Skip to content
VamiGuard Trust Center

Security, compliance and privacy — made transparent.

VamiGuard is a free browser extension for Chrome. It detects personal data, API keys, passwords and tokens in prompts to AI chatbots locally in the browser and, once you confirm, replaces them with placeholders before the prompt is sent. This Trust Center shows how we protect data, where processing takes place and how we develop securely.

Proks Certification – ISO/IEC 27001 Certified
ISO/IEC 27001:2022 certified VamiSec GmbH ISMS · Proks Certification GmbH (DAkkS-accredited) · certificate no. DE-IS-20250191 · valid until 18 September 2028 Download certificate (PDF) ⤓
View documents security@vamisec.com
PublisherVamiSec GmbH · Bonn, Germany
HostingLocal in the browser · no backend
StatusBeta · Chrome extension
Report a security incidentsecurity@vamisec.com
Last updated13 October 2026
01 — Compliance & Certifications

Built on certified foundations.

VamiGuard is developed and published by VamiSec GmbH, whose information security management system is certified to ISO/IEC 27001 by a DAkkS-accredited body. We transparently indicate what is certified, what is in preparation and what is a self-declaration.

ISO/IEC 27001

VamiSec GmbH ISMS — certified by the DAkkS-accredited Proks Certification GmbH, valid until 09/2028.

Certified

ISO/IEC 42001

VamiSec AI management system built per ISO/IEC 42001 — certification in preparation.

In preparation

GDPR

According to the extension’s privacy policy, the GDPR roles of controller and processor do not arise for VamiSec in respect of the extension’s runtime operation — detection runs on your device. Questions: privacy@vamisec.com.

Local processing

Store privacy requirements

Confirmed in line with Chrome Web Store requirements: no sale or transfer of user data, no use for advertising, use only for the declared purpose.

Self-declaration

ISO 14001

VamiSec GmbH environmental management system built per ISO 14001:2026 — certification in preparation.

In preparation

EcoVadis

Sustainability rating of VamiSec GmbH — Committed badge, awarded in October 2026.

Committed badge
02 — Hosting & Data Flow

Local processing in the browser — no data centre, no backend.

Unlike our SaaS products, today’s VamiGuard extension does not run in a data centre but entirely in the browser on your device. VamiSec operates no server that receives or stores data from the extension. The prompt — redacted if you confirm it — goes to the chatbot you chose, as usual; your browser obtains updates via Google’s Chrome Web Store.

No backend, nothing to hostDetection and redaction run in the browser on your device; there is no server-side component.
No network connections of its own (per privacy policy)The extension only reads and modifies the page already rendered in the browser (the DOM) and itself transmits no data to VamiSec, the chatbot provider or anyone else.
Ephemeral placeholder mappingThe mapping between placeholder and original value exists only in the open tab, is not written to disk and is deleted when the tab is reloaded or closed.
No AI model, no LLM callDetection currently works with local patterns (regular expressions); VamiGuard itself does not call any LLM. We do not use customer data as training data.
VamiGuard Cloud & SovereignRoadmap · plannedNot available today. The planned Cloud tier is intended to run on Deutsche Telekom’s T Cloud Public (formerly Open Telekom Cloud), exclusively in German data centres; the Sovereign tier is intended to run on-premises at the customer’s site.
  • Prompt content: checked locally — not stored on VamiSec servers, not transmitted by the extension
  • Placeholder mapping: only in the open tab, deleted on reload or close
  • Settings & custom patterns: in the browser’s extension storage on your device
  • Telemetry, analytics, crash reporting: none

These statements concern the extension, not the website vamiguard.com. Full text: extension privacy policy.

03 — Security Controls

How we protect — by domain.

Concrete controls instead of marketing. These measures are part of our security concept and are aligned with VamiSec’s ISMS.

