What the extension does with your data

Last updated 7 September 2026.

Who this covers

Holio Vault is a browser extension published by Holio for people who already
use Holio. It is a client of your own Holio environment and has no service of
its own: there is no Holio Vault account, no Holio Vault server, and no
Holio Vault database.

What it reads

Your vault items, from your own Holio. When you open the popup, the
extension asks your Holio environment for the vault items you already have
access to — their names, usernames, addresses and tags. When you copy or fill
a password, it asks for that one value. Both requests are the same ones the
Holio web vault makes, and both are recorded in Holio's audit log exactly as
they are there.

The address of the tab you are looking at, at the moment you open the
popup, so it can show which items belong to that site and fill its login
form. It is not given standing access to your tabs or your browsing history,
and nothing about the pages you visit is recorded or sent anywhere.

What it stores

Almost nothing. A password or a 2FA key that you reveal lives in the
popup's memory for the seconds between revealing it and copying or filling
it, and is gone when the popup closes. No vault secret is written to disk, to
browser storage, or to a cache.

Two things are stored, both on your own machine:

• The address of your Holio environment — one setting, synced by Chrome

across your own signed-in browsers, exactly like your other extension
settings.

• 2FA accounts you add yourself through the extension's own add page.

These stay in that browser so the codes work offline, and are never sent
anywhere. Adding the first one asks you to set a passphrase, and the store
is sealed with it: AES-GCM under a key derived from that passphrase
(PBKDF2, 600 000 iterations). The derived key is kept in session memory, so
you are asked once per browser session rather than once per code. You can
remove them all at any time from the settings page.

What it sends, and to whom

Only to your own Holio address, and only the requests described above.
There is no analytics, no telemetry, no crash reporting, no advertising
identifier and no third-party service of any kind. The extension contacts no
server that Holio does not run for you.

We do not sell your data. We do not transfer it for any purpose unrelated to
showing you your own vault. We do not use it to assess creditworthiness or for
lending.

How it signs in

It does not. The extension reuses the Holio session already in your browser.
Your session cookie is set by Holio, marked HttpOnly, and never read by the
extension — the browser attaches it to the extension's requests because you
granted the extension permission for your Holio address. There is no password
for the extension, and signing out of Holio ends the extension's access at the
same moment.

What runs on the pages you visit

Nothing, until you press Fill. The extension has no content script and no
background worker: the only code that ever enters a page is the fill function,
injected when you click Fill, on the top frame of an https page (or a
loopback address, for local development). Which items can be filled is decided
strictly — only an item whose address is the exact host of the page, so
neither a lookalike domain nor a neighbour on a shared hosting domain ever
surfaces a real credential. An item that merely shares the page's registrable
domain is listed and can be copied, but gets no Fill button. The address is
read again at the moment you click, so a tab that navigated while the panel
was open is refused rather than filled.

The permissions it asks for

• The tab you are on (activeTab) — its address, when you open the popup

and again when you click Fill.

• Script injection (scripting) — the fill function, on your click.
• Storage — the one setting and your own 2FA accounts, above.
• Clipboard — the copy buttons.
• Your Holio address — the server it is a client of.

Any other address is optional and granted by you one at a time: if you point
the extension at a different Holio environment, Chrome asks you about exactly
that one site.

Your rights, and where the data actually lives

The data the extension shows is your organisation's data in your own Holio
environment. Access, correction, export and deletion are handled there, by
your Holio administrator, under Holio's own terms — the extension is a window
onto it and holds no copy. Removing the extension removes the setting and any
2FA accounts you added on that machine, and nothing else, because there is
nothing else.

Contact

Questions about this statement, or about what the extension does:
hello@holio.ai.