Quick security facts (2026 scan)
| Chrome extension | Sider: ChatGPT Sidebar |
|---|---|
| Permission profile | Broader than typical |
| All-sites access | Yes — can access every site you visit when enabled |
| Permissions beyond typical | cookies, userScripts, declarativeNetRequest, tabCapture |
| Privacy policy score | Not fully assessed |
| Scan date / version | 2026-07-31 / 5.30.0 |
What permissions does Sider request?
The following permissions were declared in Chrome extension version 5.30.0 as of the 2026-07-31 scan. If you are asking is Sider for Chrome safe, this table is the primary evidence: it shows what the extension is allowed to do when installed.
Requests access to all websites you visit.
| Permission | Risk | What it can do |
|---|---|---|
storage | low | Can store data locally in the browser. |
cookies | high | Can read and modify cookies, which often include login sessions. |
contextMenus | low | Can add items to the right-click context menu. |
scripting | medium | Can inject and run scripts on pages it has access to. |
userScripts | high | Can register and run arbitrary user scripts on pages. |
activeTab | low | Can act on the current tab only when you click the extension. |
unlimitedStorage | low | Can store an unlimited amount of local data. |
tabs | medium | Can see the URLs, titles, and open/close state of your browser tabs. |
sidePanel | low | Can display content in the browser side panel. |
offscreen | low | Can create a hidden document to use browser APIs that need a page. |
alarms | low | Can schedule code to run at set times. |
declarativeNetRequest | medium | Can block or modify network requests using declared rules. |
tabCapture | high | Can capture the visible content, audio, and video of a tab. |
tabGroups | low | Can organize your browser tabs into groups. |
Permissions beyond the typical ai sidebar set
Compared with the permissions a typical ai sidebar extension needs, Sider also requests the following as of the 2026-07-31 scan. Extra permissions are not inherently a problem — each can support legitimate features. We list what each one can enable so you can weigh it for yourself.
cookies(high) — can support reading or setting site cookies, which can let it act inside web apps where you are already signed in.userScripts(high) — can support registering and running its own scripts on pages, which supports user-defined automations.declarativeNetRequest(medium) — can support blocking or rewriting network requests via declared rules, often used to reach an API or adjust headers.tabCapture(high) — can support capturing a tab's audio or video, which can support screen-reading, recording, or meeting features.
As of the 2026-07-31 scan, Sider requests several permissions beyond the typical set for an AI sidebar assistant. The cookies permission can support reading or setting site cookies, which can let it act inside web apps where you are already signed in. The userScripts permission can support registering and running its own scripts on pages, supporting user-defined automations. The declarativeNetRequest permission can support blocking or rewriting network requests via declared rules, often used to reach an API or adjust headers. The tabCapture permission can support capturing a tab's audio or video, which can support screen-reading, recording, or meeting features.
Where can Sider data flow?
Domains below are extracted by static analysis and represent a lower bound — an extension may contact additional endpoints at runtime that this method does not capture.
