TATER Vault — Browser Extension Privacy Policy

Last updated: July 22, 2026 · Applies to the TATER Vault browser extension (Chrome, Edge, Firefox)

The TATER Vault browser extension stores and retrieves passwords and other credentials on your behalf for the TATER platform. Its architecture intentionally prevents TATER Security from being able to read vault contents. This page describes what the extension collects, processes, and transmits. It supplements the platform-wide TATER privacy policy, which continues to apply.

1. What the Extension Stores Locally in Your Browser

• A non-extractable encryption key (the “device key”), generated inside the browser at first run and kept in IndexedDB. This key never leaves the browser.
• A short-lived Microsoft Entra ID access token, held in memory-backed session storage and cleared when the browser process ends.
• A background-unlock bundle (when autofill is enabled): while the vault is unlocked, the extension keeps a small bundle in memory-backed session storage (never written to disk, cleared when the browser closes) so it can fill and save logins after the popup is closed. The bundle contains the device-wrapped vault key (useless without the on-device device key), the matching hostnames of your login items, and the login items' ciphertext — never a usable key and never any decrypted secret. It is readable only by the extension's own trusted pages, never by web pages or their scripts.
• Autofill preferences in local extension storage: the unlock duration (default 8 hours; configurable from 15 minutes up to “always until the browser closes”), feature toggles, and an optional per-site “never offer to save” list. No secrets.

The extension does not write a usable encryption key or the decrypted contents of vault items to disk at any time.

2. What the Extension Transmits to TATER Servers

• Authentication: a bearer token issued by Microsoft Entra ID after you sign in. TATER uses this token to identify you and the organization you belong to.
• Encrypted vault items: AES-256-GCM ciphertext only. The decryption key is bound to your device and identity and is never sent to TATER.
• Item metadata: each item's type, title, and the site hostname used for matching and icons. Metadata is stored server-side so your vault can be listed and audited; item contents remain ciphertext.
• Audit metadata: minimal records of when an item was created, modified, shared, or accessed (by whom, when, from which device). The metadata does not include item contents.

3. What the Extension Transmits to Microsoft

Sign-in uses the OAuth 2.0 authorization-code flow with PKCE against Microsoft Entra ID (login.microsoftonline.com). Microsoft receives your sign-in credentials directly; TATER does not see them.

4. Autofill, the Inline Icon, and Offering to Save Logins

When autofill is enabled, the extension's content script looks at the structure of sign-in forms on the pages you visit so it can: (a) show a small TATER icon inside username/password fields, (b) fill a saved login into the form when you click that icon and pick an account, and (c) offer to save a new login to your vault after you type and submit credentials that aren't already stored.

• The content script only ever reads the shape of login forms (which fields are username/password) and the value you type into a login field for the save prompt — it never reads or transmits other page content, page text, browsing history, or analytics.
• A web page can never read your vault. When you click the inline icon, the page only learns the usernames for that same site (after your click), and a password is released only into the exact field you targeted. Queries are always scoped to the page's own web address, so one site cannot probe your vault for logins belonging to another site.
• “Offer to save” only appears for credentials you actually typed, shows the destination site, and never saves anything without your explicit click. A per-site “never offer here” choice is available.
• Autofill, the inline icon, the save prompt, and the background-unlock duration are all configurable in the extension's Settings, and can be turned off entirely.

5. Background Unlock — Trust Boundary

To fill and save logins while the popup is closed, the extension keeps the vault usable for a duration you choose (default 8 hours, or “always until the browser closes”). During that window the vault key is re-derived in memory by the extension's own service worker from the on-device device key; it is never written to disk. The effective security boundary is your operating-system user session and physical possession of the device — not the timer, which only limits the exposure window. Lock your device (or click “Lock vault”) when you step away. Closing the browser always ends background unlock.

6. What the Extension Does NOT Do

• It does not read or transmit the content of web pages beyond the structure of sign-in forms and the login values you type (used only locally for autofill and the save prompt, as described above).
• It does not collect web history, location, or analytics.
• It does not contact third-party services other than Microsoft Entra ID for sign-in and TATER's own API. Site icons are rendered from your browser's own favicon cache, not fetched from any icon service.
• It does not sell or transfer user data to third parties.

7. Zero-Knowledge Architecture

All encryption and key-unwrap operations run inside the browser using WebCrypto. The implementation is open for review in the public source (extension/lib/vault-crypto.js) and the VAULT-CRYPTO-DESIGN companion document. TATER Security personnel cannot read vault contents because the device key required to do so is held only on your device.

If you lose access to your device key (factory reset, lost laptop), recovery uses your organization's escrow path, which requires explicit administrator action within your organization and is fully audit-logged. Where escrow is enabled, your administrators — not TATER — control recovery.

8. Data Subject Rights

Vault data is held under the same data-subject-rights framework as the rest of the TATER platform — see the main privacy policy for GDPR/CCPA inquiry channels. Because TATER cannot decrypt vault contents, a request to “show me all my data” returns only metadata (which items exist, who accessed them, when); the contents are available only to you through the extension or web vault.

9. Children

The extension is not directed at children under 16. Organizations using TATER are responsible for ensuring their users meet applicable age requirements.

10. Changes to This Policy

We will update this page any time the extension's data handling changes, and increment the extension's version to match; the Chrome/Edge auto-update mechanism delivers the updated extension to all installed users.

11. Contact

Privacy questions about the extension: privacy@tatersecurity.com.