URL Category Data for Secure Enterprise Browsers
An enterprise browser enforces policy where work actually happens: inside the tab. It can block a site, but it can also allow the site and stop a paste, an upload or a download on it.
Those finer controls need to know what kind of site the user is on. This guide shows browser product teams where URL categories plug in, which categories matter and how to ship the data inside the browser.
- NavigateAllowed
- Paste from work appsBlocked
- File uploadBlocked
- DownloadAllowed
- ScreenshotAllowed
Why a browser needs category data
Network tools see a connection to a domain. The browser sees the page, the user's action and the data involved, which opens up controls that networks cannot apply.
Navigation
Allow, warn, block or open in an isolated mode when the user loads a page, decided by category.
Clipboard
Stop paste of text copied from work apps into risky categories, such as unsanctioned AI tools.
Uploads
Block or inspect file uploads to personal storage, file sharing and messaging sites.
Downloads
Block or scan downloads from file sharing, freeware and unknown new domains.
Print and capture
Limit printing and screenshots on internal apps, while public categories stay unrestricted.
Credential entry
Warn when users type work passwords on sites outside known business categories.
Privacy mode
Switch off detailed logging on banking and health sites so personal use stays private.
Usage insight
Show admins which categories and SaaS apps staff use, as input for policy and licence decisions.
Category by control: a default policy matrix
This is a starting matrix many browser vendors ship and let admins edit. Each row is a category group, each column an in-browser control.
| Category group | Visit | Paste in | Upload | Download | Enter work password |
|---|---|---|---|---|---|
| Sanctioned SaaS (your app list) | Allow | Allow | Allow | Allow | Allow |
| AI / LLM Tools, unsanctioned | Allow | Block | Block | Allow | Inspect |
| Cloud Storage / File Hosting, personal | Allow | Inspect | Block | Inspect | Inspect |
| File Sharing/P2P | Inspect | Block | Block | Block | Block |
| Email and Messaging, personal | Allow | Inspect | Block | Inspect | Inspect |
| Social Networking | Allow | Inspect | Inspect | Allow | Inspect |
| Freeware/Software | Allow | Allow | Allow | Inspect | Inspect |
| Phishing, Malware, Suspicious | Block | Block | Block | Block | Block |
| Unknown or very new domains | Inspect | Block | Block | Inspect | Block |
| Online Banking, Health & Medicine | Allow | Allow | Allow | Allow | Inspect |
AI tools: the control customers ask about first
Most enterprise browser deals now include a shadow AI question. The browser is well placed to answer it because it sees the paste and the upload, not only the visit.
What the data provides
The AI / LLM Tools category is backed by 11,800+ AI-tool domains in 18 categories and 165 subcategories, updated daily.
- Chat assistants, code assistants, writing tools
- Image, video, music and voice generators
- Meeting note takers and transcription tools
- New AI tools picked up as they appear
Controls that build on it
Rules can differ by AI subcategory, which avoids one blunt block for every AI site.
- Allow sanctioned assistants with full use
- Read-only access to unsanctioned assistants
- Block uploads to image and video generators
- Prompt a reason before pasting into code assistants
- Report AI use by team for governance reviews
Other categories a browser policy needs
Data controls get the attention, but customers also expect the security and acceptable use basics. These categories round out a default browser profile.
| Category | Browser use | Suggested default |
|---|---|---|
| VPN / Proxy / Anonymizers | Web proxies let users reach blocked sites from inside an allowed tab | Block, alert admin |
| Remote Access Tools | Browser-based remote control is common in support scams | Allow IT-approved tools only |
| URL Shorteners | Hide the real destination until the redirect | Follow redirect, decide on the final host |
| Parked / For-Sale Domains | Often lead to ad networks or scam pages | Warn |
| Web-based Applications | Discover SaaS apps in use outside the sanctioned list | Allow, report, restrict uploads |
| Developer Tools / Code Hosting | Source code can leave through public repositories and paste sites | Allow, inspect uploads and paste |
| Adult, Gambling, Hate/Discrimination, Weapons | Acceptable use on work profiles | Block on work profile |
Shipping category data inside the browser
A browser cannot wait on a slow network call before every navigation. The data needs a local tier and a cloud tier.
Local list in the policy bundle
Build a compact list from the licensed file and ship it with each tenant's policy. The browser checks it first at navigation start.
- Security categories in full
- AI, storage, file sharing, messaging and email
- The most visited domains for everything else
- Signed and versioned for safe updates
Cloud lookup for misses
Hold the full database in your own cloud, loaded from CSV, Parquet or JSON. The browser asks it on a local miss and caches the answer.
- All 120 million categorized domains
- Daily delta files applied once, centrally
- Our lookup API as a last fallback
- Domain only, never full URLs
Local hit
Decision made before the page starts loading. No network round trip.
Cloud hit
A small request to your service. Apply a cautious default while it is pending.
Unknown
Allow the visit with data controls locked, or open in isolation mode.
Offline
The local list keeps security and data rules working without a connection.
Freshness: keeping the browser current
Phishing pages and new AI tools appear daily. Content labels for established sites change slowly, so the update plan can be split.
About 300,000 newly registered domains are categorized and arrive as a delta file. Your service merges it and publishes new local lists.
Browsers pick up the new list with their regular policy refresh, without a browser update.
New domains are checked again, because many sites add content after launch. Changes arrive in the deltas.
A second recheck of the same new domains, again through the deltas.
All other domains are refreshed. Rebuild the cloud store and local lists from the new file.
Unmanaged devices, contractors and BYOD
Many enterprise browser deployments target devices the company does not manage. Category data travels with the browser profile, so the same rules apply anywhere.
Contractors
Access to internal apps only through the browser, with paste and upload blocked to personal storage, email and AI tools.
