Alexandria is built with security and privacy at its core. The extension automatically blocks itself on 200+ sensitive sites including banking, password managers, healthcare portals, and login pages before any data is accessed. All communication uses TLS encryption, content is processed transiently (never stored), and enterprise authentication protects your account with optional 2FA.
What We're Doing to Protect You
How Alexandria Protects Your Sensitive Data
Unlike most text-to-speech extensions that run everywhere by default, Alexandria takes a security-first approach. The extension proactively blocks itself on sensitive websites to prevent any possibility of accessing your private information.
This protection happens automatically, before any content is extracted or processed. When you visit a blocked site, Alexandria won't initialize-no widget appears, no text is extracted, and no API calls are made.
Key Facts
86% of the top 100 Chrome extensions request high-risk permissions on installation [LayerX Enterprise Browser Extension Security Report, 2025].
Over 5.8 million users were directly affected by documented malicious Chrome extensions in 2024-2025 [TechRadar, 2025].
A December 2024 supply chain attack compromised 35+ Chrome extensions, affecting 2.6 million users [Dark Reading, 2024].
95% of global web traffic is encrypted using HTTPS as of 2025, up from under 50% a decade ago [comparecheapssl.com, 2025].
The average cost of a data breach reached $4.44 million globally in 2025 [IBM Cost of Data Breach Report, 2025].
Security Features You Get Automatically
200+ Sensitive Sites Blocked
Alexandria maintains a comprehensive blocklist of 200+ site patterns covering password managers (1Password, LastPass, Bitwarden, etc.), banking sites, healthcare portals, tax preparation services, HR/payroll systems, legal research platforms, cryptocurrency exchanges, and all login/account pages. This list is updated regularly.
Zero Long-Term Data Storage
Your content is processed transiently for text-to-speech conversion and immediately discarded. We don't build a database of what you've read or listened to. The only data we retain is anonymous usage analytics (which pages you used the extension on, not the content itself).
TLS Encryption Everywhere
All communication between the extension and our servers uses TLS encryption (HTTPS). Your text is encrypted in transit, protecting against man-in-the-middle attacks and eavesdropping. Encryption can reduce breach-related costs by up to $2.5 million when paired with modern security practices [IBM, 2025].
Enterprise-Grade Authentication
Alexandria uses Clerk for authentication-the same enterprise platform trusted by thousands of companies. Clerk supports Google Sign-In, Microsoft accounts, passwordless email magic links, and optional two-factor authentication (2FA) for enhanced security.
Manifest V3 Architecture
Alexandria is built on Chrome's latest Manifest V3 standard, which provides stronger security controls than older extensions. Manifest V3 includes stricter permission requirements, enhanced privacy protections, and isolated execution contexts that prevent malicious code injection. As of August 2025, 73.4% of Chrome extensions had migrated to Manifest V3 [arXiv, 2025].
Row-Level Security (Database)
Your data in our database is protected with Row-Level Security (RLS) policies. This means even if there's a vulnerability in the application code, the database itself prevents unauthorized access to your data. Your sources, notebooks, and highlights are isolated at the database level.
Content Security Policy
The extension enforces a strict Content Security Policy (CSP) that restricts which scripts can execute. This prevents unauthorized code from running and reduces the risk of XSS (cross-site scripting) attacks.
Privacy-First Analytics
Alexandria uses PostHog for analytics, hosted in the EU region for GDPR compliance. We collect pseudonymous usage data (which features you use, not what content you read). Session recording is permanently disabled. We never track your browsing history outside of Alexandria usage. GDPR enforcement resulted in €1.2 billion in fines during 2024 alone, with cumulative penalties reaching €5.88 billion since the regulation took effect [GDPR Register, 2025].
Minimal Permissions
Alexandria only requests the permissions necessary to function: page content access (to read text aloud), storage (to save your preferences), and cookies (for authentication). We don't request clipboard access, browsing history, or other invasive permissions.
Secure Message Passing
Communication between extension components uses Chrome's secure messaging API, which provides isolated contexts and prevents direct DOM manipulation from untrusted code. This architecture reduces the risk of code injection attacks.
What Makes Alexandria Different from Other Extensions
Most text-to-speech extensions activate everywhere by default and rely on users to manually disable them on sensitive sites. This puts the burden on you to remember which sites are risky.
Alexandria reverses this model: we block sensitive sites by default. You get protection automatically, without having to think about it.
Proactive Protection
Alexandria checks every URL against 200+ blocking patterns before initialization. If you navigate to accounts.google.com or vault.bitwarden.com, the extension won't activate-no widget, no content extraction, no data transmission. This happens in under 10ms with zero performance impact.
