IT deployment pack
Installing SourceSecure on every work computer at once, keeping it there, which network addresses it uses, and what leaves the computer and what does not.
For the person who manages your firm's computers. It covers installing SourceSecure on every work computer at once, keeping it from being removed or switched off, which network addresses it uses, and what leaves the computer and what does not.
| Guide | What it is for |
|---|---|
| Chrome on Windows | Group Policy, Intune, or a registry file |
| Chrome from the Google Admin console | Chrome managed from Google Workspace, and ChromeOS |
| Chrome on Mac | Jamf, Kandji, Intune or any MDM, with a profile to upload |
| Microsoft Edge | From the Chrome Web Store listing, which is where Edge installs it from |
| Firefox | With a policies.json |
| Safari on Mac | Through Apple Business Manager |
| Checking it worked | On one computer and across the firm |
| Policy files | Ready-to-use policy files referred to above |
The extension
| Chrome Web Store | https://chromewebstore.google.com/detail/sourcesecure/bicelplgpeknobhaandbndecidlmeook |
| Chrome / Edge extension ID | bicelplgpeknobhaandbndecidlmeook |
| Chrome update URL | https://clients2.google.com/service/update2/crx |
| Firefox Add-ons | https://addons.mozilla.org/firefox/addon/sourcesecure/ |
| Firefox add-on ID | sourcesecure@sourcesecure.ca |
| Mac App Store (Safari) | https://apps.apple.com/app/id6816426153: SourceSecure, app ID 6816426153, bundle ID ca.sourcesecure.SourceSecure |
| Publisher | JOLIVE Labs Inc. |
SourceSecure is live in the Chrome Web Store, on Firefox Add-ons and, for Safari, on the Mac App Store. It is not listed in the Microsoft Edge Add-ons store: Edge installs it from the Chrome Web Store, by policy or by hand.
What a deployment does, and what each person still does
Installing by policy puts the extension on every computer, keeps it updated, and stops people removing or disabling it. It does not sign anybody in: SourceSecure protects a person once they have signed in with the work address your firm's SourceSecure admin added on the team page. Each person does that once per browser, from the SourceSecure icon. Until they do, the extension shows "Sign in to turn on" on each AI site.
Plan the rollout in this order:
- Your SourceSecure admin adds everybody on the team page (sourcesecure.ca, Team).
- You push the extension by policy, using the guide for your browser.
- Each person opens their browser, clicks the SourceSecure icon, and signs in with their work email. The link arrives by email.
- Check the team page: each person's browser appears there once it has checked in.
What leaves the computer
SourceSecure checks messages and attached files inside the browser, on the computer itself. The model that finds names and addresses, and the reader for pictures and scans, are files that ship inside the extension; nothing is sent anywhere to be checked.
| Sent to sourcesecure.ca | What it contains |
|---|---|
| Sign-in | The person's work email, to send them a sign-in link |
| Daily licence check | The browser's ID and a secret proving it is that browser (the server keeps only a one-way hash), and a report of counts: how many items were caught, of which kinds, how many files were checked, how often each feature was used, and for each supported AI site how often SourceSecure started there. Numbers only; there is no field a sentence could travel in |
| Catches | Within the hour, for each item caught: when, on which AI site, what kind of detail, and what the person did (redacted, sent as typed, marked not sensitive), with the detail itself masked on the computer first, for example •••• 4242 (the mask keeps the last few digits of a number or the initials of a name). Kept 90 days from when it is received, and deleted at once when the person leaves the team |
| Pauses | When protection was paused or switched off, and for how long. Kept 90 days from when the pause began, and deleted at once when the person leaves the team |
| Firm settings | What your SourceSecure admins type for the whole firm: word lists, the firm profile and, on Guard Enterprise, the playbook. Stored, and sent down to each browser |
| A suggested fact (Guard 360 and Enterprise) | The words of one fact from a person's vault, only when they press Suggest to your firm |
The optional AI features send text, only on the paid seats that include them, and only after it has been redacted in the browser. It goes to SourceSecure's server in Montreal, which checks it again, stores none of it, and passes it to OpenAI in the United States with OpenAI's storage option switched off (store: false). OpenAI may keep its own abuse-monitoring logs of these requests for up to 30 days under its standard API terms; SourceSecure has asked OpenAI for zero data retention.
