Trust & security

Built to be verifiable

Ai Notice's security posture comes from its architecture, not from claims or certifications. Because behavior is consistent, you can verify it yourself.

Five promises Ai Notice can actually keep. They are not marketing language — they are technical constraints enforced in how the extension is built.

⬡
Local-only

All scanning happens in your browser. Ai Notice does not send file content to a remote scanning server. Separate business billing and licence delivery do not receive your scanned documents.

◈
No scan-usage reporting

The extension does not include scan-usage reporting or behavioral analytics. Website and service-provider request handling is described in the Privacy Policy.

≡
No content logging

Ai Notice does not save file contents or findings in an audit or activity log. Analysis uses browser memory; it does not provide a secure-erasure guarantee.

◎
Pattern-based detection

Checks use deterministic pattern matching, not model inference. File support and inspection completeness can vary.

→
You decide

When a review appears, the available choices are shown there. A partial or failed check may end the attempt and ask you to retry.

These promises describe extension scanning, not an absence of business records. Paid billing and licence delivery use Stripe, Cloudflare and Resend for the separate roles described in our Privacy Policy. They require contact, transaction, entitlement and delivery information, never the documents you scan. This does not claim that public online checkout is already enabled.

Extension permissions

Current Chrome extension permissions include storage and limited host access for supported sites. Review the installed manifest for the exact release permissions.

Permission Reason
storage Required for local settings, including display-language preference, and an imported signed licence token. No scan audit or activity log is stored.
Host access Limited to supported ChatGPT, Claude, and Gemini sites in the current Chrome Manifest V3 release. Firefox support is not claimed.
Not requested
  • webRequest / webRequestBlocking — no network interception capability
  • identity, cookies, history, or bookmarks
  • Broad or wildcard host permissions
  • The clipboardRead permission

Selected security areas

Selected areas and bounded notes; this is not a complete risk assessment.

Area Current note
Network requests Local scanning does not upload scan content to an Ai Notice scanning service. If the user continues, the selected content is sent to the chosen AI host. Inspect both the extension service worker and page traffic when verifying this boundary.
Malicious file parsing File inspection is best-effort and may be incomplete. Do not treat a skipped or incomplete inspection as a clean result.
Regex denial-of-service Pattern-based checks are deterministic and best-effort; they do not guarantee detection of every sensitive item.
Extension compromise Inspect the installed extension package and service worker for the release under review.
Licence token Local extension storage may contain an imported signed licence token. Keep it private. Licence status is separate from scan-content handling.
Licence and billing data Business-service records for billing, entitlement and delivery are separate from local scan activity.

Known limitations

Disclosed transparently. Not omissions — intentional honesty.

Memory cleanup

Scanning uses browser memory; the extension does not provide a secure-erasure guarantee. Storage settings are separate from scan activity history.

Pattern coverage

Heuristic detection is best-effort. It does not guarantee detection of all sensitive content and may produce false positives or false negatives.

Encrypted files

Password-protected or encrypted files may not be inspectable; follow the status shown by the extension.

Unsupported file types

Supported file inspection is best-effort for text, PDF, DOCX, XLSX and PPTX. Images are not OCR-scanned. Limited checks can raise a notice, and inspection may be skipped or incomplete; an incomplete check is not a clean result.

Responsible disclosure

If you've discovered a security issue, please report it responsibly.

[email protected]

Each item below can be independently verified by your security or privacy team. Ai Notice's architecture makes these checks straightforward.

Network Use a harmless test file. Inspect the AI page's Network panel and the extension service worker's Network panel separately.
Distinguish requests made by the AI host, extension and website. Local scanning does not send content to an Ai Notice scanning service; choosing Continue upload sends the selected content to the AI host.
Permissions Review the manifest in the exact installed extension package and identify the release/version.
Current Chrome Manifest V3 release uses storage and limited host permissions for supported sites. Confirm the exact manifest for the build under review.
Content logging Inspect extension storage after harmless test uploads; distinguish settings and an imported licence token from scan data.
No saved file contents, findings or scan activity history. There is no scan audit-log export. A licence token is not anonymous scan data and should be kept private.
Licence Review the installed package's licence handling without sharing a real licence token.
The extension can store an imported signed licence token separately from scan activity. Do not publish token values or infer behaviour beyond the tested release.
Offline On an already-loaded supported page, disconnect from the network and inspect analysis of a harmless test file.
Local analysis does not require a scanning server. The AI website, checkout and licence email have their own network requirements.
Dependencies Request the source/package review materials for the exact release from [email protected].
The public site does not currently provide the extension source package. No source URL or dependency inventory is claimed here.

For the authoritative statement on what Ai Notice does and does not collect, read the Privacy Policy.

Questions about security or privacy?

For a security review or to ask about source/package availability for a specific release, email the security contact. No assessment guide or compliance review is promised here.

Email [email protected]