amazon.comthird-partyamazonaws.comthird-partyanthropic.comthird-partyar5iv.orgthird-partyawesomegpts.aithird-partybaidu.comthird-partybase-ui.comthird-partybilibili.comthird-partybing.comthird-partybrave.comthird-partycanny.iothird-partycerebras.aithird-partychatgpt.comthird-partychevrotain.iothird-partyclaude.aithird-partyclaude.comthird-partycloudflare.comthird-partyco.aothird-partyco.bwthird-partyco.ckthird-partyco.crthird-partyco.idthird-partyco.ilthird-partyco.kethird-partyco.lsthird-partyco.mathird-partyco.mzthird-partyco.ththird-partyco.tzthird-partyco.ugthird-partyco.uzthird-partyco.vethird-partyco.vithird-partyco.zmthird-partyco.zwthird-partycom.afthird-partycom.agthird-partycom.aithird-partycom.arthird-partycom.bdthird-partycom.bhthird-partycom.bnthird-partycom.bothird-partycom.bzthird-partycom.cothird-partycom.cuthird-partycom.cythird-partycom.dothird-partycom.ecthird-partycom.egthird-partycom.etthird-partycom.fjthird-partycom.ghthird-partycom.githird-partycom.gtthird-partycom.jmthird-partycom.khthird-partycom.kwthird-partycom.lbthird-partycom.lythird-partycom.mmthird-partycom.mtthird-partycom.mythird-partycom.nathird-partycom.ngthird-partycom.nithird-partycom.npthird-partycom.omthird-partycom.pathird-partycom.pethird-partycom.pgthird-partycom.phthird-partycom.pkthird-partycom.prthird-partycom.pythird-partycom.qathird-partycom.sathird-partycom.sbthird-partycom.slthird-partycom.svthird-partycom.tjthird-partycom.uythird-partycom.vcthird-partycom.vnthird-partycurl.sethird-partydashif.orgthird-partydeepseek.comthird-partydiscord.ggthird-partyduckduckgo.comthird-partydummy.comthird-partyesm.shthird-partyexample.comthird-partyexpo.devthird-partyfacebook.comthird-partyfb.methird-partyfigma.comthird-partyfireworks.aithird-partygithub.comthird-partygithubcopilot.comthird-partygoogle-analytics.comthird-partygoogle.adthird-partygoogle.aethird-partygoogle.althird-partygoogle.amthird-partygoogle.asthird-partygoogle.atthird-partygoogle.azthird-partygoogle.bathird-partygoogle.bethird-partygoogle.bfthird-partygoogle.bgthird-partygoogle.bithird-partygoogle.bjthird-partygoogle.bsthird-partygoogle.btthird-partygoogle.bythird-partygoogle.cathird-partygoogle.catthird-partygoogle.cdthird-partygoogle.cfthird-partygoogle.cgthird-partygoogle.chthird-partygoogle.cithird-partygoogle.clthird-partygoogle.cmthird-partygoogle.cnthird-partygoogle.co.inthird-partygoogle.co.jpthird-partygoogle.co.krthird-partygoogle.co.nzthird-partygoogle.co.ukthird-partygoogle.co.zathird-partygoogle.comthird-partygoogle.com.authird-partygoogle.com.brthird-partygoogle.com.hkthird-partygoogle.com.mxthird-partygoogle.com.sgthird-partygoogle.com.trthird-partygoogle.com.twthird-partygoogle.com.uathird-partygoogle.cvthird-partygoogle.czthird-partygoogle.dethird-partygoogle.djthird-partygoogle.dkthird-partygoogle.dmthird-partygoogle.dzthird-partygoogle.eethird-partygoogle.esthird-partygoogle.fithird-partygoogle.fmthird-partygoogle.frthird-partygoogle.gathird-partygoogle.gethird-partygoogle.ggthird-partygoogle.glthird-partygoogle.gmthird-partygoogle.grthird-partygoogle.gythird-partygoogle.hnthird-partygoogle.hrthird-partygoogle.htthird-partygoogle.huthird-partygoogle.iethird-partygoogle.imthird-partygoogle.iqthird-partygoogle.isthird-partygoogle.itthird-partygoogle.jethird-partygoogle.jothird-partygoogle.kgthird-partygoogle.kithird-partygoogle.kzthird-partygoogle.lathird-partygoogle.lithird-partygoogle.lkthird-partygoogle.ltthird-partygoogle.luthird-partygoogle.lvthird-partygoogle.mdthird-partygoogle.methird-partygoogle.mgthird-partygoogle.mkthird-partygoogle.mlthird-partygoogle.mnthird-partygoogle.msthird-partygoogle.muthird-partygoogle.mvthird-partygoogle.mwthird-partygoogle.nethird-partygoogle.nlthird-partygoogle.nothird-partygoogle.nrthird-partygoogle.nuthird-partygoogle.plthird-partygoogle.pnthird-partygoogle.psthird-partygoogle.ptthird-partygoogle.rothird-partygoogle.rsthird-partygoogle.ruthird-partygoogle.rwthird-partygoogle.scthird-partygoogle.sethird-partygoogle.shthird-partygoogle.sithird-partygoogle.skthird-partygoogle.smthird-partygoogle.snthird-partygoogle.sothird-partygoogle.srthird-partygoogle.stthird-partygoogle.tdthird-partygoogle.tgthird-partygoogle.tlthird-partygoogle.tmthird-partygoogle.tnthird-partygoogle.tothird-partygoogle.ttthird-partygoogle.vgthird-partygoogle.vuthird-partygoogle.wsthird-partygoogleapis.comthird-partygptshere.comthird-partygroq.comthird-partyhuggingface.cothird-partyinstagram.comthird-partyiso.orgthird-partyjson-schema.orgthird-partykagi.comthird-partykimi.comthird-partylangium.orgthird-partylinkedin.comthird-partymicrosoft.comthird-partymicrosofttranslator.comthird-partyminimax.iothird-partyminimaxi.comthird-partymistral.aithird-partymoonshot.aithird-partymoonshot.cnthird-partynaver.comthird-partynetflix.comthird-partyoaiusercontent.comthird-partyoauth.netthird-partyopenai.comthird-partyopencode.aithird-partyopenrouter.aithird-partyprosemirror.netthird-partyreactjs.orgthird-partyreddit.comthird-partys3-fips.dualstackthird-partys3.dualstackthird-partysearx.bethird-partysider.aifirst-partysidercontent.comthird-partysiderusercontent.comthird-partystackexchange.comthird-partythreads.netthird-partytogether.aithird-partytwitter.comthird-partyvercel.shthird-partyw3.orgthird-partywhatsapp.comthird-partywikipedia.orgthird-partywolframalpha.comthird-partyx.aithird-partyx.comthird-partyxiaomimimo.comthird-partyyahoo.co.jpthird-partyyahoo.comthird-partyycombinator.comthird-partyyoutu.bethird-partyyoutube-nocookie.comthird-partyyoutube.comthird-partyytjs.devthird-partyz.aithird-partyzaobao.comthird-partyzaobao.com.sgthird-partyzeroclick.devthird-party
As of the 2026-07-31 scan, the extension references one first-party vendor-owned domain (sider.ai) and a large number of third-party external domains, including services such as amazonaws.com, anthropic.com, openai.com, google-analytics.com, and many others spanning search engines, social media platforms, and AI providers. This domain list is a static-analysis lower bound, meaning it may miss dynamically loaded endpoints not visible in the extension's code at scan time. What data, if any, flows to these domains depends on how the extension operates in practice, which this scan does not assess.
Privacy policy findings
No privacy policy was fetched or scored as of the 2026-07-31 scan.
Editor's analysis: is Sider safe?
Sider (by Sider AI / Vidline Inc.) has limited publicly available security documentation, and its privacy policy could not be reached during our automated scan. As of the 2026-07-31 scan, here is what the public record shows.
Security certifications: No ISO 27001, SOC 2, or equivalent third-party security certifications were found in public records as of the scan date. Sider's website does not publish a dedicated security or compliance page.
Privacy policy: Our automated scanner could not reach or assess Sider's privacy policy (scan status: partial:policy). This means we have no policy score, no criteria breakdown, and no red flags from the policy review. Without a reviewed privacy policy, we cannot report on what Sider states it collects, shares, retains, or whether user content trains AI models.
Data flows: Static analysis shows the extension communicates with sider.ai (first-party) and a very large number of third-party domains, including anthropic.com, openai.com, google-analytics.com, and amazonaws.com. This is expected for an AI sidebar that routes queries to multiple AI model providers (ChatGPT, Claude, Gemini, Grok). The extensive domain list reflects the multi-provider architecture.
Permissions: Sider requests cookies, userScripts, declarativeNetRequest, and tabCapture — all beyond the typical set for an AI sidebar. These can support running custom scripts on pages, interacting with signed-in web apps, modifying network requests, and capturing tab audio or video. Each can serve legitimate features, but together they represent a broad permission set.