| Feature | What it sends | Switched off by |
|---|---|---|
| Prompt coaching: tips, Help me, Sharpen my prompt, Set up this chat, the weekly note (Guard Pro seats and above) | Every five messages, that stretch of the conversation, both sides. For Help me and Sharpen my prompt, the conversation on the page and the unsent draft; Help me starts when a tip appears, and Sharpen my prompt when the pointer rests on its button for a moment, so this can be sent before the click. For the weekly note, counts | Prompting tips, in the popup; or pausing SourceSecure |
| Reply marks (Guard 360 seats and above) | The person's message, the AI's reply, the few messages before them, and the short facts in the person's vault and the firm's profile | Mark AI replies, or Prompting tips; or pausing |
| Living Vault: saving a chat or a meeting (Guard Enterprise) | The chat, or the meeting transcript, to be summarised. A transcript is sent as soon as the file is added. The summary is kept only on the computer | Prompting tips, or the Living Vault switch; or pausing |
| Living Vault: Add notes, Write background (Guard Enterprise) | Only when pressed: the notes the person ticked, their draft and their own last few messages in that chat | Prompting tips, or the Living Vault switch; or pausing |
| Living Vault: Ask SourceSecure (Guard Enterprise) | Only when a question is asked: the question, an overview of the vault, and the passages found for it | The Living Vault switch, for one person on their vault page or for the firm on the team page; or pausing SourceSecure, when the box says so and nothing is sent. Not the Prompting tips switch |
Redaction replaces what SourceSecure finds. A name it does not recognise goes as typed; the server's second check looks for email addresses, phone numbers and long numbers, not names.
While SourceSecure is paused, none of the AI features sends anything. The licence check, the counts, the catches already made and the record of the pause itself still go to sourcesecure.ca.
The full description is the privacy page: https://sourcesecure.ca/privacy.
The two tables above are the whole list. What happens to values typed into a chat was tested from outside the extension: in a real Chrome with every web address pointed at a recording server, unique test values typed into a chat were found in no request to any address, in none of the extension's storage, and in none of its logs (tools/e2e-network.mjs in the source). The masked record of a catch does carry the last few digits of a caught number, by design.
Network allowlist
If your firewall or proxy only allows listed hosts, SourceSecure needs:
| Host | Why |
|---|---|
sourcesecure.ca | Sign-in, the daily licence check, catches, pauses, firm settings, and the AI features' requests that are not streamed |
coach-lasowp7xjq-nn.a.run.app | Prompt coaching, reply marks and the Living Vault's answers, on the seats that include them. Can be left blocked if your firm buys only Guard seats. Blocking this host alone does not stop those features sending: most of their requests then go through sourcesecure.ca instead |
clients2.google.com, clients2.googleusercontent.com | Chrome downloading and updating the extension from the Chrome Web Store |
And the AI sites themselves, which people use whether SourceSecure is there or not. SourceSecure runs on: chatgpt.com, chat.openai.com, claude.ai, copilot.microsoft.com, copilot.cloud.microsoft, m365.cloud.microsoft, copilot.com, www.copilot.com, gemini.google.com, perplexity.ai, www.perplexity.ai, grok.com, chat.deepseek.com, meta.ai, www.meta.ai, chat.mistral.ai, notebook.google.com, notebooklm.google.com.
If the daily check cannot reach sourcesecure.ca, protection keeps working on the last confirmed licence for 14 days.
Permissions the extension asks for, and why
| Permission | Why |
|---|---|
| Access to the AI sites listed above | To read the message box and attachments on those sites, and nowhere else |
Access to sourcesecure.ca and the coaching host | The calls described above |
storage | Settings, the licence, the person's own lists and counts, on the computer |
offscreen | A hidden page that runs the on-device name model and picture reader |
scripting | To attach to an AI site tab that was already open when the extension was installed or updated |
alarms | The daily licence check, the hourly upload of catches and pauses, and the end of a pause |
sidePanel | Shows SourceSecure in the browser's side panel |
contextMenus | "Open SourceSecure" in the right-click menu, and on Guard Enterprise seats the capture items |
activeTab | On Guard Enterprise seats, reaches the one page a person right-clicks, once, when they pick a capture item |
The extension has no standing access to any other site, none to browsing history, and none to files on the computer other than the ones a person attaches to an AI chat or adds to their own Living Vault. On a Guard Enterprise seat a person can capture from a page they choose, through the right-click menu.
Gaps to close with policy
A protected browser protects only itself. To make SourceSecure the way AI sites are used at your firm:
- Private windows. Chrome does not run extensions in Incognito windows unless allowed per extension. Disable Incognito (
IncognitoModeAvailability= 1), or people can use AI sites there unprotected. The guides include it. - Other browsers. If people can install or use another browser, block the AI sites there, or allow only the managed browser.
- Personal profiles. Apply the policy to the computer (machine level), not to a Chrome profile, so a second profile is covered too.
Policy files
Ready to use, and referred to in the guides above. Each downloads as it is.
Getting in touch
Email support@sourcesecure.ca. SourceSecure is operated by JOLIVE Labs Inc.