Security for business

Kamelo keeps client and company data out of AI, and never receives it itself.

Download the security overview (PDF)Nederlands

Your team typesDraft a payment reminder to Jansen BV, IBAN NL91 ABNA 0417 1643 00, contact Pieter de Vries.
The AI getsDraft a payment reminder to [COMPANY_1], IBAN [IBAN_1], contact [PERSON_1].

Nothing for us to process

Kamelo is software on each computer, not a service your data passes through.

No servers in between

The extension makes no network requests of its own. Text never reaches Kamelo.

Stays on the device

The link between placeholders and real data is kept in the browser, and deleted after 30 days by default, or the period your organisation sets.

Open to your review

Kamelo Business is closed source, but its code ships unminified, so your security team can read what is installed. The free edition is open source.

Signed, official releases

Through the official browser stores, which review and sign every version. Every change runs through automated tests first.

What stays out of AI

Clients and contacts

Names, email addresses, phone numbers and addresses.

Bank and card details

IBANs from 87 countries (with checksum), card numbers, routing and account numbers.

Secrets

API keys, private keys, tokens and passwords after a keyword.

Companies and your own terms

Company names with a legal form, and any client or project name you add.

Questions from IT and your DPO

Does Kamelo receive or process our data?

No. Detection and restoring happen inside each person's browser. The extension has no account, no analytics and makes no requests of its own, so client and company data never reach Kamelo. You can check this in the browser's developer tools.

Where is data stored, and for how long?

Only in the browser on that computer: the vault that links placeholders to real values, kept separately per website. It's never synced or uploaded, can be locked with Touch ID or a password (AES-256-GCM), and old entries are deleted after 30 days by default. Your organisation can set another period in its policy. See the data processing statement.

Can we roll it out to everyone?

Yes. In the pilot build, IT installs Kamelo Business on every computer with Google Admin, Microsoft Intune or a macOS profile, and sets one central policy: the licence code, a shared list of client and project names, which details are masked, how long they're kept, your own support contact, and a lock so Kamelo can't be turned off. People see "Set by your organisation" in the popup. Start a pilot.

What will admins see?

Nothing that leaves the computer: there is no central dashboard. In the pilot build, the popup on each computer shows a monthly overview with only counts per type of data, such as 3 names and 1 IBAN, never what was typed. Settings your organisation applied are visible in chrome://policy.

Which AI tools are covered?

ChatGPT, Gemini, Claude, Copilot, Microsoft 365 Copilot, Perplexity, Mistral, DeepSeek, Grok, Meta AI and more, plus AI features on other sites such as Gmail and Notion. One exception: the Copilot panel built into Edge's sidebar, where Microsoft lets no extension work.

What doesn't Kamelo protect against?

Uploaded files and images go as they are. Internal code names are only caught once you add them. Detection is rule-based, so an unusual name can slip through. And Kamelo doesn't stop someone from deliberately sharing data.

Has Kamelo been audited?

Not by an outside firm yet. Every change runs through automated tests, and the stores sign every release. The free edition's code is public; Kamelo Business ships its code unminified, so your security team can review it. Problems can be reported privately on GitHub or to hello@kamelo.eu.

What Kamelo asks for, and why

storage · alarms

Settings, the licence and the local vault. Every 12 hours, old vault entries are deleted.

scripting

Starts Kamelo in tabs already open after installing or updating. No remote code.

sidePanel

Opens Melo, Kamelo’s private chat, beside the page.

Access to all websites

AI fields are on many sites, such as Gmail, Slack and Notion. Nothing is collected.

Don't take our word for it

Read the code

The free edition on GitHub, AGPL-3.0. Kamelo Business ships unminified.

Watch the network

In developer tools: Kamelo sends nothing.

Installed by your IT

From a private Chrome Web Store listing, set up with your policy. No account, ever.

Planning a rollout? Let’s talk

Kamelo Business is open for a pilot. We set it up together with your IT team, and we're happy to answer your security questions.

Start a pilot Security overview (PDF) Report a security issue

Last updated 12 October 2026