IRIS also reads the status of FileVault, the Mac firewall and Gatekeeper, and opens System Settings for changes you choose. The review states its coverage and any limits. An unfamiliar or unsigned program is not automatically malware, and a completed scan cannot guarantee a device is clean.

Pro monitoring uses macOS file-change events while IRIS is running to check changed files in Downloads, Desktop and your user LaunchAgents folder. It does not block execution or monitor every device location. Coverage gaps and access limits are shown. Plan access is checked about every three minutes and expires after five minutes without verification. Mac plan checks use the connected account and the same monthly usage records described above.

Finding explanations inspect supported shell setup files locally for a small set of command patterns and validate code signatures where available. A familiar filename, absence of a pattern, or valid signature does not certify safety. Only evidence descriptions, not script contents, appear in the connected report. Supported user-owned files can be quarantined after confirmation; original paths and recovery details stay locally. Permanent deletion requires a separate confirmation and cannot be undone by IRIS.

What leaves your Mac

Files are scanned locally. IRIS does not upload files, file hashes, browser history, email contents or documents for reputation checks. VirusTotal is not used. The app downloads KnockKnock from GitHub and updates malware definitions from ClamAV’s infrastructure. Those services receive normal network information, including your IP address.

Only after you connect the Mac app, an encrypted report is sent through IRIS’s server. It includes findings, software names, signature evidence, scan coverage and file locations with the home-directory prefix replaced by “~”. File names can still contain personal information. The server stores the encrypted report for up to 24 hours after each upload. Connected apps may upload updates while running.

Mac app updates

Mac companion 0.3.1 and later uses Sparkle to check for app updates automatically, normally once a day. You can check manually or disable automatic checks in About. Automatic downloads are optional. Update checks and downloads contact GitHub, which receives normal network information such as your IP address and app version; scan reports and personal files are not included. Sparkle system profiling is disabled. The update feed and download must have valid signatures before extraction. IRIS waits for an active scan to finish before restarting to install an update.

Your browser and Mac hold the key

The encryption key is generated in your browser and passed to the Mac app through a connection link. Confirm the same code in both places. IRIS’s relay server does not receive that key and cannot read encrypted report contents or commands. Your browser stores the connection key locally; the Mac stores it in Keychain. Sign out on shared computers and disconnect a browser you no longer trust.

A connection lasts up to 30 days. The relay also stores your account association, a hashed device credential and last-contact times. Connection invitations expire after five minutes; requested actions expire after two minutes. Disconnecting deletes the connection, its encrypted report and any pending action. Clearing browser storage loses that browser’s key and requires reconnection. The Mac keeps its last encrypted review locally until it is replaced or removed using About → Remove saved review. Reviews older than 30 days are not reopened. Quarantine files remain until you restore them or remove the application’s stored data.

You control cleanup

File changes requested from the web dashboard require confirmation in the Mac app. Keyboard review actions open macOS privacy settings; you control permission changes there. Opening settings does not mark a finding resolved. A recheck updates only keyboard findings and preserves your other scan results. Supported, user-owned files are moved into a private quarantine and can be restored. IRIS does not silently delete files or request unrestricted administrator access. System software, application bundles and other unsupported items need guided review. A quarantine action does not guarantee that already-running software has stopped.

In Mac companion version 0.3 and later, you can explicitly trust a reviewed item. IRIS encrypts this choice locally and remembers it until you remove the choice or the inspected file, signing snapshot or relevant access evidence changes. Known-threat and malware-pattern findings cannot be trusted away. You can choose Review again under Trusted by you. The web dashboard receives the trust status as part of its encrypted report. In browser companion version 0.3 and later, the combined browser scan also shares its progress and completion/partial status with the connected web page.

Optional UBAI rewards

Mac 0.4.2 and browser 0.4.1 add a minimal authenticated scan-completion receipt for the linked IRIS account. It contains the connection and scan identifier, with no findings, file contents, history or extension inventory. IRIS records completed milestones so you can claim one-time bounties. Claiming is optional; reward and anti-fraud records remain separate from local security reports. Read UBAI rewards privacy before claiming.

Open-source credits

IRIS verifies pinned upstream SHA-256 checksums and Apple signing identities. KnockKnock is downloaded unchanged. ClamAV is bundled into IRIS with adjusted library paths and new release signatures; its exact corresponding source and required notices accompany the release. These projects are independent of IRIS and do not endorse it.

Questions: support@joinhans.io.

Device companion disclosure · Version 4 · September 6, 2026

Platform icons: Apple artwork from Simple Icons (CC0). Apple and Google Chrome names and marks belong to their respective owners; their appearance does not imply endorsement.