What work data stays on a personal computer, and how to keep it off

Opening work apps on a personal computer leaves data on it. There are five main things: browsing history, cookies, passwords saved in the browser, the copy a password manager keeps on the device, and downloaded files. Each one goes away in a different way. A password the person knows is another matter: they can write it down or save it in their own password manager, whatever the device settings say. To keep work data off the computer, use company Chrome settings to stop saving and downloads, and use a sign-in method that never hands people the password.

Five things a personal computer keeps

Cookies are files that websites create in the browser. Chrome’s help says one thing they do is keep you signed in. So on a computer that still has the cookies, the next person to open the service may find it already signed in.

The table shows how each of the five goes away. “Clear browsing data” is Chrome’s Delete browsing data dialog. The incognito window is covered in the next section.

Cached images and pages, and autofill entries such as addresses, are also stored on the computer. Clearing browsing data removes them too.

Two items need more than a quick cleanup. Saved passwords go only if the person picks that type when clearing data. Clearing data in Chrome doesn’t touch downloaded files. Its help says removing a download from the list takes it off the Downloads page, “not from your computer.” So asking someone to clear their history when they leave can leave both behind.

NIST SP 800-46, NIST’s guide to telework and personal-device security, explains why this matters. It tells organizations to assume that telework devices will end up with someone trying to recover sensitive data from them. Its main remedies are to encrypt sensitive data on the device or not store it there at all. It also notes that data can end up stored by accident, for example in the browser’s cache.

What an incognito window clears

Chrome has an incognito window that doesn’t keep history or cookies once you’re done. Chrome’s help says site data and the record of sites visited are removed when the incognito session ends, and the session ends only when you close every incognito window.

Some things stay. The same page says Chrome keeps downloaded files and any bookmarks you add. It doesn’t say how saved passwords are handled in incognito. Because nothing clears until the last window closes, a person who walks away with a window open also leaves the service signed in.

The copy a password manager keeps on the device

A password manager app on a personal computer keeps a copy of the vault there. Bitwarden’s help says it stores this copy in the desktop app’s folder or in the browser extension’s storage, encrypted until you unlock the vault. 1Password says its data is encrypted with the account password.

Removing someone doesn’t always reach that copy at once. 1Password says that if a person is offline when you suspend them, their items stay available until they next open 1Password while connected to the internet. Bitwarden says offline devices cache a read-only copy, including the organization’s items, and some apps keep it for a short time after removal. If you think that copy could be misused, Bitwarden advises updating the passwords that person could see. What to stop and what to change when someone leaves a shared password manager has the steps.

You can keep a vault off devices entirely in 1Password Business. 1Password says you can remove access from every app and allow only 1Password for Web, so the vault isn’t cached on the device. That vault then opens only in a browser, on company computers too.

Company Chrome settings that reach a personal computer

Chrome settings pushed from the Google Admin console can reach a personal computer in two cases. One is a Chrome browser the company has enrolled, on Windows, Mac or Linux, where no sign-in is needed. The other is any device where the person signs in to Chrome with a company-managed Google Account. Google’s help says the settings don’t apply when someone signs in with an account outside the organization, such as a personal Gmail account. You need Google Workspace, Cloud Identity or another qualifying Google plan, and user settings apply only to accounts on a domain you’ve verified.

These settings affect what stays on the computer. Names are as they appear in the Admin console.

Sync is how Chrome keeps the same data across a person’s devices. Google recommends keeping sync on with ephemeral mode, while Browsing Data Lifetime can turn sync off for the data it deletes. Pick one approach before you roll either out. Should employees save work passwords in the browser? covers the password setting in more detail.

All of these work only inside a Chrome that is enrolled or signed in with the company account. On the same computer, an unenrolled Chrome with a personal account, or a different browser, gets none of them. Options for letting staff use personal devices for work systems compares this with managing the whole device or streaming a remote desktop.

Passwords that device settings can’t remove

Browser settings stop only what the browser saves. If someone knows the password, they can write it in a notebook or save it in their own password manager. No device setting reaches that.

So keeping passwords off a personal computer means people never learn them. The sign-in has to work without showing the password on screen, and without saving it in the browser or a password manager. A password manager’s option to share a login with the password hidden doesn’t meet this. The item still lands in the person’s vault, and as Bitwarden notes, offline devices cache organization items. Does hiding a shared password keep it secret? goes through how the main products handle it.

Decisions to make before you allow personal computers

1. Which browser, and which account, people must use for work apps. Company settings reach only an enrolled Chrome or one signed in with a company account.
2. Whether downloads are allowed. A downloaded file stays after the window closes and after browsing data is cleared.
3. Whether people may open a password manager vault in the app on their own computer. The app keeps a copy there, and removing someone may not reach it right away.
4. Whether people are given the password at all. A password someone knows can’t be taken back by a device setting.