Security
Security at E2LLM
We take security seriously. This page describes our security practices, how to report vulnerabilities, and our track record.
Architecture & Data Handling
E2LLM is designed with security as a core principle, not an afterthought.
Capture Extension (Local)
By default, the standalone capture extension processes the DOM and generates SiFR entirely in your browser. It sends no page content to E2LLM, needs no account, and works fully offline. First-party performance telemetry sends a persistent installation ID and daily aggregate capture counts, but no page content. If you configure the optional MCP bridge, it requires an API key and connectivity, and sends requested captures plus open-tab IDs, URLs, titles, and active status to the E2LLM relay.
MCP Extension & Server (Connected)
The MCP extension sends page representation data over an encrypted connection to the MCP Server, which generates and serves SiFR to your AI client. MCP session data (SiFR captures, actions, metadata) is encrypted before storage, retained for 30 days, and then purged. Access requires a lawful request, user consent, or a safety review.
- All MCP connections require authentication — via external providers (Google, Microsoft, GitHub) or E2LLM accounts
- Session data encrypted before storage — encryption keys managed by S2 Tikshuv Ltd
- Internal access to session data is audit-logged and policy-enforced
- No payment data stored — Paddle handles all financial data as Merchant of Record
- First-party performance monitoring only — no third-party analytics or advertising trackers
- Enterprise tier: full on-premises deployment, zero data egress
Vulnerability Disclosure Policy
We welcome responsible disclosure of security vulnerabilities. If you discover a vulnerability in any E2LLM product, please report it to us.
Report a vulnerability: Send details to
security@e2llm.com. Use this address for security issues only — not for support or feature requests.
What to include
- Description of the vulnerability and its potential impact
- Steps to reproduce
- Affected product (Extension, MCP Server, Relay, Website)
- Your contact information for follow-up
Our commitment
- Acknowledge receipt of your report
- Provide an initial assessment and severity classification
- Keep you informed of remediation progress
- Credit you in the advisory (unless you prefer anonymity)
- Not pursue legal action against good-faith security researchers
See our vulnerability disclosure page for the full reporting process and what to expect after you report.
Scope
The program covers our browser extensions (Chrome, Firefox), the E2LLM MCP relay server (mcp.e2llm.com), this website, and our authentication and authorization systems.
This is a summary. The
disclosure page carries the complete in-scope and out-of-scope lists, and its exclusions are broader than what is described here — check them before reporting.
Known Vulnerabilities (CVE)
We publish security advisories for confirmed vulnerabilities in E2LLM products.
| CVE ID | Product | Severity | Status | Published |
|---|
| No known vulnerabilities at this time. |
This table will be updated as advisories are published. Subscribe to security@e2llm.com for notifications.
Security Practices
- Regular dependency audits and updates
- All connections encrypted in transit
- For external sign-in (Google, Microsoft, GitHub), your password is handled by the provider — we never see it. For E2LLM accounts, passwords are stored as secure hashes
- Detected password fields are redacted before storage — we make best-effort to avoid storing plaintext passwords
- Content Security Policy headers on all web properties
- Extension published through official browser stores with review processes
- Source code under BSL 1.1 — auditable by customers