Personal laptops
Work profile rules apply only inside the work browser. Personal browsing in other browsers is not touched or logged.
Call centres and BPO
Tight allow lists for business apps plus category blocks for everything outside work, including messaging and social sites.
Mergers
Acquired staff get access to core apps on day one, with category rules protecting data before devices are rebuilt.
Frontline and shared devices
Kiosk-style profiles that allow a short list of categories and block the rest.
Privacy commitments
Banking and health categories can be excluded from detailed logs to respect employee privacy rules.
Integration mistakes browser teams make
These problems surface after rollout, usually as help desk tickets or bypasses. They are cheap to fix in design.
Blocking whole categories
Blocking every AI or storage site sends users to their phones. Allow the visit and control the data actions instead.
Only the registered domain
Big platforms serve very different content on different hosts. Look up the full host first, then the parent domain.
One label per site
Domains can carry several ranked labels. Data controls should react to any matching label, not only the first.
No reason shown
Tell users which category triggered a block and how to request access. It cuts tickets and builds trust in the tool.
Lists that grow stale
Show list version and age in the admin console. Flag browsers that have not synced recently.
Exposing the raw list
Shipping the list unprotected inside the browser lets anyone extract it. Store it in a protected format, as the licence requires.
How a category decision runs inside the browser
The same lookup serves navigation and every later action on the page. Doing it once per page load and keeping the result with the tab avoids repeated work.
The browser takes the host from the address and normalizes it. Internal app hosts from the tenant's own list are matched first.
The full host is checked against the local list, then the registered domain. All ranked labels are returned, not only the first.
Tenant policy picks allow, warn, block or isolate. The labels and decision are stored with the tab.
Paste, upload, download, print and password entry read the stored labels. No new lookup is needed for each action.
A redirect to a new host triggers a fresh lookup. Embedded frames from other hosts can get their own labels for upload rules.
The browser sends a compact event with host, labels and action. Privacy categories are logged with less detail by default.
Questions security architects ask browser vendors
Buyers of enterprise browsers compare how each product handles categories. Having clear answers shortens security reviews.
| Question | What a strong answer covers |
|---|---|
| How many domains are categorized? | Total coverage and coverage of the domains our staff actually visit, measured on a sample of our own logs |
| How quickly are new sites labelled? | Daily handling of newly registered domains, and what the browser does with a domain that has no label yet |
| Can we tell AI tools apart? | Separate handling for chat assistants, code assistants and media generators, not one AI switch |
| Does browsing data leave our tenant? | Local lookups first, domain-only cloud lookups, clear retention periods |
| Can we override a label? | Tenant-level overrides that apply at once, plus a way to report a disputed label |
| Does it work offline? | Security and data rules keep working from the local list when the device has no connection |
| Will rules match our network tools? | The same category names and versions used in the browser, the gateway and reports |
Build plan and licensing
A browser team can ship category-aware controls in stages. Each stage is useful on its own.
| Stage | What you build | Data used |
|---|---|---|
| 1. Visibility | Category usage reports in the admin console | Cloud store or batch API over browsing logs |
| 2. Navigation rules | Allow, warn, block and isolate by category | Local list plus cloud lookup |
| 3. Data controls | Paste, upload, download and print rules per category | Same local list, more categories |
| 4. AI governance | Rules by AI subcategory and AI usage reports | AI tools set, updated daily |
| 5. Scale and sovereignty | Regional stores, air-gapped tenants | Licensed files only, no outbound calls |
Enterprise browser category data questions
What does a secure enterprise browser do with URL categories?
It uses them to decide what happens at navigation and inside the page: allow, warn or block a site, and whether copy, paste, upload, download, print or screenshots are allowed there. Categories let one rule cover thousands of sites.
Can the category data live inside the browser?
Yes. A compact list built from the licensed file can ship with the browser policy bundle, covering security categories and the most visited domains, while misses go to your cloud service.
Which categories matter most for browser controls?
AI / LLM Tools, Cloud Storage / File Hosting, File Sharing/P2P, Web-based Applications, Email and Messaging, Social Networking and the security categories. They decide where data can be pasted, uploaded or downloaded.
How are AI tools handled?
The AI / LLM Tools category is backed by 11,800+ AI-tool domains in 18 categories and 165 subcategories, updated daily. Browsers can allow sanctioned assistants, block paste into others, and treat code assistants or image generators differently.
Does the browser need to send URLs to a third party?
No. The licensed database runs in your own systems or inside the browser bundle, and if you use our lookup API for misses, send only the domain.
How often should browser lists update?
Daily for security and AI categories. About 300,000 newly registered domains are categorized every day and delivered as delta files, while other domains are refreshed monthly.
Does this work for unmanaged and contractor devices?
Yes, that is a main use of enterprise browsers. The policy and category list travel with the browser profile, so the same rules apply on a personal laptop without device management.
What licence does a browser vendor need?
An OEM licence, since the data is embedded in a product your customers use. Resale or publication of the raw data, such as exposing the full list in the browser, is not allowed.
Can users see why an action was blocked?
Yes, and they should. Show the category that triggered the rule on the block notice, along with a way to request access, so users understand the policy and the help desk gets fewer tickets.
How are subdomains and redirects handled?
Look up the full host first and fall back to the registered domain, so labels for specific hosts are kept. When a page redirects to a new host, run a fresh lookup and apply the policy of the final destination.
Can the same data drive our gateway and our browser?
Yes. One licensed file can feed the browser's local list, your cloud lookup service and any network product you sell, which keeps category names and decisions consistent across all of them.
Make every tab category-aware
Tell us how your browser syncs policy and how many tenants you serve. We will suggest a local list size, a cloud setup and the OEM licence that fits.
Talk to us OEM licensing