Security
Security and transparency
SupaPM is built for product teams working with company context, customer insight, and internal planning data. This page explains the controls and design choices that help teams review SupaPM before adoption.
Read-only page context
After you grant page context for a site, the side panel can list those tabs and read their visible content when you ask — the same permission as @page. It does not click buttons, type into pages, submit forms, or make destructive changes on the sites you visit.
Limited browser permissions
The extension uses Manifest V3 and active-tab access for page context. It does not request broad access to every website through an all-URLs host permission. Local folders are granted separately by you, one folder at a time, and stay read-only.
Local-first workspace data
Extension projects, skills, prompts, settings, edit history, and local folder catalogs are stored locally in the browser unless a feature explicitly sends data to SupaPM or a configured AI provider.
Provider choice and HTTPS defaults
Teams can choose their AI provider and configure their own API keys. Manual model endpoints must use HTTPS, with an explicit opt-in for local or private-network HTTP endpoints.
User-granted local folders
In Chrome and Edge you can grant read-only access to a local folder so the side panel can list, search, and read files on demand. Firefox does not provide a live folder-handle API, so this is not offered there. SupaPM does not copy the folder into its servers or write back to disk. File contents leave the machine only when the agent reads them into a request to your configured AI provider, the same as chat attachments. Removing the folder drops the grant immediately.
No advertising use
Browser extension context is used to provide SupaPM functionality, not for third-party advertising or cross-site behavioural tracking.
Extension posture
The SupaPM extension is designed as a side panel assistant, not a browser automation agent. It can use the active page as context, open useful links in new tabs, search local folders you have granted, and update SupaPM's own local workspace documents when you ask it to. It is not designed to operate third-party web apps on your behalf, write to your disk, or perform destructive actions on the pages you browse.
When the assistant edits SupaPM documents such as Org Knowledge, Skills, or project descriptions, those edits are tracked with visible history and restore support. That makes AI-assisted changes reviewable and reversible instead of silent.
Supply chain transparency
We publish a Software Bill of Materials for the browser extension so security and compliance teams can review the open source runtime dependencies used by SupaPM.
Browser extension SBOM
Download or inspect the machine-readable CycloneDX Software Bill of Materials for the current extension release.
What to review
- The extension manifest permissions and host permissions, plus any local folders you have granted.
- The SBOM for runtime dependency names, versions, licences, and package URLs.
- The Privacy Policy for how SupaPM handles website, extension, account, and workspace data.
- Your organisation's configured AI provider and model endpoint choices.
These materials are intended to make review easier, not to replace your own security assessment. An SBOM is a transparency artifact, not a certification or guarantee.
Need more information?
Contact hello@supapm.com if your organisation needs additional security, privacy, or compliance details.