Data security

  • The extension checks prompt content only locally in the browser — not stored on VamiSec servers
  • Ephemeral placeholder mapping: deleted when the tab is reloaded or closed
  • Settings and custom patterns stay in the extension storage on the device
  • No AI training on customer data by VamiSec — whether your chatbot trains on prompts is governed by its provider’s terms

Application security

  • Secure SDLC from requirements through to release (details below)
  • Manifest V3 browser extension — no server-side components
  • Pattern-based detection without a guarantee of completeness — you decide on every redaction

Access & identity

  • No user account, no sign-in, no registration
  • VamiSec has no access to your prompts or settings — there is no backend
  • Installation and configuration are in your own hands

Infrastructure

  • No server infrastructure: the extension runs in the browser on your device
  • Distribution and updates via the Chrome Web Store — no update server of our own
  • Website vamiguard.com hardened separately (HSTS, Content Security Policy)

Logging & traceability

  • No telemetry, no analytics, no crash reporting by the extension
  • A mapping panel shows you the current assignment of placeholders to original values
  • Changes to data handling: new version of the privacy policy with a new effective date

Incident management

  • Defined incident response process
  • Security issues in the extension: report to security@vamisec.com
  • Machine-readable contact details per RFC 9116: security.txt

User in control

  • A warning for every potential secret detected — you decide whether it is redacted
  • Confirmed values are replaced with stable placeholders before sending and restored locally in the response
  • Individual detectors can be switched off; custom words and regex patterns can be added

Organisation & governance

  • VamiSec ISMS certified to ISO/IEC 27001 (DAkkS-accredited body)
  • Security awareness training for all employees
  • Supplier and risk management processes

Availability & portability

  • No backend: the extension does not depend on VamiSec servers
  • Custom patterns can be exported to and imported from a local text file
  • You exercise your rights directly in the browser: view, export, switch off detectors, uninstall
04 — Secure Software Development Lifecycle

We develop as securely as we test.

For VamiGuard, security is not a downstream step but anchored in every phase of development — state of the art, from requirements through to release.

01

Security Requirements Engineering

Security and data-protection requirements are defined before the first line of code.

02

Threat Modeling

Threat modeling based on STRIDE as part of our development process.

03

Code Review

Changes are reviewed before they are merged — with a focus on security and data protection.

04

Pre-release Testing

Changes are tested before they are published to the Chrome Web Store.

05

Secure Deployment

Delivery and updates via the Chrome Web Store; the detection patterns ship as part of the extension package.

06

Responsible Disclosure

Report security issues to security@vamisec.com (machine-readable: /.well-known/security.txt).

05 — Sub-processors

Disclosed — who processes which data.

VamiSec uses no sub-processors to operate the VamiGuard extension: detection and redaction run locally in the browser, and there is no backend. If this changes — for example through the planned Cloud or Sovereign features — we will publish the change in the extension’s privacy policy with a new effective date and note material changes in the update notes on the Chrome Web Store.

You choose the chatbots you use with VamiGuard yourself; their providers are not sub-processors of VamiSec. You remain responsible for any data you send to a chatbot.

Sub-processor Purpose Region
None
VamiGuard browser extension		 Detection and redaction run locally in the browser on your device; the extension transmits no data to VamiSec or anyone else. Local

Privacy questions about the extension: privacy@vamisec.com · Full text: extension privacy policy.

06 — Documents & Evidence

Everything you need for your review.

Public documents are available directly. Confidential evidence is released upon a brief request or under NDA.

Public

ISO/IEC 27001 certificate

Certificate of the VamiSec ISMS (no. DE-IS-20250191, ISO/IEC 27001:2022, valid until 18 September 2028), issued by the DAkkS-accredited Proks Certification GmbH.

View →
Public

Information Security Policy

Overarching information security policy with strategic direction.

View →
Public

AI Policy

Overarching policy of VamiSec GmbH on the responsible use of AI — the foundation of our AI management system per ISO/IEC 42001, with reference to the EU AI Act and the GDPR.

View →
Public

Extension privacy policy

Version 1.0, effective 28 April 2026: which data the extension processes locally, where it resides and how you exercise your rights directly in the browser.

View →
On request

Statement of Applicability (ISO/IEC 27001)

Statement of the applicability of the Annex A controls in the ISMS of VamiSec GmbH — on request.

Request →
On request

Architecture & data flow

We answer technical questions on the architecture and data flow of the VamiGuard extension on request; the summary is in the “Hosting & Data Flow” section above.

Ask us →
Under NDA

CAIQ / Security Questionnaire

VamiSec answers common security questionnaires (e.g. CAIQ) for your vendor risk process on request under NDA.

Request →
Public

Responsible disclosure (security.txt)

Report security vulnerabilities in VamiGuard confidentially to security@vamisec.com — machine-readable per RFC 9116 at /.well-known/security.txt.

