Security Center
How Tempus AI PM protects your data, what it accesses, and how to report vulnerabilities.
1. Architecture overview
Tempus is a Chrome Extension (Manifest V3) that runs entirely in your browser as a service worker plus side panel. It communicates directly with your existing SaaS APIs — Jira, Tempo, Google Calendar, Confluence, Dynamics 365, Salesforce — using your authenticated sessions. No data is proxied through Tempus servers.
What connects where
| Connection | Direction | Data | Purpose |
|---|---|---|---|
| Jira Cloud | Browser → Jira | Issues, worklogs, projects | Core functionality |
| Tempo | Browser → Tempo | Plans, allocations, schedules | Capacity & compliance |
| Google Calendar | Browser → Google | Events (read-only) | Meeting visibility |
| Google Tasks | Browser → Google | Tasks (read + mark complete) | Import tasks into Jira |
| Confluence | Browser → Confluence | Page creation | Report publishing |
| Dynamics 365 / Salesforce | Browser → CRM | Project fields | CRM data sync |
| Claude / Gemini | Browser → AI provider | Selected project metrics | AI analysis (optional, user-initiated) |
| Supabase | Browser → Supabase | License key + device ID | License validation only |
2. OAuth scopes & permissions
Tempus requests the minimum scopes required for each integration:
Jira / Atlassian (OAuth 2.0 — 3LO)
read:jira-work— read worklogs, issues, projectswrite:jira-work— create and update worklogsread:jira-user— read user profiles for team viewsread:confluence-content.all— read Confluence spaces (publishing target)write:confluence-content— create Confluence pages (reports)
Google Calendar & Tasks (OAuth 2.0)
calendar.events.readonly— read-only access to calendar events. Tempus cannot create, modify or delete events.https://www.googleapis.com/auth/tasks— read your Google Tasks and mark an imported task complete. Tempus does not create or delete tasks or lists.
Tempo
- Personal API token — provided by you in Settings. Used for plans, allocations, schedules and workday data.
Dynamics 365 / Salesforce
- Cookie-based session or OAuth 2.0 (Dynamics), OAuth 2.0 (Salesforce). Access limited to the configured entity/object fields only.
3. Token storage
Tempus uses Chrome’s extension storage APIs with security best practices:
- Access tokens are stored in
chrome.storage.session— ephemeral storage that is cleared when the browser closes and is not accessible to content scripts or web pages. - Refresh tokens are stored in
chrome.storage.localwith access restricted viasetAccessLevelto trusted extension contexts only (service worker and popup). - Tokens are never exposed to web pages, content scripts or other extensions.
- You can revoke all tokens instantly by disconnecting integrations in Settings or uninstalling the extension.
4. Data retention & storage
| Data type | Storage | Retention |
|---|---|---|
| Jira issues, worklogs | chrome.storage.local | Cached; cleared on disconnect |
| Calendar events | In-memory only | Discarded when the popup closes |
| Google Tasks | In-memory only | Discarded when the popup closes |
| Tempo data | In-memory cache (60s TTL) | Not persisted |
| CRM field data | chrome.storage.local | Configuration only; live data fetched per view |
| AI analysis results | chrome.storage.local (optional) | User-managed; deletable in Reports |
| Passive activity log | chrome.storage.local | 30-day auto-cleanup |
| License key | chrome.storage.local | Until you disconnect |
5. Content Security Policy
The extension’s manifest.json enforces a strict Content Security Policy. No inline scripts are used — all event handlers are bound programmatically. No external scripts are loaded at runtime. The extension does not inject content scripts into web pages.
6. Third-party services
| Service | Purpose | Data sent |
|---|---|---|
| Supabase | License validation & device activation | License key, anonymized device fingerprint |
| Stripe | Payment processing | Handled entirely by Stripe — Tempus never sees card data |
| Resend | Transactional email (license delivery) | Email address + license key |
| Claude API / Gemini API | AI analysis (optional, user-initiated) | Selected project metrics: titles, statuses, hours, team member names |
7. What Tempus does NOT do
- Does not collect usage analytics or behavioral data
- Does not display ads
- Does not sell or share data with third parties
- Does not operate a central backend that processes your Jira data
- Does not inject scripts into web pages
- Does not access browser history, bookmarks or other extensions
- Does not store credentials — only OAuth tokens managed by Chrome’s APIs
8. Vulnerability reporting
Email: hello@tempus-ai-pm.com (subject: "Security Report")
Please include:
- Description of the vulnerability
- Steps to reproduce
- Impact assessment
- Your suggested fix (if any)
Reports are acknowledged within 48 hours, with a resolution timeline provided within 5 business days.
9. Updates
This page is updated with each release. Extension updates are delivered automatically through the Chrome Web Store. Changes to scopes, permissions or data handling are communicated in the extension’s changelog and on this page.
Last updated: September 2026 · Extension version: 4.5.0