How to read this page
Most of what follows can be checked without taking our word for it. The extension’s permissions are listed on its Chrome Web Store page and inside the downloaded package; the database columns are described here in the same words the schema uses. Where we have no evidence for something, this page says so instead of implying it.
What the extension can access
A Chrome extension can only do what its manifest asks for, and the manifest ships inside the package. Guard4AI asks for one permission.
Every claim in this section is checkable from the Chrome Web Store listing. The permissions a Chrome extension requests are shown on its store page before you install it, and the manifest itself is inside the downloaded package. You do not have to take any of it on trust.
One permission: storage
It lets the extension keep your settings and your masking table on your own machine. That is the entire list. Guard4AI does not request tabs, history, cookies, bookmarks, downloads, webRequest, scripting or nativeMessaging, and it declares no optional permissions it could ask for later.
Twenty-eight AI tools, named one at a time
The part that reads your message is a content script, and it can only run where the manifest lists it. Guard4AI lists twenty-eight AI tools explicitly: ChatGPT, Claude, Gemini, Copilot, Perplexity, Poe, Mistral, DeepSeek, Grok, Meta AI and the rest, plus our own Supabase project for the licence check.
It does not ask for <all_urls>, and it does not ask for a wildcard. On your bank, your email, your practice management system or your intranet, Guard4AI is not running at all. Not idle, not watching: the browser never loads it there.
No remote code
The extension’s content security policy is script-src 'self'. Nothing it runs is fetched from a server at runtime, so there is no path by which the behaviour of an installed copy can be changed without a new version passing Chrome Web Store review.
That includes the heavy parts. The PDF reader, the Word reader and the text recognition engine are all shipped inside the package rather than downloaded, which is most of its size. The one exception in the policy is wasm-unsafe-eval, which the text recognition engine needs in order to run its WebAssembly at all.
What a web page can and cannot reach
The manifest sets no externally_connectable, so no page on the web, including ours, can use Chrome’s extension messaging to reach Guard4AI or read anything out of it.
One qualification, because the stronger claim would be inaccurate. On the supported sites the content script runs inside the page, and it does listen for browser message events. It listens for exactly one thing: the handshake from the file-reading frame the extension creates itself. It checks that the sender is that frame and ignores every other message. A page can therefore send a message; it cannot get Guard4AI to act on one.
What stays on your device
All of it lives in the browser’s own extension storage, which is readable only by Guard4AI and only on that machine. Nothing here is synced to us or to your admin.
- The masking table. The pairs that map a real value to the stand-in it was swapped for. This is the file that makes a reply readable, and it is also the most sensitive thing Guard4AI holds. It never leaves the device, and Clear deletes it.
- Your settings. Which categories are on, whether file scanning is on, badge behaviour, theme, and which one-time notices you have already seen.
- Local counters. How much has been caught on this browser, for the popup’s own display.
- Your licence or seat record. For a workplace seat: the seat id, the company name, and the date it was redeemed. For a personal licence: a random activation token and the date the key was last confirmed.
- A cached copy of the scanning policy your admin has set, so the extension behaves correctly while offline.
Removing the extension removes all of it. Clear, in the popup, deletes the masking table and the counters without removing the extension.
What is transmitted
Written as requests rather than as topics. A workplace seat can make six, and no others:
- Redeeming the invite code, once. Carries the code and the first and last name typed at activation.
- Recording a catch. Carries the seat id, the category, and which AI tool it happened on. One request per category.
- Recording a tool as used, at most once per tool per day. Carries the seat id and the tool’s name.
- Recording an attachment. Carries the file’s broad type and one of three outcomes.
- Confirming the seat is still valid, roughly every fifteen minutes while an AI tool is open. Carries the seat id, and brings back the scanning policy.
- Handing the seat back on deactivation. Carries the seat id.
A personal licence makes two: it confirms the key is still paid, and it releases the device on deactivation. Both carry a random token and nothing else.
Every request goes over HTTPS. The code that builds the catch report checks each field against a fixed list and refuses to send anything at all if a field it does not recognise appears, which is a structural guard rather than a promise: adding a fourth field breaks the request instead of leaking it.
The same thing as a diagram
Coverage is the supported AI websites listed above, open in your browser. Guard4AI is not in Word, Outlook or any desktop application, and it does not see a file you upload anywhere other than those sites.
