Chrome extension security and data handling

The Solidroad Chrome extension records a browser-based workflow (clicks, navigation and typed input) so Solidroad can turn it into an interactive software simulation. This article explains what the extension can access, what it records, how that data is transmitted and stored, and which controls you have. It is written for security, compliance, IT and privacy teams reviewing the extension, and for anyone who wants to know what is recorded. For install and recording steps, see How to Create Software Simulations on Solidroad.

What the extension does

Recording is always started by you and can be stopped at any time from the extension. Data is synced to Solidroad only while a recording is active. Typical uses are documenting internal tools and processes, building onboarding walkthroughs, and creating interactive training simulations for teams.

Privacy and security principles

• Recording is opt-in. It begins only when you click Start Recording, and the extension shows a visible recording indicator (for example a banner or icon state) while it runs. You can stop it immediately from the extension.

• The extension captures the structured events needed to reproduce a workflow, not continuous video. It does not collect browser history, bookmarks, files or data from other applications.

• Data is transmitted only over HTTPS (TLS 1.2 or higher) to Solidroad services. Authentication uses OAuth and JWT.

Chrome permissions requested

The extension also requests host permissions for http://* and https://* so that you can record on any site you choose to document. Host permissions enable the capability; recording happens only on the tab where you start it.

What is collected during a recording

While a recording is active, the extension collects:

• Interaction events for replay: clicks and UI interactions, navigation, scrolling, typed input in form fields (see Sensitive data handling below) and the DOM change events needed to reproduce the workflow accurately.

• Page context: the page URL and domain, and the visual or page state needed for replay accuracy.

• Recording metadata: the recording name you enter, start and stop timestamps and duration, and internal recording identifiers such as the flow ID.

What is not collected

• Passwords or sensitive form fields when masking is enabled (see below)

• Data from other browser tabs

• Browser history or bookmarks

• Files on your device or downloads

• Data from other applications

• Anything at all when you are not actively recording

Sensitive data handling

Typed input can be captured as part of workflow replay. The underlying recording approach (rrweb) supports masking sensitive inputs, such as passwords and specified selectors or fields.

As a recommended policy, always mask password fields, mask or exclude fields likely to contain secrets (tokens, SSNs, payment information), and avoid recording workflows that include highly sensitive screens unless you have to.

As a user, avoid recording workflows that include password entry (even if masked), payment card details, government IDs, health data or other special-category personal data, or API keys, access tokens and other secret values.

Local storage on the device

The extension stores limited data locally in chrome.storage.local:

• The authentication token (JWT) used for API access

• Basic user profile for display in the extension, such as name and email

• Recording state (status, flow ID and event queue) while a recording is in progress

This data sits inside your Chrome profile under Chrome’s extension storage protections. Local authentication data is removed on sign-out, and recording state is cleared after a successful upload or a cancellation.

Data transmission and APIs

You sign in via Solidroad using OAuth, and the extension receives a JWT token to call Solidroad APIs. During a recording, events are synced periodically (roughly every 5 seconds); when you stop recording, the final batch is uploaded. When not recording, the extension does not transmit recording data.

Events are transmitted as compressed, structured JSON. This is not raw video capture.

Security controls

• Authentication and authorisation: OAuth-based sign-in with scoped session tokens (JWT). Recordings are associated with the authenticated user and workspace.

• Transport: HTTPS-only communication (TLS 1.2 or higher).

• Extension posture: Chrome Extension Manifest V3 security model, no external scripts loaded from CDNs, a Content Security Policy aligned to Chrome requirements, and recording scripts that run in isolated extension contexts.

• Operational logging: API requests and key actions (auth events, start and stop recording) are logged on the backend for auditability.

Cross-origin and iframe behaviour

The extension respects standard browser security boundaries and does not attempt to bypass them. Cross-origin iframes may be unrecordable because of browser restrictions.

Data retention and deletion

Recording data retention is governed by Solidroad’s retention policies and your configuration where applicable. You can delete recordings from within the Solidroad web interface, subject to permissions and policy.

Security contact

For security questions, deployment guidance or to report a vulnerability, email security@solidroad.com with the relevant details, or contact your Solidroad representative. Follow your own organisation’s security reporting process as well.

Related articles

• How to Create Software Simulations on Solidroad

• How to Create Simulations

• Network allowlist guide

If you have any further questions, contact the Solidroad team via the Help tab in the platform.