Everything your security reviewer needs

1. Summary

2. Data flow

1. The user starts a capture with the toolbar icon, a keyboard shortcut or the right-click menu. Chrome then grants temporary access to that one tab (activeTab).
2. Chrome renders the visible area. For a full page, the extension scrolls the tab, stitches the parts in memory and restores the page.
3. The image opens in a page packaged inside the extension (chrome-extension://). It loads no remote code, fonts or analytics.
4. The user blurs, crops and annotates. Blur is written into the pixels.
5. The user copies the image to the clipboard or downloads a PNG. Closing the tab discards it.

To verify: open chrome://extensions, enable Developer mode, inspect Screshot's service worker and watch the Network tab while capturing. No requests leave the browser.

3. Permissions

No host permissions and no access to history, cookies, downloads or storage.

4. Data inventory

5. Subprocessors

The extension uses no subprocessors. The website uses these services:

6. Questionnaire answers

Does the product store, process or transmit customer data?

No. The extension has no server component. Screenshots never leave the user's device unless the user copies or downloads them.

Which network connections does the extension make?

None during capture, editing, copy or download. It opens screshot.com pages in normal tabs only for the welcome guide after a manual install and the optional uninstall survey.

Does it include analytics, telemetry or third-party scripts?

No. Nothing is loaded from remote servers, and there is no analytics or crash reporting in the extension.

Which browser permissions does it request?

activeTab, scripting, contextMenus. None triggers an install warning, and there are no host permissions. See the table above.

Can it read other tabs, browsing history or cookies?

No. activeTab gives access only to the tab the user chooses to capture, only at that moment.

Is data encrypted in transit and at rest?

There is no data in transit or at rest on our side for the extension. The website is served over HTTPS only.

Does it support SSO, SCIM or role-based access?

Not needed: there are no accounts. Access is controlled by deploying or blocking the extension through Chrome policy.

How is it deployed and removed?

Force-install with the Google Admin console, Microsoft Intune, Group Policy or a macOS profile, and remove it from the same policy. See the deployment guide.

How are updates delivered and reviewed?

Through the Chrome Web Store, which reviews each version. If a new version requests a permission that shows a warning, Chrome disables it until the user or admin approves.

Can admins control which version runs?

Chrome policy can allow, block or force-install the extension by ID. Pinning a specific version is not supported by the Chrome Web Store.

Has the product had an independent penetration test?

Not yet. We will share results with customers under NDA once one is complete.

How do you handle vulnerabilities?

Report them to contact@screshot.com. We acknowledge reports and ask for reasonable time to fix before public disclosure.

How will you notify us of security incidents or material changes?

We publish changes to permissions or data handling on the security page and privacy policy before releasing the version that makes them.

7. Upcoming changes

We are building optional cloud upload and share links. When they launch, a screenshot will be uploaded only when a user clicks Share on it, and each link will start visible only to its owner. Before release we will update this pack with the new data flow, stored data and subprocessors, and we plan to add a Chrome policy so admins can keep sharing turned off. The commitments are listed in the security overview.