SessionBox has three main components: a server which performs administrative tasks, a data store which holds user data and a client application. The client application handles all requests that are going through a browser tab that is managed by SessionBox. We also provide extensions to all major browsers, that enable our users to use SessionBox with Chrome, Edge, Firefox or Opera as well, by connecting your selected browser to our client application - but our client application also hosts our own solution: SessionBox Workstation.

We decided not to build our own infrastructure, instead we rely on third-party cloud providers, having limitless resources to ensure a rock solid and secure platform. Before we choose a cloud provider we check if their privacy and security guidelines and certifications meet our requirements.

Our servers run on Heroku and they are located in the United States. You can review Heroku's security policy here: https://www.heroku.com/policy/security

Our data store is in Google Cloud and it is located in the United States. You can review Google Cloud's security policy here: https://cloud.google.com/security/

Our client application and extension is running on your computer.

Like other applications, we are logging some non-identifying usage data. This data is handled by Google Analytics, and it doesn't contain any sensitive information and it is anonymous.

If some error happens we create crash logs. We use these crash logs to stabilize our application and proactively fix possible problems. All sensitive data is filtered from these logs at device level and no sensitive data is sent to our servers.

SessionBox supports three types of profiles: local, synced and temporary. Each type is stored at a different place, but all of them are encrypted in a way that only the locally stored keys are able to decrypt them. Local profiles are stored in your browser's indexed db storage. Synced profiles are stored in our data store. Temporary profiles are not persisted at all.

We are storing two kinds of information when you use SessionBox. We are storing metadata for your profiles which contains the following information: your profile's color, icon, launch url, group and some other technical details. In some cases we are also storing your profile's cookies. Your profile cookies are considered as extra sensitive data and handled by extra care, based on a zero-knowledge solution, meaning that no one except you can open the data stored here.

The extra sensitive parts of your profiles are encrypted and decrypted on your device. We never send your cookies or other extra sensitive data to our servers without encryption. The keys required to decrypt your data are available only on your device and never sent to our servers or data stores. We always use open-source cryptographic libraries and standard algorithms (AES-256 for symmetric operations and RSA 2048 bit for asymmetric operations). We never write our own cryptographic code or modify existing libraries. Our components are always communicating through secure connections.

No, they can't. Your profile cookies are encrypted and cannot be decrypted without knowing your secret key. Your secret key resides on your computer and are never sent to us. This is one of the reasons why we cannot help in case you've lost your password and have no access to a previously installed and used client any more. Without your credentials, there is no way to open your data.

To ensure the security of your profiles, create a SessionBox account. Choose a strong password and keep your password in secret. We also suggest to enable two-factor authentication on our Account security page, to have a second line of defense. This ensures that even if your credentials are known by an attacker, your account can still not be accessed.

We are using the same encryption mechanism for local profiles and synced profiles. If you log out from SessionBox, your profiles cannot be decrypted until you log in again, even if someone has direct access to your computer.