Pattern-Based Detection
Instead of maintaining a static list of URLs, Alexandria uses intelligent pattern matching. For example, the pattern /^https?:\/\/accounts\./ blocks all accounts.* subdomains across any service (accounts.google.com, accounts.microsoft.com, accounts.github.com, etc.). This provides comprehensive coverage even for new services we haven't specifically listed.
User-Reported Improvements
If Alexandria blocks a site incorrectly (false positive) or misses a sensitive site that should be blocked, you can report it via our feedback page. We review reports regularly and update the blocklist accordingly. Your feedback makes the extension safer for everyone.
Automatic Site Blocking
Alexandria will never activate on the following types of sensitive pages. This protection happens automatically before any content is extracted or processed.
Account & Authentication Pages
- Login and sign-in pages (accounts.*, login.*, signin.*, auth.*, sso.*)
- Google, Microsoft, Yahoo, Facebook, Apple ID login pages
- Single Sign-On (SSO) portals
- Two-factor authentication pages
- Password reset and account recovery pages
Password Managers
- 1Password, LastPass, Bitwarden, Dashlane
- NordPass, Keeper, RoboForm, Zoho Vault
- Proton Pass, Enpass
- Any vault.* subdomain or /vault path
Financial Services
- Banking: All sites matching banking patterns and domains
- Payment Processors: PayPal, Stripe, Venmo
- Investment Accounts: Fidelity, Schwab, E*TRADE, TD Ameritrade, Vanguard, Robinhood
- Cryptocurrency: Coinbase, Binance, Kraken, Gemini, Crypto.com
- Payment Authentication: 3D Secure verification, Cardinal Commerce, Visa/Mastercard secure checkout
Healthcare & Medical
- Patient portals (HIPAA-protected health information)
- MyChart, FollowMyHealth, HealthVault
- Insurance portals: UnitedHealthcare, Anthem, Blue Cross Blue Shield, Aetna, Cigna, Humana
Tax & Financial Documents
- Tax preparation sites: TurboTax, H&R Block, TaxAct, FreeTaxUSA, TaxSlayer
- IRS.gov and all government tax portals
- Tax filing and financial document sites
HR & Payroll Systems
- ADP, Workday, Paychex, Paylocity
- Paycom, UltiPro/UKG, BambooHR
- Employee portals containing salary, benefits, and tax information
Legal & Court Systems
- Legal research platforms: LexisNexis, Westlaw, Bloomberg Law
- Court filing systems: PACER, US Courts domains
- Confidential legal documents and case management systems
Government & Secure Sites
- All .gov and .mil domains
- Government portals and services
- Browser internal pages (chrome://, edge://, about:)
- Extension stores and management pages
Analytics & Tag Management
- Google Tag Manager
- Google Analytics
- Google Marketing Platform
How Protection Works
When you visit a protected site:
- Instant Detection: Alexandria checks the URL before any initialization (less than 10ms overhead)
- Complete Blocking: No content extraction, no text processing, no API calls
- Clear Communication: Extension popup shows "Protected" status with explanation
- User Feedback: Easy reporting if you believe a site is incorrectly blocked via support@alexandria.live
How Alexandria Protects Your Sensitive Data
Unlike most text-to-speech extensions that run everywhere by default, Alexandria takes a security-first approach. The extension proactively blocks itself on sensitive websites to prevent any possibility of accessing your private information.
This protection happens automatically, before any content is extracted or processed. When you visit a blocked site, Alexandria won't initialize-no widget appears, no text is extracted, and no API calls are made.
Key Facts
86% of the top 100 Chrome extensions request high-risk permissions on installation [LayerX Enterprise Browser Extension Security Report, 2025].
Over 5.8 million users were directly affected by documented malicious Chrome extensions in 2024-2025 [TechRadar, 2025].
A December 2024 supply chain attack compromised 35+ Chrome extensions, affecting 2.6 million users [Dark Reading, 2024].
95% of global web traffic is encrypted using HTTPS as of 2025, up from under 50% a decade ago [comparecheapssl.com, 2025].
The average cost of a data breach reached $4.44 million globally in 2025 [IBM Cost of Data Breach Report, 2025].
Security Features You Get Automatically
200+ Sensitive Sites Blocked
Alexandria maintains a comprehensive blocklist of 200+ site patterns covering password managers (1Password, LastPass, Bitwarden, etc.), banking sites, healthcare portals, tax preparation services, HR/payroll systems, legal research platforms, cryptocurrency exchanges, and all login/account pages. This list is updated regularly.
