A computer device, comprising: a download unit arranged to download a file into a storage device; a file logging unit arranged to record a resource locator identifying a source network location of the file; and a system policy unit arranged to store a plurality of URLs each being associated with a respective process control policy which defines process execution privileges; characterised in that: the file logging unit in response to downloading the file to the computer device is arranged to record the resource locator associated with a first fingerprint of the file recorded together securely in a file logging table; and a process control unit is arranged to: obtain a second fingerprint of the file upon launching a process in a runtime execution environment based on the file, wherein the second fingerprint is obtained at a later time after recording the first fingerprint, retrieve the resource locator from the file logging table of the file logging unit by using the second fingerprint to match with the first fingerprint stored in the file logging table, retrieve the process control policy from the system policy unit according to the retrieved resource locator, by using the retrieved resource locator to match with one of the URLs stored therein; and selectively apply the process execution privileges which determine execution of the process in the runtime execution environment according to the retrieved process control policy. a download unit arranged to download a file into a storage device; a file logging unit arranged to record a resource locator identifying a source network location of the file; and a system policy unit arranged to store a plurality of URLs each being associated with a respective process control policy which defines process execution privileges; characterised in that: the file logging unit in response to downloading the file to the computer device is arranged to record the resource locator associated with a first fingerprint of the file recorded together securely in a file logging table; and the file logging unit in response to downloading the file to the computer device is arranged to record the resource locator associated with a first fingerprint of the file recorded together securely in a file logging table; and a process control unit is arranged to: obtain a second fingerprint of the file upon launching a process in a runtime execution environment based on the file, wherein the second fingerprint is obtained at a later time after recording the first fingerprint, retrieve the resource locator from the file logging table of the file logging unit by using the second fingerprint to match with the first fingerprint stored in the file logging table, retrieve the process control policy from the system policy unit according to the retrieved resource locator, by using the retrieved resource locator to match with one of the URLs stored therein; and selectively apply the process execution privileges which determine execution of the process in the runtime execution environment according to the retrieved process control policy. obtain a second fingerprint of the file upon launching a process in a runtime execution environment based on the file, wherein the second fingerprint is obtained at a later time after recording the first fingerprint, retrieve the resource locator from the file logging table of the file logging unit by using the second fingerprint to match with the first fingerprint stored in the file logging table, retrieve the process control policy from the system policy unit according to the retrieved resource locator, by using the retrieved resource locator to match with one of the URLs stored therein; and selectively apply the process execution privileges which determine execution of the process in the runtime execution environment according to the retrieved process control policy.