Français · English
Privacy Policy
In one paragraph. PasseMots is a zero-knowledge secrets manager: your vault is encrypted and decrypted inside your browser, with a key derived from your master password, which we never receive. The server only holds encrypted data it cannot read, plus the minimum needed to run your account: your email address, your organisation and a few dates. Nothing is sold, nothing is used for advertising, and the extension contains no tracker.
1. Data controller
PasseMots is published and operated by E2PZ, reachable at contact@e2pz.app. Send any request about your data to that address.
2. Data we collect
We collect only the following. This list is exhaustive.
2.1 Account data
| Data | Source | Why |
|---|---|---|
| Email address | You, on sign-up or when accepting an invitation | Identify your account, send you service emails |
| First and last name (optional) | You | Show you under a readable name to other members of your organisation |
| Organisation, role, status | Your administrator | Determine what you can access |
| Last login date, failed login attempts | Generated | Account security, abuse detection |
2.2 Authentication data and keys
Your master password is never sent to us. Your browser derives two distinct values from it locally (Argon2id): an authentication proof, which the server stores hashed again, and an encryption key that never leaves your device. The server therefore holds: that hashed proof, the derivation parameters, your public key, and your private keys already encrypted by your browser. None of these values can recover your master password or read your vault.
2.3 Your vault contents
Credentials, passwords, notes, files and anything you share are stored end-to-end encrypted. The server handles them as opaque blobs: it knows neither their content, nor the names you give them, nor the sites they relate to. It does know unavoidable technical metadata: how many items exist, their type (password, note, file), their size, their creation and modification dates, and which members a share was created for.
2.4 Technical data
- Server logs: timestamp, requested path, response code, and the IP address on security events (for example exceeding a request limit).
- Organisation audit log: who did what and when inside your organisation (creating, editing or deleting an item, sharing, role changes). It is visible to your organisation's administrators.
2.5 Data the extension keeps on your device
This data is never sent to our servers. It stays in your browser's local storage, and uninstalling the extension erases it.
- Session tokens and their expiry, so your password is not requested every time.
- Decryption keys, in volatile memory only: cleared after ten minutes of inactivity and when the browser closes.
- Your PIN envelope if you set one, protected by a device-bound key.
- The list of sites where you declined the save prompt.
- The last email address you typed, to prefill the sign-in field.
- A draft of a form you are filling in, so it is not lost if the window closes.
3. How we use this data
- Provide the service: authenticate you, sync your encrypted vault across your devices, offer to fill a form when you ask for it.
- Communicate: send emails strictly related to the service — invitation to join an organisation, notification that an item was shared with you. No newsletter, no marketing.
- Keep it secure: limit authentication attempts, detect abuse, maintain the audit log intended for your organisation's administrators.
- Ensure continuity: encrypted service backups.
- Comply with the law: answer a legal obligation we are bound by. We could only hand over encrypted data, unreadable to us.
We perform no profiling, no automated decision-making, no advertising, and your data trains no model.
4. Where and how long we store it
- Hosting: in France, on infrastructure we operate. No transfer outside the European Union.
- Account and vault: kept as long as your account exists. On deletion, your items, shares and files are deleted.
- Backups: encrypted, kept for 30 days, then destroyed. A requested deletion therefore disappears from our backups within 30 days at most.
- External share links: deleted on expiry, when their view count is exhausted, or on revocation, with a maximum lifetime of 90 days.
- Technical logs: short rotation, a few days.
- Audit log: kept for your organisation's traceability, deleted with it.
5. Who we share it with
We do not sell, rent or trade any data. We pass data to a third party only in these cases:
| Recipient | Data passed | Reason |
|---|---|---|
| Mailjet (Sinch, France) | Recipient email address and message content | Deliver invitation and share-notification emails. These messages never contain a secret or a key. |
| Members of your organisation | What you explicitly share with them, plus your name and email address | Make internal sharing possible. You decide on every share. |
| The recipient of an external link | The content you chose to share | The link itself carries the decryption key; we cannot read that content. |
| A legally competent authority | Account data, and encrypted data only | A legal order we are bound to comply with. |
The browser extension communicates with no third party. Its only network
destination is https://passemots.e2pz.app, your account's API. It embeds no tracker,
no ad network and no analytics. Our public marketing pages use analytics we host ourselves,
without cookies and without any personal identifier; it covers neither the application nor the
extension.
6. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, object and port your data. In practice:
- Access and correct: your account details are editable from the application.
- Export: the application offers a CSV export of your vault, decrypted in your browser.
- Delete: write to contact@e2pz.app or ask your organisation's administrator. We answer within 30 days.
- Complain: you may contact the French data protection authority, CNIL (cnil.fr).
7. Security
- End-to-end encryption: AES-256-GCM for content, Argon2id for deriving your master password, X25519 for member-to-member sharing.
- TLS only in transit.
- The vault locks automatically after ten minutes of inactivity in the extension.
- Filling a form is never automatic: you trigger it yourself, which protects you against phishing pages.
A direct consequence of zero-knowledge: if you lose your master password, we cannot reset it or recover your vault. That is the price of guaranteeing that nobody but you can read your data.
8. Browser extension: permissions and limited use
storage: keep your session and preferences locally, on your device.- Access to
https://passemots.e2pz.app/*: talk to your account's API. - Content script on web pages: show the fill button next to sign-in fields, and offer to save a credential you just typed. The extension reads a field's content only when you trigger one of those actions.
In accordance with the Chrome Web Store Limited Use policy: data collected by the extension is used solely to provide the user-facing feature; it is not sold, not transferred to third parties, not used for advertising, not used for creditworthiness or lending purposes, and no human reads it, except with your explicit consent, to comply with the law, or where necessary for security.
9. Children
The service is intended for professional use and is not directed at people under 16. We do not knowingly collect their data.
10. Changes
Any substantial change to this policy is published on this page with an updated version date and signalled to the administrators of the organisations concerned.