Overview
See how it works in seven minutes.
Our founder Brian Silverstein walks through how Haven Enterprise protects customer sessions from bots, fraud and malicious extensions, without changing how your app looks or feels.
Recorded under our former name, MirrorTab.
What it stops
No DOM. No foothold.
Bots, fraud tools and agentic AI all need to read and change your app in the browser. Take that away, and these attacks have nothing to work with.
Bots and agentic AI
- Account takeover and credential stuffing
- AI-powered bots and agentic AI attacks
- Content scraping and data harvesting
- API abuse
Fraud
- Automated money movement
- Transaction fraud
- Concurrent session exploitation
- Access from untrusted devices
Attacks inside the browser
- Man-in-the-Browser and malicious extensions
- Formjacking and script injection
- Cookie and token theft
- Clickjacking and redirect attacks
How it works
How does Haven Enterprise protect a session?
It plugs into the edge you already run: your CDN, WAF, load balancer and fraud platform. Your app keeps working the same way for real customers.
No DOM in the browser
Your app's code, APIs and data stay on your side. The browser receives a rendered view, so there is nothing for a script or extension to read.
Less on the device to leak
Sensitive data and session tokens stay off the end user's device, so a compromised laptop or a bad extension has far less to steal.
No plugins or agents
It runs server-side in the cloud. No changes to your application code, and nothing for your customers to install.
Drag to see the DOM disappear with Haven Enterprise
You decide when it switches on
Protect only the workflows that matter, and trigger protection from signals you already have.
Workflows
Triggers
Integrations
Works with the edge you already run.
Haven Enterprise adds to your CDN, WAF and load balancer rather than replacing them. Watch how it deploys on each platform.
Man-in-the-Browser
What does a Man-in-the-Browser attack look like, and where does it stop?
A trojan installs a browser extension that waits for your transaction page, then reads and rewrites the form before it is sent. Your server can't tell the difference. Here is where the chain breaks.
Compare
How is this different from what you already use?
Bot tools try to spot automation or slow it down. Haven Enterprise takes away the code, DOM and tokens that automation relies on, in the workflows you protect.
Bot detection
How it stops bots
Scores traffic with rules, fingerprints and behavior models, then blocks or challenges what looks automated.
Works alongside it: your bot score can switch Haven Enterprise on, which then takes the code, DOM and tokens out of the browser for that session.
Account protection
Where it focuses
Mainly the sign-in: credential checks, MFA and risk scoring at login.
The workflows you choose, including after login, like payments and account changes.
Code obfuscation
What's left in the browser
Code that is harder to read, but still runs in the browser.
In protected workflows, code, DOM and tokens stay on your side. The browser gets a rendered view.
Enterprise browsers
Who uses it
Your employees, in a managed browser you roll out to them.
Your customers and partners, in the browser they already use, with nothing to install.
Remote browser isolation
What it isolates
Risky sites and links your employees open, run remotely and streamed back to them.
Your own app's sensitive workflows, for your customers and partners, rendered server-side in the cloud.
Who it's for
Built for teams whose web app is where the money moves.
Banking and fintech
Protect logins, payments and account changes from session takeover and automated money movement.
E-commerce and marketplaces
Protect checkout and account flows from scrapers, formjacking and transaction fraud.
Partner and customer portals
Share sensitive web apps with outside users without sending your app's code or DOM to their devices.
Read the Financial Services and e-Commerce datasheet
Haven Business or Haven Enterprise?
They protect the browser from two different sides.
Haven Business
Protects your people as they browse.
A browser extension for every employee: link checks, site verification, download protection and extension pausing.
Explore Haven BusinessHaven Enterprise
Protects the sessions on the web apps you run.
Server-side in the cloud, plugged into your edge, for your customers and partners. Nothing for them to install.
Book a demoRecognition
Recognized by the security community.
Awarded and covered under our former name, MirrorTab.
Our story
Built by Honey's co-founder.
Haven Enterprise was created by Brian Silverstein, former CTO and co-founder of Honey, the browser extension acquired by PayPal.
"At Honey, we built the world's most popular browser extension by working deep in the DOM. Now we're flipping the model, removing the DOM entirely to stop automation from bots, fraud and agentic AI."
Resources
Go deeper.
Is Haven Enterprise the same product as MirrorTab?
Yes. MirrorTab is now Haven Enterprise. It is the same technology and the same team, now under the Haven name. The company behind it is still MirrorTab Corp.
How is it different from Haven Business?
Haven Business is a browser extension that protects your employees as they browse. Haven Enterprise protects the sessions on the web apps you run, for your customers and partners, server-side in the cloud.
Do my customers need to install anything?
No. Haven Enterprise runs server-side in the cloud and plugs into your existing edge. There is nothing for your users to install and no change to your application code.
Which edge platforms does it work with?
Any edge platform, including CDNs, WAFs and load balancers such as Cloudflare, Akamai, Fastly and HAProxy. It extends the stack you already have rather than replacing it.
Does it protect every page of my app?
You choose. Haven Enterprise switches on for select workflows, such as login, money movement or account changes, and can be triggered by your WAF, a bot score, the user's auth state or a feature flag.