diff --git a/TAP/compat.py b/TAP/compat.py
index f33401f..965f3f6 100644
--- a/TAP/compat.py
+++ b/TAP/compat.py
@@ -20,8 +20,6 @@
 # 1.x [webserver] keys that 3.x reads from [WEB].
 _WEB_KEYS = ('TAP_WORKDIR', 'TAP_WORKURL', 'HTTP_URL', 'HTTP_PORT', 'CGI_PGM',
              'ArraySize', 'INFOMSG')
-# 1.x [webserver] keys that 3.x reads from the connection section.
-_DB_KEYS_FROM_WEB = ('COOKIENAME', 'RACOL', 'DECCOL')
 # 1.x ADQL_* keys and their 3.x [SPTIND] names.
 _SPTIND_KEYS = {'ADQL_MODE': 'MODE', 'ADQL_LEVEL': 'LEVEL', 'ADQL_XCOL': 'XCOL',
                 'ADQL_YCOL': 'YCOL', 'ADQL_ZCOL': 'ZCOL',
@@ -70,9 +68,13 @@ def translate_legacy(conf):
     new['WEB'] = {k: web[k] for k in _WEB_KEYS if k in web}
     db = {'DBMS': dbms}
     db.update({k: v for k, v in conf[dbms].items() if not k.startswith('ADQL_')})
-    for k in _DB_KEYS_FROM_WEB:
-        if k in web:
-            db[k] = web[k]
+    # Every other [webserver] key goes to the connection section, where 3.x
+    # reads COOKIENAME, RACOL, DECCOL and the proprietary-filter keys
+    # (PROPFILTER, ACCESS_TBL, USERS_TBL, FILEID, ACCESSID).  Nothing is
+    # dropped: a lost PROPFILTER would serve proprietary rows to anyone.
+    for k, v in web.items():
+        if k not in _WEB_KEYS and k != 'DBMS' and not k.startswith('ADQL_'):
+            db[k] = v
     if dbms == 'sqlite3':
         db.setdefault('TAP_SCHEMA_FILE', 'TAP_SCHEMA')   # 3.x's SQLite ATTACH name
     new['DBMS'] = db
diff --git a/tests/test_compat_config.py b/tests/test_compat_config.py
index ef749d4..acc7ad5 100644
--- a/tests/test_compat_config.py
+++ b/tests/test_compat_config.py
@@ -92,6 +92,31 @@ def test_legacy_oracle_reads_like_its_3x_equivalent(tmp_path):
     assert current.connectInfo['compat'] == compat.NONE
 
 
+PROPRIETARY_KEYS = ('ACCESS_TBL=access_tbl\nUSERS_TBL=users_tbl\nFILEID=fileid\n'
+                    'ACCESSID=accessid\nPROPFILTER=koa\n')
+
+
+def test_legacy_proprietary_filter_keys_are_kept(tmp_path):
+    # A 1.x config keeps the proprietary-filter keys in [webserver]; 3.x reads
+    # them from the connection section.  Dropping them serves proprietary rows.
+    legacy = configParam(write(tmp_path, 'legacy.conf', LEGACY_ORACLE.replace(
+        'CGI_PGM=/TAP\n', 'CGI_PGM=/TAP\n' + PROPRIETARY_KEYS)))
+    current = configParam(write(tmp_path, 'current.conf', CURRENT_ORACLE.replace(
+        'DECCOL=dec\n', 'DECCOL=dec\n' + PROPRIETARY_KEYS), compat=''))
+    assert legacy.propfilter == 'koa'
+    assert (legacy.accesstbl, legacy.usertbl, legacy.fileid, legacy.accessid) == \
+        ('access_tbl', 'users_tbl', 'fileid', 'accessid')
+    assert state(legacy) == state(current)
+
+
+def test_every_legacy_webserver_key_is_kept(tmp_path):
+    # Keys the translator has no list entry for still reach configParam.
+    text = LEGACY_ORACLE.replace('CGI_PGM=/TAP\n', 'CGI_PGM=/TAP\nSOME_FUTURE_KEY=x\n')
+    conf = compat.translate_legacy(__import__('configobj').ConfigObj(
+        write(tmp_path, 'TAP.conf', text)))
+    assert conf['DBMS']['SOME_FUTURE_KEY'] == 'x'
+
+
 def test_explicit_compat_list(tmp_path):
     cp = configParam(write(tmp_path, 'TAP.conf', CURRENT_ORACLE,
                            compat='COMPAT = nea-errors, nea-uws'))