- 1You type a message, or attach a file
- 2Guard4AI checks it in the browser, before anything is sent
- 3Details it detects and can replace are swapped for realistic stand-ins. Some categories are flagged as a warning instead, and are sent as typed unless you edit them.
Whichever supported site you are using. It receives the stand-ins, and answers as if they were real.
- 4Your real values are put back into the reply, so it reads normally
Your admin’s dashboard receives: the first and last name entered when the seat was activated, the category of what was caught, and which AI tool it happened on. Plus, in company-wide totals with no seat attached, which tools were used and the broad type and outcome of files attached.
Never the message. Never the value. Never a filename.
Detection is pattern matching and it is not perfect. Guard4AI is a safeguard against accidental over-sharing, not a guarantee that nothing sensitive can ever reach an AI tool.
What the backend stores
Six tables carry customer data. None of them has a column that could hold your message text.
- Companies. Company name, invite code, plan, seat limit, subscription status and Stripe identifiers.
- Employees, one row per seat. A random id, the company, the first and last name given at activation, when it was redeemed and when it was last active.
- Events, one row per catch. Company, seat, category, AI tool, timestamp. Category and tool are both closed lists checked by the database itself.
- Tool usage. Company, tool, day, and a count of browsers. No seat column exists, so this cannot be attributed to a person however the data is queried.
- Attachment outcomes. Company, day, broad file type, outcome, count. No seat column exists here either.
- Licences and activations, for personal plans. The key, the plan, the status, the billing period, and one random token per activated browser with the date it was last seen. No name, no email, no device fingerprint, no IP address.
Separately we hold your account email and a billing record if you have bought something, and any enquiry you have sent through the contact form.
Retention, stated accurately
There is no scheduled deletion. Nothing on our side purges old rows on a timer, and no retention period is currently defined.
What that means in practice is that a row persists until something deletes it, and three things do:
- An admin removing a seat. The seat and every catch filed against it are deleted immediately. The dashboard says how many rows went.
- The company being deleted. Seats, catches, tool usage and attachment outcomes all cascade with it. Deleting the account owner deletes the company the same way.
- Asking us. Email hello@guard4ai.com and we will delete what you ask for.
Two points on what is being retained. The rows are tallies rather than content, so what persists is that a phone number was caught on ChatGPT on a Tuesday, not the number itself. The contact form is the only place we hold free text, and its rate limit stores a one-way hash of your IP address rather than the address.
Who can see what
- Your admin sees their own company and nothing else. That is enforced by the database, not by the page: every read is filtered to rows whose company is owned by the signed-in account, so a modified page or a hand-written request returns the same nothing.
- Other people on your team see nothing. There is no per-seat view and no way for one seat to read another.
- Guard4AI staff can read the database. We operate it, so we have administrative access. What that access covers is described above: tallies, names on seats, and billing records. It does not include messages, because no column holds one.
- On a personal licence there is nothing to look you up by. The activation token is random and carries no name, email or device information.
Hosting and encryption
The website and the API routes run on Vercel. The database is Supabase, hosted in Sydney. Every request between your browser and either of them is HTTPS.
Both platforms encrypt data at rest as part of their service. That is their control, documented by them. Guard4AI has not independently audited it and does not hold a certification of its own.
Third parties
- Supabase holds the database described above.
- Vercel hosts the site and keeps standard web server logs.
- Stripe handles payment on its own pages. Card numbers never touch our site or our servers.
- Resend sends the licence and account emails.
- Cloudflare runs the spam check on the contact form, and sees that request only.
- Google Analytics and Microsoft Clarity measure the website, never the extension, and only where consent allows. Clarity records sessions; what it does and does not capture is set out in the privacy policy.
None of them receive your message text, because we never have it.
What we have not built yet
Four things a security review commonly asks for, and where each one stands.
- Independent testing: no third-party penetration test has been completed.
- Certification: no SOC 2 or ISO 27001 certification is held.
- Managed deployment: no MSI, configuration profile or device management integration is provided.
- Single sign-on: not supported. Accounts use email and password.
If any of these is a requirement, Guard4AI does not meet it today.
Deployment
Each browser installs Guard4AI from the Chrome Web Store and activates it with a code. There is no MSI, no configuration profile, no single sign-on and no admin console beyond the dashboard. That suits a small firm with no desktop management in place, and it is a limitation for a large one that has it.
Reporting a security problem
Email hello@guard4ai.com with what you found and how to reproduce it. We will acknowledge it within two business days and tell you what we intend to do. No bug bounty programme is offered.