For business use: Without published security certifications or a reviewed privacy policy, Sider's suitability for regulated industries cannot be assessed. There is no publicly available SOC 2 report, DPA, or enterprise security documentation.
Bottom line: The inability to assess Sider's privacy policy is itself a data gap. Combined with no known security certifications and a broad permission set, users should exercise caution with sensitive data. The multi-provider AI architecture means your queries may be routed to different AI models — understand what that implies for your data before use.
Is Sider safe to use? Sider routes queries across multiple model providers and requests broader-than-typical permissions (cookies, userScripts, declarativeNetRequest, tabCapture) plus all-sites access. We could not fully score the privacy policy during the automated scan, and no ISO/SOC 2 certifications were found publicly. That leaves a documentation gap: the product may be fine for casual use, but we cannot show the same control evidence we can for Grammarly or DeepL.
Is Sider for Chrome safe on a work laptop? If your company restricts extensions with tab capture or custom script injection, Sider will likely fail policy review. For personal research on non-sensitive pages, review the permission table on this page and decide against your own threat model.
FAQ: is Sider safe to use?
Is Sider safe?
No security certifications found and privacy policy could not be assessed by our scanner. The extension routes queries to multiple AI providers (ChatGPT, Claude, Gemini) and requests broad permissions including custom script execution and tab capture.
Is Sider safe to use?
No security certifications found and privacy policy could not be assessed by our scanner. The extension routes queries to multiple AI providers (ChatGPT, Claude, Gemini) and requests broad permissions including custom script execution and tab capture.
Is Sider for Chrome safe?
The Sider Chrome extension was scanned on 2026-07-31 (version 5.30.0). Requests broader permissions than typical for a AI sidebar assistant. It can access all sites you visit when enabled. Privacy policy was not fully scored.
Is Sider secure for business use?
Security certifications: No ISO 27001, SOC 2, or equivalent third-party security certifications were found in public records as of the scan date. Sider's website does not publish a dedicated security or compliance page.
Does Sider use your data for AI training?
No clear statement was found in the privacy policy as of the 2026-07-31 scan.
What permissions does the Sider Chrome extension request?
Sider version 5.30.0 declares: storage, cookies, contextMenus, scripting, userScripts, activeTab, unlimitedStorage, tabs, sidePanel, offscreen, alarms, declarativeNetRequest, tabCapture, tabGroups as of the 2026-07-31 scan. Profile: Broader than typical.
Similar extensions
Monica
Peer AI sidebar — typical vs broader permission profile comparison.
Merlin
AI assistant with partial compliance claims — compare documentation gaps.
Grammarly
Certified baseline when your question is business security controls.
Compare other AI extensions we scanned
Still deciding? Read independent disclosures for other AI Chrome extensions — same methodology, same scan date window.
Is Merlin AI Assistant safe?
Claims SOC 2/GDPR/ISO compliance for paid users only — not independently verified. Privacy policy scored 5.0/10 with three red flags: no data deletion rights, unclear GDPR handling, and AI training on user content.
Broader than typical · scanned 2026-07-31
Is Monica safe?
No ISO or SOC 2 certifications found. Privacy policy scored 4.1/10 with four red flags: no data deletion rights, no policy change notification, no children's data policy, and AI training on user content with no disclosed opt-out.
Typical for its category · scanned 2026-07-31
Is DeepL Translate safe?
DeepL is ISO 27001 certified and GDPR-compliant. Free-tier translations may train AI models; paid plans do not. The browser extension requests broader permissions than typical for translation tools, but they serve legitimate translation functionality.
Broader than typical · scanned 2026-07-31
Is Grammarly safe?
Grammarly holds SOC 2 Type 2, ISO 27001, ISO 42001, and HIPAA compliance — one of the broadest security portfolios among AI writing tools. Users can opt out of AI training on their content. The extension requests broader permissions than typical, supporting desktop app integration and signed-in web app access.
Broader than typical · scanned 2026-07-31
Compare with every extension we have reviewed on theextension security index, or see how this disclosure is produced on our security methodology page. Looking for a tool by job-to-be-done? Try the AI Tool Finder.