Deploy Redacta to every employee

Overview & prerequisites

Redacta is a standard Manifest V3 extension distributed through the four major browser stores. Any deployment pattern you already use for other extensions works here.

• Business or Enterprise plan on Redacta (audit log, managed API key, and reporting endpoint require these tiers).
• An MDM of your choice: Chrome Enterprise, Microsoft Intune, Group Policy, Jamf, Kandji, or direct policy files.
• A service API key generated from Dashboard → API Keys → Create service key. Distribute via managed storage — never embed in checked-in code.

Chrome Enterprise

Apply the following OU-level policy from the Google Admin console (Devices → Chrome → Apps & extensions → Users & browsers), or set it via Windows registry / /etc/opt/chrome/policies on managed endpoints.

{
  "ExtensionInstallForcelist": [
    "YOUR_CHROME_EXTENSION_ID_HERE;https://clients2.google.com/service/update2/crx"
  ],
  "ExtensionSettings": {
    "YOUR_CHROME_EXTENSION_ID_HERE": {
      "installation_mode": "force_installed",
      "update_url": "https://clients2.google.com/service/update2/crx",
      "toolbar_pin": "force_pinned"
    }
  },
  "3rdparty": {
    "extensions": {
      "YOUR_CHROME_EXTENSION_ID_HERE": {
        "apiKey": "rdk_live_xxxxxxxxxxxxxxxx",
        "reportingEnabled": true,
        "allowedSites": [
          "claude.ai",
          "chatgpt.com",
          "chat.openai.com",
          "gemini.google.com"
        ]
      }
    }
  }
}

What this does: force-installs Redacta at next browser start, pins its icon to the toolbar, and pushes the managed API key + reporting config into the extension's managed storage area. Users cannot disable or remove it.

Microsoft Edge (Intune / Group Policy)

In Microsoft Intune, create a configuration profile of type Settings Catalog → Microsoft Edge. Add Extension Management and paste the JSON below. For classic Group Policy, use the Edge ADMX templates and the matching ExtensionInstallForcelist setting.

{
  "ExtensionInstallForcelist": [
    "YOUR_EDGE_EXTENSION_ID_HERE;https://edge.microsoft.com/extensionwebstorebase/v1/crx"
  ],
  "3rdparty": {
    "extensions": {
      "YOUR_EDGE_EXTENSION_ID_HERE": {
        "apiKey": "rdk_live_xxxxxxxxxxxxxxxx",
        "reportingEnabled": true
      }
    }
  }
}

Firefox

Firefox enterprise deployments use policies.json placed next to the Firefox binary (/Applications/Firefox.app/Contents/Resources/distribution/ on macOS, C:\Program Files\Mozilla Firefox\distribution\ on Windows) or the ADMX templates shipped by Mozilla. Our gecko add-on ID is redacta@getredacta.com.

{
  "policies": {
    "ExtensionSettings": {
      "redacta@getredacta.com": {
        "installation_mode": "force_installed",
        "install_url": "https://getredacta.com/downloads/redacta-firefox-latest.xpi"
      }
    },
    "3rdparty": {
      "Extensions": {
        "redacta@getredacta.com": {
          "apiKey": "rdk_live_xxxxxxxxxxxxxxxx",
          "reportingEnabled": true
        }
      }
    }
  }
}

Business customers can host the signed .xpi directly (we provide it) or reference the AMO listing once approved.

macOS configuration profiles

Jamf, Kandji, Mosyle, and any other Apple MDM can push Chrome and Edge extension policies via a standard .mobileconfig payload. The snippet below is the Chrome-specific portion; Edge and Firefox use the same pattern with their own payload types (com.microsoft.Edge and org.mozilla.firefox).

<key>PayloadContent</key>
<array>
  <dict>
    <key>PayloadType</key>
    <string>com.google.Chrome</string>
    <key>ExtensionInstallForcelist</key>
    <array>
      <string>YOUR_CHROME_EXTENSION_ID_HERE;https://clients2.google.com/service/update2/crx</string>
    </array>
    <key>PayloadIdentifier</key>
    <string>com.sandiadevgroup.redacta.chrome</string>
  </dict>
</array>

Pre-configuring the API key

The extension reads a managed-storage schema defined in its manifest. When your policy populates it, the popup hides the API key field and users cannot change it. Recognized keys:

Audit log & reporting

Every redaction performed by a managed extension emits an event to the Redacta audit log, visible in the dashboard under Reports → Extension activity. Each event records provider host, entity types, counts, tenant ID, and timestamp. Message text and original values are never captured. Export as CSV or stream via webhook.

On the Enterprise plan, we can also forward events to your SIEM (Splunk HEC, Datadog, or any generic webhook).

FAQ for IT