Privacy policy
This policy covers the Key Vault Credential Helper browser extension for Chrome, Edge and Firefox. In short: the extension works entirely in your browser, talks only to Microsoft, and sends no data to us.
Who we are
The extension is published by NTT Security (Sweden) AB, Stockholm, Sweden. For privacy questions, contact privacy@security.ntt.
What the extension does
On a website you have allowed, the extension signs you in to your own organization's Microsoft Entra ID account. It then reads one secret from your organization's Azure Key Vault and hands it to the page that asked for it, so that page can fill in a password. The extension does nothing on a website until you allow it there from the extension's toolbar button.
Information the extension handles
All of the following stays on your device:
- A Key Vault access token from Microsoft. It is kept in the browser's session storage, so it is deleted when you close the browser. The extension does not keep a refresh token.
- The secret it reads, such as a password. It is passed only to the page on the allowed site that asked for it, and the extension never stores it.
- The sites you have allowed, and for each one the Microsoft tenant, application and key vault identifiers that site uses. These are kept in the browser's local storage, so the extension can refuse a site that later asks for a different vault.
The extension does not read the content of web pages, your browsing history or your tabs.
What we collect
Nothing. The extension contains no analytics, telemetry, tracking or advertising, and it sends no information to us or to anyone other than Microsoft. We do not sell, share or transfer any user data, and we do not use it for any purpose, including creditworthiness or lending.
Who the extension talks to
The extension connects only to these Microsoft services, over HTTPS:
login.microsoftonline.com: Microsoft Entra ID, to sign you in.*.vault.azure.net: Azure Key Vault, to read the secret.
Microsoft processes that sign-in and those requests under your organization's agreement with Microsoft. Your organization decides who may sign in and which secrets you may read.
Permissions
- activeTab: to read the address of the current tab when you open the toolbar popup, so it can show whether that site is allowed.
- identity: to sign you in to Microsoft Entra ID.
- scripting: to add a small relay script to a site only after you allow that site. The relay passes requests between the page and the extension and does not read or change the page.
- storage: to keep the information described above.
- Host permissions: the two Microsoft services above, and each website you choose to allow.
Your choices
- Remove a site in the extension's toolbar popup to stop the extension working there.
- Clear the cached sign-in in the popup, or close the browser, to delete the access token.
- Uninstall the extension to delete everything it has stored.
Children
The extension is a tool for organizations and their staff. It is not directed at children.
Changes to this policy
If this policy changes, the new version is published on this page with a new effective date.
Contact
NTT Security (Sweden) AB, Stockholm, Sweden
privacy@security.ntt