Is Staffbase Email safe?

Clean risk

Staffbase Email captures outgoing Gmail subject, recipients, and links on send and posts them to its Bananatag tracking backend.

On Gmail compose, the extension's content script collects each outgoing message's subject, recipient list, and embedded links, and POSTs them to serviceapi-v3-prod.bananatag.com to register the email for tracking. When link tracking is enabled, it also reads the anchor links in the message body and rewrites each one through the s2.bl-1.com redirector so opens and clicks can be logged. The content script runs only on mail.google.com, and the tracking behavior is the extension's stated purpose.

Staffbasev5.5.1Chrome Web Store
0Risk
Who publishes it

Staffbase SE - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Staffbase
Declared legal entity
Staffbase SE
Registered address
Annaberger Str. 73, Chemnitz 09111, DE
Registered contact
Ilija Lazarov
Website
support.staffbase.com/hc/en-us

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 5.5.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on googleusercontent.com

    https://*.googleusercontent.com/*

  • Read and change your data on bananatag.com

    https://*.bananatag.com/*

  • Read and change your data on mail.google.com

    https://mail.google.com/* and 1 more

  • Read and change your data on datadoghq.com

    https://*.datadoghq.com/*

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed Staffbase contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • s2.bl-1.com

    Staffbase sends data to s2.bl-1.com. No other extension we have analyzed sends data here.

  • serviceapi-v3-prod.bananatag.com

    Staffbase sends data to serviceapi-v3-prod.bananatag.com. No other extension we have analyzed sends data here.

  • Staffbase / Bananatag

    Staffbase sends data to Staffbase / Bananatag. Named as a recipient in this extension's own analysis.

Updated 30 September 2026jpbnpbfpgjkblmejlgkfkekajajhjcid