Security
A browser extension has to be trustworthy.
That’s why ClickCheck is built so there’s as little as possible to see, store or misuse. Here’s how, without the marketing speak.
As little data as possible
The extension only responds on websites and buttons you created a rule for. On every other page it reads nothing and sends nothing.
Even when a rule is triggered, very little reaches the server: which rule, on which website, what the person chose and whether the button was recognised properly. Only an approval request includes the amount, because the approver needs to see it.
Detection in the browser
Reading amounts, comparing account numbers and spotting sensitive text all happen inside the extension. Text someone pastes into an AI tool never leaves the computer towards ClickCheck.
Known values, such as suppliers’ account numbers, are only present in the extension as hashes. The extension can compare against them without the list being readable in the browser.
Keys per device
The extension never signs in with a user’s password. When it’s linked, each device gets its own random key, of which the server only stores a hash. An admin can unlink a device at any time, and the key stops working immediately.
Single-use, signed approvals
An approval is digitally signed and bound to the organisation, the requester, the device, the rule and the specific action, with a short validity. The server marks it as used, so it can’t be replayed for a different action or after it expires.
Separated customer data
Each organisation only sees its own rules, events and approvals. That separation is enforced at several layers and tested automatically. IT partners with several clients see, per client, only what belongs to that client.
Safe when in doubt
A fault in ClickCheck must not bring your work to a halt. A block only applies when the extension recognises a button with high confidence and the rule is active. Otherwise it becomes a warning.
Rule texts are displayed as plain text in an isolated part of the page. A website can’t alter or imitate the ClickCheck message to trick someone.
Retention
Events aren’t kept longer than needed. Each organisation chooses a retention period of 90, 180 or 365 days, after which they’re deleted automatically.
The rule assistant
The rule assistant is optional. It only drafts a rule; a person always publishes. We don’t store prompts containing personal data. If the feature is switched off, it disappears from the dashboard entirely.
Hosting and connections
All connections between extension, dashboard and server use HTTPS. We’ll state where the servers are located here once the production environment is final.
Reporting a vulnerability
Think you’ve found a security issue? Let us know through the contact page, with the topic “Privacy and security”. We’ll respond as quickly as we can and ask you not to disclose it publicly until it’s fixed.