Security Center

How Tempus AI PM protects your data, what we access, and how to report vulnerabilities.

Core principle: Tempus is a local-first Chrome extension. Your Jira, Calendar, and project data is processed in your browser. We do not operate a central application server that receives or stores your data.

1. Architecture overview

Tempus is a Chrome Extension (Manifest V3) that runs entirely in your browser as a service worker + side panel. It communicates directly with your existing SaaS APIs — Jira, Tempo, Google Calendar, Confluence, Dynamics 365, Salesforce — using your authenticated sessions. No data is proxied through Tempus servers.

What connects where

Connection	Direction	Data	Purpose
Jira Cloud	Browser → Jira	Issues, worklogs, projects	Core functionality
Tempo	Browser → Tempo	Plans, allocations, schedules	Capacity & compliance
Google Calendar	Browser → Google	Events (read-only)	Meeting visibility
Confluence	Browser → Confluence	Page creation	Report publishing
Dynamics 365 / Salesforce	Browser → CRM	Project fields	CRM data sync
Claude / Gemini	Browser → AI provider	Selected project metrics	AI analysis (optional, user-initiated)
Supabase	Browser → Supabase	License key + device ID	License validation only

2. OAuth scopes & permissions

Tempus requests the minimum scopes required for each integration:

Jira / Atlassian (OAuth 2.0 — 3LO)

read:jira-work — Read worklogs, issues, projects
write:jira-work — Create/update worklogs
read:jira-user — Read user profiles for team views
read:confluence-content.all — Read Confluence spaces (for publishing target)
write:confluence-content — Create Confluence pages (reports)

Google Calendar (OAuth 2.0)

calendar.events.readonly — Read-only access to calendar events. Tempus cannot create, modify, or delete events.

Tempo

Personal API token — provided by the user in Settings. Used for plans, allocations, schedules, and user workday data.

Dynamics 365 / Salesforce

Cookie-based session or OAuth 2.0 (Dynamics), OAuth 2.0 (Salesforce). Access limited to configured entity/object fields only.

3. Token storage

Tempus uses Chrome's extension storage APIs with security best practices:

Access tokens are stored in chrome.storage.session — ephemeral storage that is cleared when the browser closes and is not accessible to content scripts or web pages.
Refresh tokens are stored in chrome.storage.local with access restricted via setAccessLevel to trusted extension contexts only (service worker and popup).
Tokens are never exposed to web pages, content scripts, or other extensions.
Users can revoke all tokens instantly by disconnecting integrations in Settings or uninstalling the extension.

4. Data retention & storage

Data type	Storage	Retention
Jira issues, worklogs	chrome.storage.local	Cached; cleared on disconnect
Calendar events	In-memory only	Discarded when popup closes
Tempo data	In-memory cache (60s TTL)	Not persisted
CRM field data	chrome.storage.local	Configuration only; live data fetched per view
AI analysis results	chrome.storage.local (optional)	User-managed; deletable in Reports
Passive activity log	chrome.storage.local	30-day auto-cleanup
License key	chrome.storage.local	Until user disconnects

5. Content Security Policy

The extension's manifest.json enforces a strict Content Security Policy. No inline scripts are used — all event handlers are bound programmatically. No external scripts are loaded at runtime. The extension does not inject content scripts into web pages.

6. Third-party services

Service	Purpose	Data sent
Supabase	License validation & device activation	License key, anonymized device fingerprint
Stripe	Payment processing	Handled entirely by Stripe — Tempus never sees card data
Resend	Transactional email (license delivery)	Email address + license key
Claude API / Gemini API	AI analysis (optional, user-initiated)	Selected project metrics: titles, statuses, hours, team member names

7. What Tempus does NOT do

Does not collect usage analytics or behavioral data
Does not display ads
Does not sell or share data with third parties
Does not operate a central backend that processes your Jira data
Does not inject scripts into web pages
Does not access browser history, bookmarks, or other extensions
Does not store credentials — only OAuth tokens managed by Chrome's APIs

8. Vulnerability reporting

If you discover a security vulnerability in Tempus, please report it responsibly. We take all reports seriously and will respond promptly.

Email: hello@tempus-ai-pm.com (subject: "Security Report")

Please include:

Description of the vulnerability
Steps to reproduce
Impact assessment
Your suggested fix (if any)

We commit to acknowledging reports within 48 hours and providing a resolution timeline within 5 business days.

9. Updates

This page is updated with each release. Extension updates are delivered automatically through the Chrome Web Store. Changes to scopes, permissions, or data handling are communicated in the extension's changelog and on this page.

Last updated: September 2026 · Extension version: 4.5.0