Zero Long-Term Data Storage
Your content is processed transiently for text-to-speech conversion and immediately discarded. We don't build a database of what you've read or listened to. The only data we retain is anonymous usage analytics (which pages you used the extension on, not the content itself).
TLS Encryption Everywhere
All communication between the extension and our servers uses TLS encryption (HTTPS). Your text is encrypted in transit, protecting against man-in-the-middle attacks and eavesdropping. Encryption can reduce breach-related costs by up to $2.5 million when paired with modern security practices [IBM, 2025].
Enterprise-Grade Authentication
Alexandria uses Clerk for authentication-the same enterprise platform trusted by thousands of companies. Clerk supports Google Sign-In, Microsoft accounts, passwordless email magic links, and optional two-factor authentication (2FA) for enhanced security.
Manifest V3 Architecture
Alexandria is built on Chrome's latest Manifest V3 standard, which provides stronger security controls than older extensions. Manifest V3 includes stricter permission requirements, enhanced privacy protections, and isolated execution contexts that prevent malicious code injection. As of August 2025, 73.4% of Chrome extensions had migrated to Manifest V3 [arXiv, 2025].
Row-Level Security (Database)
Your data in our database is protected with Row-Level Security (RLS) policies. This means even if there's a vulnerability in the application code, the database itself prevents unauthorized access to your data. Your sources, notebooks, and highlights are isolated at the database level.
Content Security Policy
The extension enforces a strict Content Security Policy (CSP) that restricts which scripts can execute. This prevents unauthorized code from running and reduces the risk of XSS (cross-site scripting) attacks.
Privacy-First Analytics
Alexandria uses PostHog for analytics, hosted in the EU region for GDPR compliance. We collect pseudonymous usage data (which features you use, not what content you read). Session recording is permanently disabled. We never track your browsing history outside of Alexandria usage. GDPR enforcement resulted in €1.2 billion in fines during 2024 alone, with cumulative penalties reaching €5.88 billion since the regulation took effect [GDPR Register, 2025].
Minimal Permissions
Alexandria only requests the permissions necessary to function: page content access (to read text aloud), storage (to save your preferences), and cookies (for authentication). We don't request clipboard access, browsing history, or other invasive permissions.
Secure Message Passing
Communication between extension components uses Chrome's secure messaging API, which provides isolated contexts and prevents direct DOM manipulation from untrusted code. This architecture reduces the risk of code injection attacks.
What Makes Alexandria Different from Other Extensions
Most text-to-speech extensions activate everywhere by default and rely on users to manually disable them on sensitive sites. This puts the burden on you to remember which sites are risky.
Alexandria reverses this model: we block sensitive sites by default. You get protection automatically, without having to think about it.
Proactive Protection
Alexandria checks every URL against 200+ blocking patterns before initialization. If you navigate to accounts.google.com or vault.bitwarden.com, the extension won't activate-no widget, no content extraction, no data transmission. This happens in under 10ms with zero performance impact.
Pattern-Based Detection
Instead of maintaining a static list of URLs, Alexandria uses intelligent pattern matching. For example, the pattern /^https?:\/\/accounts\./ blocks all accounts.* subdomains across any service (accounts.google.com, accounts.microsoft.com, accounts.github.com, etc.). This provides comprehensive coverage even for new services we haven't specifically listed.
User-Reported Improvements
If Alexandria blocks a site incorrectly (false positive) or misses a sensitive site that should be blocked, you can report it via our feedback page. We review reports regularly and update the blocklist accordingly. Your feedback makes the extension safer for everyone.
How to Evaluate Text-to-Speech Extension Security
Use this checklist to assess whether any TTS extension is safe to use. Alexandria implements all 7 security measures.
Check Site Blocking Policy
A secure TTS extension should block sensitive sites automatically. Check if it blocks password managers, banking sites, healthcare portals, and login pages by default. Alexandria blocks 200+ site patterns including all major password managers, financial services, and authentication pages.
Verify Data Storage Policy
Read the privacy policy to understand what data is stored. Secure extensions process content transiently without long-term retention. Alexandria never stores your content-text is converted to speech in real-time and immediately discarded.
Review Requested Permissions
Check the extension's permissions in Chrome. Red flags include: clipboard access (unless needed for core functionality), browsing history access, downloads permission, or overly broad host permissions. Alexandria requests only content access, storage (preferences), and cookies (authentication).
Check for Manifest V3
Verify the extension uses Manifest V3, Chrome's latest security standard. Manifest V2 extensions are deprecated and have weaker security controls. Alexandria is built on Manifest V3 with stricter permission requirements and enhanced privacy protections.
