Seeking Assurances on getDisplayMedia Security and Local-Only Data Handling

[EvanBC1]

Hello and thank you in advanced,

I am using the getDisplayMedia method (https://developer.mozilla.org/en-US/docs/Web/API/MediaDevices/getDisplayMedia) to capture a screen recording or screenshot (with the user’s consent) that may include sensitive information. This data will be uploaded to our app for processing.

Our legal and compliance team is concerned that the getDisplayMedia function might send this captured data to the browser company or other third parties, rather than keeping it confined to the local device. They are seeking official documentation or assurances that this functionality operates exclusively on the user's local machine and that no third-party transmission occurs unless explicitly programmed.

Does such documentation exist to confirm that getDisplayMedia is local-only and that captured data is not sent elsewhere by default? Additionally, is there guidance we can use to show how this data is handled securely and deleted when the browser session ends?

We have been looking through the mdn and w3c docs and have not found anything that states this explicitly.

Thank you.