View →
Public

Environmental & sustainability policies

ISO 14001 environmental management policy and the sustainability & ESG policy of VamiSec GmbH.

Environmental Management Policy (PDF) ↗ Sustainability & ESG Policy (PDF) ↗
07 — Environmental management & sustainability

Responsibility beyond information security.

VamiSec GmbH, the publisher of VamiGuard, runs a documented environmental management system (EMS) per ISO 14001:2026. It is integrated with our ISO/IEC 27001-certified ISMS into one management system, and our sustainability performance is additionally assessed externally by EcoVadis.

Environmental management system per ISO 14001:2026Environmental policy, registers of environmental aspects and legal obligations, measurable environmental objectives with KPIs and clearly assigned EMS responsibility.
Integrated with the ISMSThe EMS uses the processes of our ISO/IEC 27001-certified ISMS — from change and corrective-action management to a joint management review.
Certification in preparationCertification to ISO 14001 by a DAkkS-accredited body is in preparation; the audit is planned for 2027.

In the EcoVadis sustainability rating, VamiSec GmbH was awarded the Committed badge in October 2026 — recognising continuous improvement in sustainability.

The rating and the environmental management system relate to VamiSec GmbH as a company — the developer and publisher of VamiGuard.

08 — FAQ

Common questions from due diligence.

Where is our data stored?
Not with VamiSec. The VamiGuard extension checks prompt content locally in the browser on your device; your settings and custom patterns are kept in the browser’s extension storage, and the placeholder mapping only in the open tab. VamiSec operates no server that receives or stores data from the extension. The prompt — redacted if you confirm it — is received by the chatbot provider you chose.
Is VamiGuard ISO 27001 certified?
Not as a product: ISO/IEC 27001 certifies management systems, not individual products. What is certified is the ISMS of VamiSec GmbH, which develops and publishes VamiGuard — by the DAkkS-accredited Proks Certification GmbH (certificate DE-IS-20250191, ISO/IEC 27001:2022, valid until 18 September 2028). According to the certificate, the scope is: “Provision of consulting services in the field of information security, associated digital products and supporting information-processing facilities for the processing of customer data, IT infrastructure and cloud storage” (translated from German). The certificate does not name individual products.
How do users authenticate?
They don’t need to: the VamiGuard extension has no user account, no sign-in and no registration. You install the extension from the Chrome Web Store and configure it yourself. As there is no backend, VamiSec has no access to your data.
Can VamiSec see our prompts?
No. According to its privacy policy, the extension opens no network connections of its own and itself transmits no data to VamiSec or anyone else; there is no telemetry, no analytics and no crash reporting. Important: the prompt goes to the chatbot as usual — redacted if you confirm the redaction, otherwise with the original values. Your browser checks for updates with Google’s Chrome Web Store, not with VamiSec.
How will we be informed in the event of a security incident?
We follow the defined incident response process of our ISMS. As the extension has neither a backend nor user accounts, VamiSec stores no data from the extension and cannot notify users individually. We distribute fixes as updates via the Chrome Web Store, through which your browser updates the extension; changes to data handling are published in the extension’s privacy policy, and material changes are noted in the update notes on the Chrome Web Store. Please report security issues to security@vamisec.com — machine-readable per RFC 9116 at /.well-known/security.txt.
Is our data used to train AI models?
No. We do not use customer data as training data: we do not train or fine-tune any AI models with it, and we only connect external AI models under contractual terms that exclude use for training. VamiGuard itself uses no AI model today — detection works with local patterns in the browser, and VamiSec receives no user data from the extension. Whether the chatbot provider you send prompts to uses them for training is governed by that provider’s terms.
How do we obtain access to confidential documents?
Public documents are available directly. For the Statement of Applicability, questions on the architecture or completed questionnaires, a short request to security@vamisec.com is sufficient; evidence subject to an NDA is released after signing.
What is available today, and what is planned?
Available today is the free Community extension for Chrome from the Chrome Web Store, labelled as beta. It warns you about detected values and leaves the decision to you. Planned but not available today are the VamiGuard Cloud tier (SaaS on T Cloud Public, German data centres only) and the VamiGuard Sovereign tier (on-premises at the customer’s site). If this changes how data is processed, we will update the extension’s privacy policy and this Trust Center.
Still have questions?

Talk to our team.

We answer your security and compliance questions and provide the evidence your procurement needs.

Book a meeting security@vamisec.com