Security & Trust

Built so your ServiceNow data never has to leave your control.

Marlow is a Chrome side-panel assistant for ServiceNow. This page is written for the security team that has to approve it. Every statement below describes how the shipped product behaves today; where something is planned rather than shipped, it is marked roadmap.

Last updated: 2026-10-14 · Extension 2.24.1 · Questions: security@instancegenie.ai

Summary for reviewers

Marlow talks to ServiceNow from the user's own browser, as the user. Every read and write uses the user's existing ServiceNow session and is subject to their ACLs. InstanceGenie's servers do not hold ServiceNow credentials and do not proxy ServiceNow traffic.
Our backend is an AI-provider proxy and a policy plane, not a data store. It relays prompts to the model provider your organization chose and enforces org policy. It stores usage metrics, policy, and audit entries — not conversation content. Conversations live in the user's browser profile.
You choose the AI model and the key. Bring your organization's own provider key (Anthropic, OpenAI, Azure OpenAI, Google, OpenRouter, Vercel AI Gateway, or a compatible gateway you host). Keys are encrypted at rest with AES-256-GCM and never returned to any client.
The extension asks for the minimum. Powerful Chrome permissions (desktopCapture, downloads, notifications) are optional and requested only at the moment a user invokes the feature, with an explanation first. The one permission Chrome will not allow to be optional, debugger, is not in the standard build at all — it ships only in a separately-labelled Developer Edition for the few users who need Browser Test Mode.
The AI cannot act unsupervised. Every write is shown to the user and confirmed; Production instances get an extra guard your admins can enforce; an optional second-model reviewer can be required before any change; writes are attributed and undoable.

Architecture & data flow

There are three parties: the extension in the user's Chrome, your ServiceNow instance(s), and the InstanceGenie backend (Cloudflare Workers, D1, KV, Vectorize, Workers AI). The model provider is a fourth, chosen by you.

Flow	From → To	What travels	Notes
Reading / writing records	Extension → your ServiceNow	Table/Attachment API calls	Uses the signed-in browser session (`X-UserToken`). Never leaves the browser–instance path. ACLs apply.
Asking the model	Extension → InstanceGenie → model provider	Prompt, tool results the user's session returned, tool schemas	Relayed in transit; not persisted by InstanceGenie. Provider is your choice; see sub-processors.
Usage accounting	InstanceGenie (internal)	Tenant, user, model, token counts, tool names, cost	Drives budgets and the admin dashboard. No prompt text.
Outcome telemetry	Extension → InstanceGenie	Outcome class, duration, tool names, record identifiers touched	No field values. Lets admins see what Marlow achieved.
Episodic memory (opt-in)	Extension → InstanceGenie	A validated summary of a conversation	Summarised on Workers AI, embedded in Vectorize, private to the user, instance-scoped, 30/60/90-day retention. Org can disable; users can view and delete their own.
Gap / bug reports	Extension → InstanceGenie → GitHub (private)	User-written report, redacted	sys_ids, record numbers, emails and hostnames are stripped before storage.
Conversations	Stays in the browser	—	`chrome.storage.local` + IndexedDB in the user's profile. Deleted by the user; never uploaded.
Shared files	Browser → your ServiceNow (upload); Browser → model (if shown)	Original file; a downscaled/partial copy to the model only when the user shares it in chat	Kept in the browser for the conversation (7-day cap). InstanceGenie never stores the file.

What we store — and what we don't

Stored on InstanceGenie

Account: email, display name, Google OAuth subject, role, tenant
Org policy: model locks, memory/judge/persona/sub-agent policy, Production guard, budgets, allowed hosts, branding
Encrypted AI-provider keys (org and, if allowed, per-user)
Usage events (tokens, model, tool names, cost) and outcome events (class, identifiers, durations)
Episodic-memory summaries (only if enabled)
Audit log of admin actions
Redacted gap reports and their resolution status
Org skills / quick actions your admins publish

Never stored on InstanceGenie

Conversation transcripts or prompts
ServiceNow record contents returned by tools
ServiceNow credentials or session tokens
Files the user shares or attaches
Screenshots
Provider keys in plaintext (they are never returned to any client after save)

