Company Repository Setup
Deploy your organisation's internal phrase library to all employees — without uploading sensitive phrases to any external server. Your data stays on your infrastructure.
How it works
A simple JSON array on your intranet, SharePoint, S3, or any HTTPS endpoint you control. unmask.tools never sees or stores the contents.
Paste the URL into the Company Repository section of the extension popup, or deploy it silently via Chrome Enterprise Policy / MDM — zero friction for employees.
On startup the extension fetches the latest phrases from your URL and caches them on-device. Detections happen entirely in the browser. Phrases auto-refresh every 24 hours.
Detections from your repository are visually distinct and are never submitted to the global dataset or the public detection report — regardless of the employee's sharing settings.
JSON file format
Your file must be a JSON array. Each object requires at minimum a phrase field.
[
{
"phrase": "collateral damage",
"translation": "civilian casualties",
"severity": "critical",
"legalRef": "IHL Art. 51(5)(b)",
"sourceLanguage": "en",
"category": "Military operations"
},
{
"phrase": "surgical strike",
"translation": "targeted attack on a specific location",
"severity": "high"
},
{
"phrase": "internal restructuring",
"severity": "medium"
}
]
Field reference
| Field | Required | Description |
|---|---|---|
phrase | Yes | The phrase to detect. Max 200 characters. |
severity | No | critical, high, or medium. Defaults to medium. |
translation | No | Plain-language explanation shown in tooltip. Max 500 characters. |
legalRef | No | Legal or policy reference shown in tooltip. Max 200 characters. |
sourceLanguage | No | ISO 639-1 language code (e.g. en, de). Defaults to en. |
category | No | Internal grouping label. Max 100 characters. |
Hosting options
The file must be served over HTTPS with a CORS header that allows the extension to read it: Access-Control-Allow-Origin: *
Upload the file and use the direct download link. Works without additional CORS setup for Microsoft 365 tenants.
Set the CORS policy on your bucket/container to allow GET from any origin. Use a private bucket with a pre-signed URL for added security.
Any nginx or Apache instance on your intranet. Add add_header Access-Control-Allow-Origin *; to the location block.
Host the file in a public repo and use the raw.githubusercontent.com URL. Simple, no CORS config needed.
Silent deployment via MDM (recommended for enterprises)
Use Chrome Enterprise Policy to push the repository URL and API key to all managed devices — employees see a pre-configured extension with no setup steps.
Google Workspace / Chrome Browser Cloud Management
In the Admin Console → Devices → Chrome → Apps & Extensions → select the unmask.shield extension → Policy for extensions, add:
{
"unmask_company_repo_url": {
"Value": "https://your-company.com/unmask-phrases.json"
},
"unmask_api_key": {
"Value": "your_team_api_key_here"
}
}
Microsoft Intune / Endpoint Manager
Create a Chrome Configuration Profile with the extension policy JSON above. Deploy to the target security group.
Jamf Pro (macOS)
Use a Configuration Profile with a Chrome Extension Settings payload. Set the managed storage keys as above.
Data security summary
| Data | Leaves the device? | Reaches unmask.tools? |
|---|---|---|
| Company phrase list | Never | Never — fetched directly from your server, not via ours |
| Company phrase detections | Never | Blocked at source — isLocal filter prevents submission |
| Page text (AI detection) | Only if AI detection is on | Excerpt sent to ldm-analyze for scoring — not stored |
| Page text (Ollama) | Never | Processed locally by your Ollama instance |
| API key usage count | Yes | Yes — used to enforce tier limits |
For full details see the Privacy Policy. For security officer review requests, contact hello@unmask.tools.