SuperAlign Browser Extension v1

SuperAlign Browser Extension is a companion to the SuperAlign Surface scanner — a Shadow AI discovery and inventory platform for security and IT teams. Together they help your organization see which AI tools your workforce uses, understand what data is leaving the company, and apply governance policies to AI usage. This extension captures the prompts you submit to popular AI web tools and forwards them to the SuperAlign Surface scanner running on the same machine. The scanner aggregates that activity into your organization's AI Bill of Materials (AIBOM), which security teams use for inventory, risk scoring, and remediation. WHO THIS IS FOR SuperAlign is deployed by IT and security teams. The extension is intended to be installed on company-managed endpoints as part of the SuperAlign deployment. It is not useful as a standalone tool — it requires the SuperAlign Surface scanner to be installed on the same device. WHAT IT CAPTURES The extension intercepts user-submitted prompts on these AI web tools: • ChatGPT (chatgpt.com) • Claude (claude.ai) • Perplexity (perplexity.ai) • Gemini (gemini.google.com) For each prompt, it captures: the destination host, the request URL, and the prompt text the user submitted. It does not capture: model responses, conversation history, page content unrelated to a submitted prompt, cookies, credentials, or browsing activity outside the four supported AI hosts. WHERE THE DATA GOES Captured prompts are sent only to the local SuperAlign Surface scanner running on the same machine, over a loopback HTTP API at 127.0.0.1:57343. The extension does not communicate with any third-party server, advertising network, or analytics service. The scanner — not the extension — is responsible for forwarding aggregated data to the customer's own SuperAlign backend. PERMISSIONS The extension requests the minimum permissions needed for its function: • host_permissions: chatgpt.com, claude.ai, *.perplexity.ai, gemini.google.com — required to inject the prompt-capture script into these specific AI tools. • host_permissions: http://127.0.0.1:57343/* — required to send captured prompts to the local SuperAlign scanner over loopback HTTP. The extension does NOT request: tabs, cookies, history, downloads, storage, scripting, webRequest, nativeMessaging, or any broad host permission. It cannot read your browsing activity outside the four AI tools listed above. PRIVACY AND SECURITY • All communication with the scanner happens on localhost; no data is sent to the internet by the extension itself. • The scanner validates every request against the extension's ID — other local processes and websites cannot impersonate the extension. • The scanner authenticates against your organization's SuperAlign tenant; the extension reads but never writes credentials. • Source code and security architecture documentation are available to enterprise customers under NDA. HOW IT WORKS 1. The extension's content script runs only on the four supported AI hosts. 2. When you submit a prompt in the AI tool's web interface, the script reads the outbound request body and extracts the user-authored text. 3. The captured prompt is sent to the local SuperAlign Surface scanner over the loopback HTTP API. 4. The scanner enriches and forwards the prompt as part of the organization's AIBOM inventory. REQUIREMENTS • SuperAlign Surface scanner installed and running on the same machine. • An active SuperAlign tenant; sign-in is handled by the scanner, not the extension. SUPPORT For deployment, configuration, or support questions, contact your SuperAlign representative or visit https://superalign.ai.