EPIQ Vault lets people whose company uses EPIQ Hub reach the company's password vault from the browser: find a sign-in for the site they are on, fill it in, copy a password or a 2FA code, and save a new sign-in to the vault. This page explains what the extension stores, what it sends and to whom. The extension is provided by ADWConnect Ltd.

Who receives your data

The extension talks only to the EPIQ Hub address you sign in on (for example app.epiqhub.com or your provider's own address). Nothing is sent to us as the extension's publisher, to advertisers, to analytics services or to any other third party. We do not sell data and do not use it for anything other than running the vault for you.

What the extension sends to your EPIQ Hub

• Sign-in. You sign in on your EPIQ Hub's own page (OAuth 2 with PKCE). The extension never sees your hub password.
• The site you are on. To find matching sign-ins, the extension sends the domain name of the open tab (for example example.com, never the full address or page contents) to your hub. It only does this on https pages.
• Vault actions. When you reveal or copy a password or 2FA code, save or change a record, or star one, that request goes to your hub, which checks your permissions and records it in the vault's audit log, the same as in the web vault. If your company asks for a reason before a reveal, the reason you type is sent too.

What stays in your browser

• Your accounts: the hub address, your name, email, company and the sign-in tokens, in the browser's extension storage.
• A list of your records so the popup opens quickly: titles, usernames, website addresses, folders and tags. Passwords, notes and 2FA secrets are not kept: they are fetched from your hub each time you reveal one and held in memory only.
• Your settings (theme, auto lock time and similar).

Locking the extension (by hand or after the idle time you set) and signing out remove the tokens and the saved records from the browser. Passwords and 2FA codes you copy are cleared from the clipboard after 30 seconds.

Permissions it asks for, and why

• Read the site you are on (content script on https pages): to show matching sign-ins and fill the sign-in form when you ask. It reads the sign-in fields only, and only on the top-level page.
• Tabs and active tab: to know which site the open tab is, so the right sign-ins are listed.
• Identity: to open your hub's sign-in page.
• Your hub's address: to talk to it. For a hub other than app.epiqhub.com the browser asks you once when you sign in there.
• Storage, alarms and idle: to keep your accounts and settings, refresh sign-ins and lock after the idle time.
• Clipboard and offscreen document: to copy a password or code and clear it again after 30 seconds.
• Notifications, context menu and side panel: update notices, the right-click "search the vault" option and the side panel view.

Keeping your data and deleting it

Your vault records live in your company's EPIQ Hub, under its own retention and privacy terms; ask your company's administrator about them. To remove everything the extension keeps in this browser, sign out of each account or remove the extension.

Security

All traffic goes over https. Vault secrets are encrypted at rest in EPIQ Hub and only leave it when you reveal them, after the hub's checks. The extension does not run on plain http pages or inside embedded frames.

Children

The extension is a business tool for staff of companies that use EPIQ Hub and is not meant for children.

Changes and contact

If what the extension collects changes, this page will be updated first, with a new date at the top. Questions: contact ADWConnect Ltd through your EPIQ Hub, or see the main privacy policy.