Verify Encryption
Check if the extension uses HTTPS/TLS for all server communication. Any unencrypted (HTTP) communication is a major security risk. Alexandria uses TLS encryption for all API calls-your data is encrypted in transit.
Review Authentication Method
Secure extensions use enterprise authentication providers (OAuth, SAML, trusted identity platforms) rather than custom-built auth. Alexandria uses Clerk, an enterprise authentication platform with support for 2FA, passwordless login, and security monitoring.
Look for Security Contact
Trustworthy extensions provide a security contact email for responsible disclosure of vulnerabilities. Alexandria maintains security@alexandria.live for security reports and publishes a comprehensive security page documenting our protections.
Security Features Comparison
| Feature | Alexandria | Typical Extension | Why It Matters |
|---|---|---|---|
| Automatic Site Blocking | 200+ patterns | 0-20 patterns | Proactive protection without user configuration |
| Password Manager Blocking | All 10 major password managers | Usually none | Prevents credential theft and vault access |
| Banking Site Protection | Pattern-based (all banking domains) | Manual blocking only | Automatic financial data protection |
| Healthcare Portal Blocking | HIPAA-protected sites blocked | No blocking | Medical privacy compliance |
| Login Page Protection | All accounts.*, login.*, signin.* blocked | Rarely blocked | Prevents access to authentication pages |
| Data Storage | Zero retention (transient processing) | Often stored for caching | Privacy guarantee - can't leak what we don't store |
| Authentication | Clerk enterprise (with 2FA support) | Basic or none | Account security and session management |
| Extension Architecture | Manifest V3 (latest standard) | Often V2 (deprecated) | Modern security controls and privacy protections |
| Content Security Policy | Strict CSP (script-src 'self') | Often permissive | Prevents XSS and code injection attacks |
| Encryption | TLS everywhere (HTTPS only) | Varies | Data protection in transit |
| Database Security | Row-Level Security (RLS) | Application-level only | Defense-in-depth data isolation |
| Analytics Privacy | PostHog EU (GDPR-compliant) | Google Analytics (US) | European data protection standards |
| Security Documentation | Comprehensive public security page | Basic or none | Transparency builds trust |
| Security Contact | security@alexandria.live | Often missing | Responsible vulnerability disclosure |
* Comparison based on publicly available information. Features and pricing may vary.
Technical Security Measures
- Encryption in Transit: All API communications use HTTPS/TLS
- No Data Storage: Text content is processed transiently and not stored long-term
- Minimal Permissions: Extension only requests necessary browser permissions
- Regular Updates: Security patterns are continuously updated to protect against new threats
- Pattern Matching: Both exact URL matching and regex patterns for comprehensive coverage
- Row-Level Security: Database-level data isolation prevents unauthorized access
- Content Security Policy: Strict CSP prevents unauthorized script execution
- UUID Resource IDs: Cryptographically random identifiers prevent enumeration attacks
Manual Activation Sites
Some sites require manual activation for privacy (not blocked, but won't auto-start):
- Social media platforms (Twitter/X, Facebook, Instagram, LinkedIn)
- Development tools (GitHub, GitLab, Stack Overflow)
- Collaboration tools (Slack, Discord, Notion, Figma)
- Web applications (app.*, dashboard.*, console.* subdomains)
On these sites, click the Alexandria extension icon to manually activate when needed.
Frequently Asked Questions
Reporting & Transparency
We believe in transparency and continuous improvement:
- Report Incorrect Blocking: If a site is incorrectly blocked, report it via support@alexandria.live
- Request New Protections: Know a sensitive site we should block? Let us know
- Open Communication: We'll explain our blocking decisions and update this page as protections evolve
- Security Roadmap: Follow our planned security improvements at our story page
Security Contact
Found a security issue? Please report it responsibly:
We aim to respond within 24 hours for critical vulnerabilities.
Our Security Philosophy
We built Alexandria with security baked in from the start. A few principles guide our approach:
- Security should be automatic. Users shouldn't have to remember which sites are risky.
- If we block sensitive sites by default, you're protected even if you forget.
- We publish everything about how we handle security. Transparency matters.
- The strongest data protection is not storing your content in the first place.
- Privacy isn't a feature you turn on. It's how the extension works.
- We protect your data at multiple layers: the browser extension, our application code, and the database itself.
Related Policies
- Privacy Policy - Complete privacy details and data practices
- GDPR Rights - Your European data protection rights
- Cookie Information - What cookies we use and why
- Terms of Service - Terms of use
Contact
Questions about our security practices?
General inquiries: support@alexandria.live
Security reports: security@alexandria.live
Feedback & feature requests: support@alexandria.live