Trust

What runs on your computer

Everything that reads a client detail. The check of a message before it is sent, the model that recognises names, companies and places, the reader for pictures and scans, and the redaction of attached files all run inside the browser extension, on the person's own computer. The models are files shipped inside the extension, not services we run.

Settings, the person's own word lists, the items they marked not sensitive, the facts in their reply-marks vault and their local tallies are kept in the browser's own extension storage on that computer. Nothing of these is synced anywhere by us. On a Guard Enterprise seat the Living Vault is kept there too, encrypted with a key the browser will not release, and is never uploaded or synced as a whole.

When SourceSecure finds something, the person decides: it offers a redacted version, and they can still send what they typed. If its own check cannot finish, because the name model does not answer or the check fails, the message is held until it has been checked, and the person is told why; a Guard Enterprise team head can choose send with a warning for their firm instead. A message with a file that could not be read is held so the person can decide. If the extension is switched off or paused, messages go as typed.

What is sent, and to whom

To our server, sourcesecure.ca. The person's work email when they sign in, so a sign in link can be sent. Once a day, the browser's id, a secret proving it is that browser, and a report of counts: how many items were caught, of which kinds, what was done about them, how often each feature was used, and for each supported AI site how often SourceSecure started there. Within the hour, for each catch: when, on which AI site, what kind of detail and what the person chose, with the detail itself masked on the computer first, like •••• 4242 (the mask keeps the last few digits of a number or the initials of a name). When protection was paused or switched off, and for how long. And what the firm's admins type for everyone: the firm's word lists, its profile and its playbook, and a vault fact a person chooses to suggest to the firm.

To our coaching service, then to OpenAI. Only on the paid seats that include them, and only while the person has them switched on. On Guard Pro seats and above: prompt coaching, Help me, Sharpen my prompt and Set up this chat. Sharpen my prompt starts preparing when the pointer rests on its button for a moment, which sends the redacted conversation then, before the click. On Guard 360 seats and above: reply marks, and the short facts read from a person's messages for their vault. On Guard Enterprise seats: a chat the person saves to their Living Vault, a meeting transcript they add to it (sent as soon as it is added), a question to Ask SourceSecure with the vault excerpts found for it, and, when they press Write background in Add notes, the notes they ticked, their draft and their own last few messages. The text is redacted in the browser first, so the client details SourceSecure finds arrive as stand ins such as [PERSON_1]. Our server checks it again for anything that looks like an email address, a phone number or a long number, and refuses to send rather than quietly cleaning it. It is then passed to OpenAI's API with storage switched off (store: false) and is not used by OpenAI for training. OpenAI may keep its own abuse-monitoring logs of these requests for up to 30 days under its standard API terms; we have asked OpenAI for zero data retention, and this sentence will change when it is in place. The weekly coaching note sends a summary of the person's week, counts and habits from fixed lists and, on Guard 360 seats and above, a few short facts about their work from their vault, rather than anything they wrote that week.

To nobody else. Payment is handled by Stripe on its own checkout page, and we never see card details. Sign in is run by Google's Firebase Authentication. Emails we send go through Resend, and email sent to our support address reaches us through Cloudflare. None of them receives anything a person typed into an AI chat.

What we never store

The messages people write, and the files they attach. They are checked and redacted on the computer. Files never reach us; messages reach us only redacted, for the features above, and are not kept by us.

The text of any request to the coaching service: a coaching request, a reply check, a saved chat or meeting, a question to Ask SourceSecure or a background. It passes through our server to OpenAI and back, and is not written to our database or our logs. Our logs record that something happened, never what anybody wrote. What OpenAI may keep of it is said above.

The detail that was caught. Only its kind and a masked form, made on the computer, are sent to us; the masked form keeps the last few digits of a number or the initials of a name, and nothing more.

The browser's secret. We keep a one way hash of it, so our database cannot be used to pretend to be a browser.

