Security

Am I Being Pwned? is built and operated by Bay Area Labs Inc. We specialize in analyzing browser extensions for malicious, suspicious, and vulnerable behavior. Our team combines security research experience with engineering expertise in browser internals. Our founder is on the Centre for Cybersecurity Belgium's 2026 Wall of Fame for coordinated vulnerability disclosure.

Security questions or a questionnaire to fill in? Email security@amibeingpwned.com.

• Edge network - Cloudflare Pages and Workers handle all HTTP traffic, providing DDoS mitigation, TLS termination, and global edge caching. Only static assets are cached at the edge; customer data is not.
• Database - Cloudflare D1, our multi-tenant application database, plus a separate D1 database holding the public extension catalog.
• Data location - Our databases are stored in the EU. Requests are served by Cloudflare's global network, so a request may be handled at the data center nearest the user on its way to the database.
• Subprocessors - Cloudflare (hosting, database and email delivery) and PostHog (product analytics). See the full list; we email account owners 30 days before adding one.
• Encryption - TLS 1.2+ in transit. Encrypted at rest, with integration credentials (SentinelOne and Google Workspace tokens) separately encrypted with AES-256-GCM before they are written, so a database read alone does not yield a usable token.
• Backups and continuity - the database can be restored to any minute in the last 30 days, which also means deleted data leaves our backups within 30 days. Paid plans can export the fleet as CSV at any time, and anyone can ask us for a full export. If we ever wind the service down, we give at least 90 days' notice and a full export before anything is deleted.
• Authentication - Passkeys, magic links, or Google OAuth 2.0. We never store passwords. Session tokens are signed and httpOnly.
• Secrets management - All credentials and API keys are stored as encrypted environment variables, never committed to source control.

• No public database endpoint - D1 is reachable only through a binding held by our Worker. There is no host, no port and no connection string to leak, steal or expose: an attacker cannot reach the database directly even with stolen credentials, because there is nothing to connect to.
• Integration credentials, encrypted per use site - your SentinelOne and Google Workspace tokens are encrypted with AES-256-GCM under keys derived per use site via HKDF, with a fresh random IV per record. A key derived for one use site cannot decrypt another's data.
• Tokens never stored in plaintext - organization API keys, device enrollment tokens and invite tokens are stored only as hashes. Device tokens rotate on every sync.
• Hardened API surface - HSTS with preload, X-Frame-Options: DENY, nosniff and a strict referrer policy on every response, Turnstile on public mutations, and per-IP rate limiting at 200 requests per minute.
• Least privilege into your tools - our SentinelOne role holds a handful of read, indicator and alert-rule permissions out of roughly sixty. Its one endpoint action is File Fetch, to read browser settings files, and only if you collect inventory with it. Revoke it in your own console at any time, without asking us.

• Notification window - We notify affected customers within 24 hours of confirming an incident involving their data. That is deliberately inside the 72-hour window GDPR Article 33 gives you as controller, because your regulatory clock starts before our investigation finishes.
• What you get - An initial notice with the scope, the data categories affected and the time window, written updates until the incident is closed, and a post-incident report once it is resolved.
• How we reach you - Direct email to the owners and admins of your organization. We do not treat a status page as notification.
• Cooperation - We support your own regulator and data-subject notifications, including providing logs and written statements for your filing.

The Am I Being Pwned? extension (Chrome, Edge and Firefox) reports the following for each enrolled browser:

• A random device identifier the extension creates on install
• Browser, operating system and CPU architecture, and the extension's own version
• For each installed extension: its ID, name, version, install type, and whether it is enabled
• The email of the signed-in browser profile, if there is one and the browser shares it (not Firefox), so your admins can tell whose browser is whose
• Usage events from the extension popup, for product analytics

Other sources you can connect

• Google Workspace - the managed browsers and devices in your tenant, their extensions, and your directory users' work emails.
• SentinelOne - for each agent: computer name, serial number, operating system, last logged-in user, external IP, MAC addresses, and its installed browser extensions.
• Endpoint collector - the script you deploy reports a machine identifier, hostname and operating system, and for each browser profile the OS username and installed extensions.

What we never collect

• Browsing history or visited URLs
• Form data, keystrokes, or credentials
• Page content or DOM
• Cookies or session tokens
• Screenshots or screen recordings
• Personal files or documents

• management - list installed extensions, and disable the ones your policy blocks.
• identity - read the signed-in Chrome profile's email. Not requested on Firefox.
• storage, alarms and notifications - keep its enrollment, schedule syncs, and tell the user when an extension has been blocked.
• Host access to amibeingpwned.com and app.amibeingpwned.com only, so our dashboard can talk to it.

It does not request tabs, webRequest, cookies, or access to any other site, and cannot read or change the pages you visit.

• Independent assurance - Bay Area Labs Inc does not hold a SOC 2 report or ISO 27001 certification, and no third-party penetration test has been carried out. The controls under "How your data is protected" are ones you can check, and we will answer your security questionnaire.
• Framework mapping - The findings and compliance reports we generate for your fleet map to CIS Controls v8, ISO 27001 Annex A, and SOC 2 Trust Services Criteria. This describes the reports, not our own certification.
• GDPR - Our databases are stored in the EU. For your fleet data you are the controller and we are your processor. We collect the minimum data necessary and delete it on the schedule in our Privacy Policy.
• Data processing - We sign a Data Processing Agreement (DPA), with Standard Contractual Clauses where needed, with any paid customer who asks. Enterprise customers can agree a negotiated contract in place of the click-through terms.

If you believe you have found a security vulnerability in our service, email security@amibeingpwned.com. You can encrypt your report using our PGP key:

We ask that you

• Give us reasonable time to investigate and fix the issue before public disclosure
• Avoid accessing or modifying other users' data during your research
• Include enough detail for us to reproduce the issue

We will not pursue legal action against researchers acting in good faith.