Security
How are API keys, code, and prompts handled?
Short answer: the extension sends a request through the GS Copilot Worker to the AI provider you select. BYOK credentials can pass through that Worker request path; they are not described as bypassing GS Copilot infrastructure.
Last reviewed 2026-07-20
Verified request path
Browser extension→GS Copilot Worker→Selected AI provider
The browser extension collects only the request context needed for the feature you invoke. The Worker routes that request to the selected provider. The provider’s own terms and retention settings apply to provider-side processing.
Data handling at a glance
| Data | Processor | Retention | Your control |
|---|---|---|---|
| BYOK API key | Extension and Worker request path | Used to authenticate the configured provider request; do not treat this as a no-contact path. | Remove or replace the key in extension settings. |
| Project code and prompts | Extension, Worker, and selected provider | Processed for the requested response; provider retention is governed by that provider. | Choose the provider, avoid sending secrets, and delete project context where the extension provides that control. |
| Account and billing data | GS Copilot service providers | Retained as needed for account operation, billing, support, and legal obligations. | Use account controls or contact support. |
For terms governing the service, see the Privacy Policy. This page is a product-data-flow explanation, not a substitute for legal terms.