Passwords. There are none: sign in is through Google or a single use link emailed to an address the person owns.

Encryption

Every connection the extension and the site make is over HTTPS, and the site tells browsers to use only the secure address for a year. Google encrypts the database and the server's storage at rest as standard.

Every page carries a Content-Security-Policy that allows scripts only from this site and, for the sign in window, Google's sign in loader at apis.google.com; refuses any script written into a page; refuses to be framed by any other site; and allows connections only to this site and Google's sign in.

Where the data lives

Your firm's records, the daily counts, catches and pauses are held in Google Cloud Firestore in the northamerica-northeast1 region, which is Montreal, Canada. The functions that serve this site and the API, and the coaching service, run in the same region.

Some things are held by the companies named above, in their own systems: sign in accounts by Firebase Authentication, billing by Stripe, and the redacted text of a request to the coaching service passes through OpenAI in the United States. The privacy page lists each one.

Catches are deleted 90 days after they are received, and a pause 90 days after it began. A person's are deleted at once when they leave the team.

How it was tested

The detector is tested against generated values that pass their own check digits, disguised in every way we could think of: odd separators, invisible characters, look alike letters, numbers buried in tables, JSON and email threads. Every combination that a person could make by accident has to be caught in full, and the redacted text must not let the value be read back.

Because passing your own exam proves little, it is also measured on held out rounds: disguises written by a separate red team that never sees the detector's code, scored blind before any fix, alongside decoys such as order numbers and timestamps that must not be flagged. Each round becomes a floor the detector may not fall below.

What leaves the computer is tested from outside the extension. In a real Chrome, with every web address pointed at a local recording server, fresh test values are typed into a stand in chat page. A run fails if any of them is found in any request to any address, in the extension's storage, or in its logs.

The site itself is scanned with OWASP ZAP: a full scan, attacks included, against a private copy running on our own computer, and a passive scan of the live site, which only reads the pages any visitor could.

There is no SOC 2 report, ISO 27001 certification or independent penetration test yet. The security page says so in full.

How your IT team can check it themselves

Watch the network. Open the browser's developer tools on an AI site, or put the computer behind your own proxy, and type a made up card number such as 4111 1111 1111 1111. The only hosts SourceSecure calls are sourcesecure.ca and, on seats with coaching, coach-lasowp7xjq-nn.a.run.app. No request carries the number. The record of the catch, sent to sourcesecure.ca within the hour, carries its last four digits behind a mask (•••• 1111) and nothing else of it. Our IT pack lists the hosts for a firewall allowlist, and has the policy files for installing SourceSecure on every computer at once.

Try a canary. Make up a value that exists nowhere else, such as a SIN with a valid check digit or a phrase with a random number in it. Type it into a chat, let SourceSecure catch it, then search your proxy logs for it. It should appear only in what you sent to the AI site, and not at all if you chose the redacted version. This is the same test we run, in tools/e2e-network.mjs, by pointing every address at a recording server.

Read the code. The extension's code ships inside it, minified but not obfuscated. Firefox's reviewers build the add-on from its source before it is listed. Your browser's extension tools show the files and every permission it asks for.

Turn things off. Switch prompting tips off in the popup and nothing a person types into an AI chat is sent to the coaching service. What is left is the licence check, the counts, the masked catches and the pauses to sourcesecure.ca, and, on a Guard Enterprise seat, a question the person chooses to put to Ask SourceSecure, sent redacted when they ask it. Pause SourceSecure and that stops as well: while it is paused, nothing at all goes to the coaching service. Watching the network with tips off, and then with SourceSecure paused, is the quickest way to confirm both.

Found a problem?

Read how to report a security problem on the security page, or find our contact details in security.txt. What we do when something goes wrong, and how fast your firm is told, is in our incident and breach response policy. The privacy policy, the terms and the security page have the full detail behind every section above.

Getting in touch

Email support@sourcesecure.ca. SourceSecure is operated by JOLIVE Labs Inc.