Does FrontTailor send data to CloudDNA?

No. FrontTailor works locally in the browser, without telemetry and without an account. The exceptions are the AI assistant and the ticket handover – after a preview and a click they go directly to the service you configured, never to CloudDNA.

Why does Chrome warn about access to all websites during installation?

A small script checks on every page whether there is SAP UI5. It reads no content and sends nothing. FrontTailor gets access to an app only after you grant its domain.

Does FrontTailor have the debugger permission?

No. Only the separate extension FrontTailor Profiler Companion has it, for the CPU deep profile. Everything else works without the companion.

Does FrontTailor store passwords or tokens?

No. The only exception is your own AI key, and only if you let it be stored on the device – encrypted, never synced.

Permissions and privacy

FrontTailor works locally in the browser. There is no telemetry, no analytics, no advertising and no account, and nothing goes to CloudDNA. Data leaves the browser only when you trigger it – after a preview and a click.

Telemetry: none
Host access: only after a grant per domain
Data to CloudDNA: none
Remote code: none

Permissions

Every permission in the manifest has a purpose, and every new one needs a documented architecture decision.

Permission	Kind	What for
`storage`	required	Store settings and profiles locally, read the policy
`scripting`	required	Inject the page script into granted UI5 pages
`activeTab`	required	Screenshot for “Report a problem”, only after your action
`sidePanel`	required	The side panel next to the app
`webRequest`	required	Observe OData requests and failed requests of granted apps
`alarms`	required	Scheduled fetch of enforced team packages, morning check reminder
`declarativeNetRequestWithHostAccess`	required	UI5 version override and local code; acts only on granted domains and only once you switch it on
`browsingData`	optional	Clear the browser cache; the browser asks on the first cache reset
Host access `https:///`, `http:///`	optional	Access to an app only after you grant its domain

FrontTailor does not have debugger. Only the separate extension FrontTailor Profiler Companion holds it, for the performance profiler’s CPU deep profile; it has no access to web pages, acts only when you start it and never starts on PROD systems.

Host access and the install warning

During installation Chrome warns: “Read and change all your data on all websites”. The reason is a small script that only checks on every page whether there are SAP UI5 markers – for at most 10 seconds. It reads no content, sends no data and changes nothing; on pages without UI5 it does not even open a connection.

FrontTailor gets access to a UI5 app only after you click Activate in the popup and confirm the browser dialog (grant).
You can revoke grants at any time under chrome://extensions or edge://extensions.
Your company can restrict the allowed hosts by policy (allowedHosts, Enterprise deployment).

What stays local

Data	Where	How long
Address, UI5 version and connection status of the tab	`chrome.storage.session`	until the browser closes
Session errors (UI5 log, failed requests – only scheme, host and path, without parameters)	`chrome.storage.session`	until the page reloads or the browser closes
Host profiles, theme, language and the modules’ settings	`chrome.storage.local`	until you delete them or remove the extension
Licence key and – if you choose – your own AI key (encrypted)	`chrome.storage.local`, never in sync	until you remove them

FrontTailor does not store credentials, tokens or session cookies. The only exception is your own AI key, and only if you choose Save on this device; your company can switch that off.

When data leaves the browser

Only in these cases, and always only after your click:

Feature	Where to	What
AI assistant from Pro	directly to the provider you configured	exactly what the preview shows, masked first
Ticket from “Report a problem” from Pro	to the ticket system you or your company set up	the report from the preview, masked
Fetching a team package from Team	to your team’s server	only a `GET` of the package file
Backend service from Enterprise	to the page’s SAP system	read-only requests, only after you switch it on per host
Checks such as the deployment check or system compare	to the same server the app comes from	fetching `manifest.json`, `$metadata` and similar files of the app

CloudDNA receives nothing in any of these cases. The interface fonts ship with the extension; extension pages load nothing from third parties.

Masking personal data

Before a report or an AI request leaves the browser, FrontTailor replaces e-mail addresses, phone numbers, IBANs, long digit sequences, your own names and patterns with placeholders such as [EMAIL]. Your company can make rules mandatory (issueReporter.mandatoryRules, aiRequirePiiMasking). The masking does not detect every kind of personal data – check the preview.

No remote code

All code is inside the package, without obfuscation. FrontTailor loads no scripts at runtime and uses no eval; a check script verifies this on every build. Team packages are settings, not code.

Permissions and privacy

Permissions

Host access and the install warning

What stays local

When data leaves the browser

Masking personal data

No remote code

See also

Sources on this page

Short answers.

Ten tabs too many? Talk to us.