How EPIC treats your data and your sites.
Browser-native intelligence, with transparency and control. Because EPIC operates in your browser, it requests the permissions it needs to inspect and, when you choose, test or modify what the browser can see. Those permissions deserve a clear explanation.
Everything starts on your device
EPIC is designed around browser-native, local-first investigation. Your scans, history and reports are kept in your browser. EPIC has no analytics, advertising, crash-reporting or tracking code, and it does not send what you scan to EdgePro Workbench.
A short summary of all of this also lives inside the panel, under Monitor → Data and privacy, so you can read it next to the work.
What EPIC can access
EPIC uses browser permissions to support capabilities such as network diagnostics, application inspection, testing, modification and evidence collection. Permissions including debugger and <all_urls> enable these workflows. They do not mean that every capability runs automatically, or that every site is actively tested. EPIC acts on the tab you choose, when you start a scan, a journey, a crawl or a modification.
Scanning observes; changing is a separate step
Quick Scan and App Crawl read what the page already sends to your browser. App Crawl follows links with GET only, and is designed to avoid submitting forms or triggering logout, delete or payment actions. Changing a page is a separate Modify action that you start yourself, in your own browser, on a page you are testing. The real site is never changed.
How active checks are controlled
EPIC includes safeguards for its active probe workflows. In controlled release validation:
- Probes required explicit authorization before they ran.
- Probe requests used GET methods and omitted credentials.
- Application crawling avoided the tested destructive actions, including logout, account deletion and unsubscribe operations.
- Security findings were checked against known-positive and known-negative test cases.
These results describe tested behavior. They are not a guarantee that every website or application will behave identically, and a GET request is a safe method rather than a promise of no side effects on every server, which is why the authorization step stays.
How EPIC protects exported evidence
EPIC applies masking and redaction to credentials, tokens, cookies and other sensitive values in supported saved records and exports. The v1.5 release validation tested evidence exports and backups against representative secrets, tokens and cookie values; those test values were not present in the inspected outputs. The one exception is the full HAR file, which keeps the original data, is offered only after a warning, and is named so you can tell it apart.
Local-first by design
EPIC is designed around browser-native, local-first investigation. Some functions make external requests, and these are disclosed alongside the features that use them:
- License validation with Lemon Squeezy, our payment provider: the license key and a random instance id for your installation.
- Optional domain and email-domain checks (SPF, DKIM, DMARC, MTA-STS, TLS reporting) that send only domain names to Google Public DNS, and only when you click them.
Beyond these, EPIC's requests go to the site you are analyzing, as part of the scan, crawl, journey or API work you start. Nothing is sent to EdgePro Workbench.
Findings are evidence, not verdicts
Each finding is marked Observed (shown directly by browser evidence), Potential (a signal that needs confirmation) or Verified (shown by an authorized, repeatable check). EPIC gives you evidence for your review. It does not determine compliance, and its security and compliance signals are not a complete assessment, a penetration test or a compliance certification.
What validation has been completed
EPIC v1.5.1 passed its automated check suites across interface behavior, workflows, capture, extraction, findings and safety, with additional suites for the full regression on the shipped Chrome and Edge packages and for the update from the previous version. Real-world detection accuracy and authenticated-application behavior remain areas for continued validation.
Our commitment
We aim to make EPIC's permissions understandable, its active testing deliberate, its findings evidence-based, and its exported information appropriately protected.
Inspect with context. Test with control. Report with confidence.
See it for yourself, on your own site.
The free plan gives you the full picture of any page, with your data kept on your device. No account, no card.