Privacy policy
In short: this website sets no cookies, loads nothing from third-party servers and uses no trackers. We only receive data if you write to us. The browser extension AuthTailor has no server and sends none of your data – its privacy policy is in section 5.
Sections 1–4 and 6–7 are a translation for convenience; the German version is legally binding. Section 5 is the original English privacy policy of the extension.
1. Controller
CloudDNA GmbH, Untere Hauptstraße 23, 7410 Loipersdorf, Austria
Managing director: Martin Koch · Phone: +43 664 1964199 · E-mail: office@clouddna.at
We are not obliged to appoint a data protection officer. For all data protection questions, you can reach us at the e-mail address above.
2. Visiting the website
When you visit the website, our hosting provider processes technically necessary data (IP address, time, page requested, browser identifier) in server logs in order to deliver the page and protect it against attacks. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). The logs are deleted automatically after a short time.
Hosting: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Delivery preferably from the Frankfurt (fra1) region. Where data may reach the USA, we rely on: EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023) and standard contractual clauses.
3. No cookies, no trackers, no third-party content
We do not set cookies. We access your device only where this is strictly necessary for a function you have chosen (§ 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021), § 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG)). Fonts, scripts, images and the video are hosted on our own server; no content is loaded from Google, YouTube, social media platforms or analytics services. The video only loads when you start it. The “Watch on YouTube” link opens YouTube in your browser; only then do Google’s privacy terms apply. Your browser stores the light/dark choice only for the current visit (sessionStorage); it is not transmitted to us.
4. Requests via the form and by e-mail
If you write to us via the form or by e-mail, we process your details (name, company, e-mail, subject of your request, role, environment, message and – if you came via a link with a campaign code – that code from the address bar, so that we know what you are responding to) in order to reply to you. The legal basis is taking steps prior to entering into a contract (Art. 6(1)(b) GDPR) or our legitimate interest in answering enquiries (point (f)). We create the request as a contact in our CRM (the Tailor-Plattform of CloudDNA) and handle it there; no processor outside CloudDNA is involved. In the “Thank you” window after submitting, we display your first name and e-mail address only in your browser – nothing is stored or transmitted to third parties for this. We keep the request until it has been dealt with, and beyond that only where statutory retention obligations apply or a contractual relationship results from it. Please do not send us tokens, cookies, passwords or service keys. We will not send you a newsletter unless you expressly subscribe to one.
5. Browser extension AuthTailor
This section is the privacy policy of the browser extension AuthTailor for Chrome, Microsoft Edge and Firefox, in the same wording as under “About” in the extension. It is also the address given as the privacy policy in the Chrome Web Store.
Last updated: 2026-11-08 · Same wording as under “About” in the extension.
Who is responsible
AuthTailor is a browser extension that helps developers and administrators analyse SAML and OpenID Connect logins. It is published by:
- CloudDNA GmbH, Untere Hauptstraße 23, 7410 Loipersdorf, Austria
- E-mail: office@clouddna.at
- Imprint: https://www.clouddna.at/impressum/
In short
No data leaves your device. AuthTailor has no server, no account, no analytics, no telemetry, no advertising and no third-party code. It never sends your data to CloudDNA or anyone else.
The one request it makes on your behalf
When you click "Load keys from <issuer>", the panel fetches the public discovery document and the public keys (JWKS) of that token issuer with a plain HTTP GET, without cookies or a referrer. Nothing from your input is sent; the issuer only sees that its public keys were requested, and from which IP address. Without that click, the extension makes no network request.
What the extension processes, and where
- Live recording (only after you press "Record live"): the extension observes the network requests that the browser makes during a login – URL, method, form parameters of login POSTs (e.g. SAMLResponse) and, if the "Headers" option is on, request and response headers. With the "Also bearer tokens" option it also observes JWTs in the Authorization header of API calls. It does this only after you grant the optional host permission, and gives that permission back when you stop. Recording stops on its own after 30 minutes.
- Pasted or dropped content: text or files you paste or drop into the panel, such as SAML messages, JWTs, URLs, HAR files, error messages, certificates, keys, SAP service keys, destinations or configuration files.
- Page storage scan (only after you click "Scan this page" in Tools): a function runs once in the active tab and reads its localStorage, sessionStorage, IndexedDB and the names of cookies readable by JavaScript. Only the kind of each token (JWT, refresh token, secret), its length and harmless claims (issuer, audience, expiry, scopes) come back to the panel – never a value. Access comes from activeTab (when you opened the panel from the toolbar icon) or from a one-time host permission that is given back right after the scan.
- Analysis runs entirely inside the extension panel on your device. Recordings and pasted content stay in memory only while the panel is open; they are never written to disk.
- Masking: secrets are masked as they are recorded – cookie values, Authorization values, CSRF tokens, API keys, session headers, client secrets and passwords. Long cookie values are kept only as a short fingerprint, so that the tracer can tell whether a session cookie was renewed at login; refresh tokens only as a short hash, so that it can tell whether they are rotated. Bearer JWTs and DPoP proofs stay unmasked only with the "Also bearer tokens" option, because the check needs them.
- Stored settings: only your choice of UI language and the "Headers" option (browser storage of the extension), plus a flag recording whether the extension requested the host permission itself, so that it can hand it back (session storage, cleared when the browser closes). You can reset the settings under About or remove them by uninstalling the extension.
What leaves the panel
- Only what you copy or save yourself, for example with "Copy report", "Copy headers (masked)" or "Save cleaned HAR".
- The copied report and the saved HAR contain masked values only.
Links to websites
Under About, the panel links to the CloudDNA website, its imprint and our books at SAP PRESS. These links open in a new tab without a referrer; the extension sends nothing with them. The websites you open have their own privacy policies.
Sharing and sale
None. AuthTailor does not sell or transfer any data, and does not use any data for advertising, creditworthiness or any purpose other than its single purpose of analysing logins.
Legal basis and your rights
As CloudDNA receives no personal data through AuthTailor, it stores nothing about you that could be accessed, corrected or deleted. All processing happens on your device at your request. If you have questions, write to office@clouddna.at. You also have the right to lodge a complaint with a supervisory authority; in Austria this is the Datenschutzbehörde (https://www.dsb.gv.at/).
Changes
If the extension's handling of data changes, this policy is updated with the new version and the date above.
6. Advertising
We send advertising e-mails or make advertising calls only with your prior consent (§ 174 TKG 2021).
7. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection. To exercise them, write to office@clouddna.at. You can lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at) or with a supervisory authority in your country.
Last updated: 8 November 2026