Chrome permissions, one by one

Install-time permissions are the minimum Marlow needs to exist as a side panel on ServiceNow tabs. Host access is limited to *.service-now.com, *.servicenow.com, instancegenie.ai, and GitHub (read-only: your organization's published skills, ServiceNow's public product-documentation mirror, and ServiceNow's SDK documentation site servicenow.github.io; no instance data is sent to any of them). Three powerful permissions are optional: not granted at install, requested in a user gesture when the feature is used, explained in plain language first, and revocable in Marlow Settings → Permissions or chrome://extensions. debugger cannot be optional in Chrome, so it is excluded from the standard build entirely and offered only in a Developer Edition (same code, one extra install-time permission, distinct extension name).

Permission	Type	Used for	What it cannot do
`sidePanel`	install	Render Marlow as a Chrome side panel	—
`storage`, `unlimitedStorage`	install	Keep settings and conversations in the local browser profile	No sync to Google; no access to other extensions' data
`activeTab`, `tabs`, `scripting`	install	Detect the ServiceNow tab, read page context (table/sys_id/form), run the content script on ServiceNow hosts only	Content scripts are declared for ServiceNow hosts only; no injection into other sites
`identity`	install	Google sign-in to InstanceGenie via `launchWebAuthFlow`	No access to the user's Google data beyond email/profile
`alarms`, `contextMenus`	install	User-created scheduled jobs; right-click "Ask Marlow"	Jobs run only while Chrome is open; nothing server-side
`debugger`	Developer Edition only	Browser Test Mode: drive the active ServiceNow tab (click/type/inspect) during a user-started test. Absent from the standard build.	Only the tab the user starts the test on; Chrome shows a persistent banner while attached; detaches at session end. Standard-build users who invoke it get a clear "install Developer Edition" message.
`desktopCapture`	optional	Chrome's native screen-share picker for a single screenshot	No recording; nothing captured until the user picks; one frame
`downloads`	optional	Save exports via Chrome's download manager	Falls back to an in-page download link if not granted
`notifications`	optional	OS notification when a scheduled job completes	Silently skipped if not granted

Enterprise Chrome policy: Marlow can be force-installed or allowlisted by extension ID with the base permission set; the optional set can be left to users or blocked by policy without breaking core functionality. Organizations that do not want debugger anywhere simply do not distribute the Developer Edition. No remote code: all JavaScript ships inside the extension package (pdf.js is vendored, pinned, and loaded from the extension's own origin).

ServiceNow access

Session-based. Marlow uses the user's logged-in ServiceNow session and the page's g_ck user token. It has exactly the rights that user has, no more. It does not use an integration user, does not require a ServiceNow plugin, and does not install anything on the instance.
Every write is confirmed. Creates, updates, approvals, script execution, update-set changes and bulk operations show a confirmation dialog with the exact payload (and a before→after diff for updates) before anything is sent.
Production guard. Instances classified as Production get an additional, explicit warning on every write. Org admins can enforce this so users cannot turn it off.
Per-instance write permissions. Users (and org policy) can restrict which write capabilities Marlow may use on each connected instance.
Attribution and undo. Writes made through Marlow are logged locally with before-state; update_record changes can be reverted from the chat.
Allowed hosts. Org admins can restrict which ServiceNow hostnames Marlow will operate on.
in transition A legacy cross-instance relay path can use Basic auth with a username/password the user entered in Settings; that secret lives in the browser profile. It is being replaced by session-only relay; see roadmap.

Keys & encryption

AI-provider keys (org and per-user) are encrypted at rest with AES-256-GCM under a key-encryption key held as a Cloudflare Worker secret, never in code or the database. Decryption is authenticated: a wrong or rotated KEK fails loudly rather than returning garbage.
Keys are write-only from every client: after save, the UI shows only a masked suffix. They are decrypted in the Worker solely to make the provider call.
All traffic is TLS 1.2+; HSTS is enabled on instancegenie.ai. Cloudflare terminates TLS and the Worker runs in Cloudflare's isolate sandbox.
Data at rest (D1, KV, Vectorize) is encrypted by Cloudflare. Secrets are rotated per the runbook in our repository (SECURITY.md).

