How Octo Browser protects user data

Would you like to try Octo Browser at discount?
Use the promo code OCTOBLOG to get 30% off any subscription. This offer is valid only for new users.

What can threaten the data security of anti-detect browser users

Valuable data stored in anti-detect browser profiles can fall into the wrong hands if users accidentally share it with malicious actors, lose it as a result of an account breach, or if the anti-detect browser itself has a vulnerability.

The last scenario is unlikely, but it does happen. In January 2025, malicious actors exploited a vulnerability on AdsPower's side to replace cryptocurrency wallet extensions, such as MetaMask, with malicious versions. Users who installed or updated an extension between January 21 and 24 were at risk. The malicious code transmitted wallet seed phrases and private keys to the attackers. According to SlowMist's assessment, the losses exceeded $4.7 million.

This type of attack is not possible in Octo Browser: each team has its own isolated set of extensions, which are installed directly from the Chrome Web Store or from your own file, without a shared extension repository.

An additional risk arises when an anti-detect browser is used by a team of several people. In this case, a malicious insider could also delete profile data, transfer it to attackers, or use it for their own purposes.

How does Octo Browser protect user data

We've put all the necessary safeguards in place to keep our users' data secure:

• We store data on European cloud servers and encrypt it using the AES-256 standard. This is a highly secure encryption standard used by government and financial organizations, banks, and businesses.

• Our data storage architecture ensures that even if an attacker gains access to the database, they cannot access user profiles. Profiles are encrypted using several components: a secret key, a unique key from the database, and a user key if the profile is password-protected. Without access to even one of these components, a profile cannot be decrypted.

• Octo Browser employees only have access to the minimum amount of personal data required for analytics: email addresses, subscription types, and payment amounts. Employees cannot see what users do inside their profiles.

• You can further secure your account by enabling two-factor authentication (2FA). This means that signing in requires not only your password but also a one-time verification code from an authenticator app.

• Octo Browser profiles can also be protected with a password. Without it, a profile cannot be launched, transferred, or exported.

Setting a password for profile

• For teamwork, Octo offers folder-based access permissions, an activity log, the ability to revoke a team member's access, and the option to restore deleted profiles from the Trash. These features help reduce risks associated not only with external attacks but also with access by team members.

Granting access rights to work with profiles to a team member

Octo protects user data on its end, but account security also depends on the user's own actions. That's why it's important not only to rely on the browser's security but also to follow basic security practices.

What can you do to reduce the risk of losing your account or exposing your data

You can avoid many security threats by following a few basic information security practices:

• Use strong passwords and never reuse them across different websites.

• Store your passwords in a password manager, such as Bitwarden or Dashlane, rather than in a notepad on your desktop.

• Don't click unknown links.

• Never share your account login details or password with anyone.

• Don't install software or browser extensions from unknown sources.

• Give each team member access only to the profiles they need to work with.

• Install updates as soon as they become available.

• Register your Octo Browser account with an email address you will always have access to.

• Enable two-factor authentication and keep your backup codes in a safe place.

These are basic security practices, but some are easy to overlook. To refresh your knowledge or learn more, we've collected the main recommendations here.

Can I restore a profile or my account if I accidentally delete it

Deleted profiles don't disappear immediately. Instead, they are moved to the Trash, where they remain for 72 hours before being permanently deleted. The exception is profiles deleted through the API without being moved to the Trash: they are deleted immediately and cannot be restored.

An account can only be deleted by submitting a request to Customer Service and confirming access to the account:

1. Contact Customer Service through any convenient channel: by email at help@octobrowser.net, via the website chat, on Telegram or WhatsApp.

2. Let Customer Service know when you're ready to verify your identity. They will send a confirmation email with a link to the email address associated with your account.

3. Open the email and follow the link. It is valid for one hour.

4. If two-factor authentication is enabled on your account, enter your 2FA code.

If you're a team member, contact your team manager to request account deletion.

Account deletion is irreversible. All associated data and profiles will be permanently deleted. Your active subscription will be deactivated, access to the API and team members will be revoked, and your token and traffic balances will be reset to zero.