Tenant isolation & roles

Every table row is scoped by tenant_id; every API route runs behind session middleware that binds the request to one tenant. There are no cross-tenant queries.
Roles: owner, admin, member. Policy and key management are owner/admin only. Admin actions are written to an audit log.
Sign-in is Google OAuth today. roadmap SAML/OIDC SSO and SCIM provisioning for Enterprise.
Org-wide locks let admins pin the model, require a Production guard, lock the write-reviewer mode, disable memory or sub-agents, and lock persona — users cannot override a lock.
Budgets: monthly org and per-user AI spend limits with warn/stop thresholds enforced server-side.

AI safety controls

Marlow is an agent: the model chooses tools. The controls below bound what that can do.

Risk	Control
Model makes a wrong or unintended change	Human confirmation on every write; before→after diff; Production guard; undo. Optional second-model reviewer ("judge") compares the request, current record and proposed write and returns approve / revise / reject — can be required org-wide.
Prompt injection via record data, scripts, web pages or skills	Instance data and web content are presented to the model as data, labelled untrusted; skills containing exfiltration or "ignore instructions" patterns are refused; the reviewer and worker prompts carry explicit injection guards; the reviewer's output is a fixed enum and cannot instruct Marlow.
Autonomous sub-agents over-reach	Workers are read-only unless the org enables writes and the parent grants specific tools; the server intersects every worker tool list with policy; workers cannot delegate, cannot ask the user, and have step/time budgets.
Reviewer or worker widens its own powers	Tool allowlists are enforced server-side per hop; the client refuses out-of-list tools too.
Data exfiltration to the web	Web research is off until an admin enables it; outbound queries are scrubbed of sys_ids, record numbers, emails and hostnames; Marlow refuses to fetch your own instance over the public web and refuses internal/loopback addresses.
Runaway cost	Org/user budgets, rate limits, context compaction, worker step caps.
Hallucinated capability	The tool loader reports unknown tools as unknown rather than "loaded"; tool schemas and executors are audited for parity in CI.

Model providers

Prompts go to the provider you configure. InstanceGenie does not train on your data and does not retain prompts. Each provider's own retention terms apply to the data they receive; many offer zero-data-retention for API traffic, and Marlow honours ZDR flags where a gateway exposes them. Two platform-side functions — conversation-memory summarisation and context compaction — run first on Cloudflare Workers AI (Llama, in Cloudflare's network) and fall back to your provider only if that is unavailable. Full list with regions and ZDR status: sub-processors.

Operations & supply chain

Hosting: Cloudflare Workers (edge isolates), D1, KV, Vectorize, Workers AI. No servers we patch; no containers.
Dependencies: the backend has a single runtime dependency (hono). The extension vendors pdf.js (Apache-2.0), pinned. CI runs npm audit at high severity and publishes a CycloneDX SBOM with every build.
Testing: 38 automated suites run on every change, executing the real code paths (tool selection, policy enforcement, write gates, reviewer, attachments, memory). A tool-drift audit fails the build if a tool is advertised without an executor or vice-versa.
Release process: every change goes through a pull request, CI, and a versioned release note that ships inside the extension.
Logging: Worker logs exclude prompt bodies. Admin actions go to the tenant audit log.
Extension distribution: packaged builds are served from instancegenie.ai with a manifest users can verify; roadmap Chrome Web Store listing for policy-based force-install.

Compliance roadmap

Item	Status
Public security, privacy and sub-processor pages; `security.txt`	shipped
Optional Chrome permissions requested at point of use	shipped
Dependency audit + SBOM in CI	shipped
Retire Basic-auth cross-instance relay (session-only)	in progress
Audit-log export (CSV / SIEM webhook)	roadmap
SAML / OIDC SSO, SCIM	roadmap — Enterprise
Third-party penetration test	roadmap
SOC 2 Type I	roadmap
Completed SIG-Lite / CAIQ questionnaire on request	available — email security@

Vulnerability disclosure

If you believe you have found a security issue, email security@instancegenie.ai. We acknowledge reports within 2 business days and aim to resolve confirmed critical issues within 7 days. Please do not test against other customers' tenants. Our machine-readable policy is at /.well-known/security.txt.