Setting up the Chrome extension

The extension exists to keep a suspect URL off the endpoint. Instead of fetching the page, Chrome hands the address to Guard.ch, which opens it in a throwaway cloud browser and streams that back into a tab, with the live analysis running beside the page: requests, redirects, cookies, storage writes, tracking classifications and every third party it contacts, while the session runs.

Launch actions run only when you invoke them. On managed installs, a narrowly scoped auto-SSO script can also run on the Guard.ch sign-in entry page: it reads the policy-managed Workspace slug and may redirect to company SSO, but reads no page content. This guide covers launches, managed deployment, permissions, and troubleshooting.

What it adds to Chrome

• Open in Guard.ch, in the right-click menu on every link. It also fires on selected text, so a URL that arrived as plain text in a ticket goes straight into an investigation. When a link and a selection are both in play, the link wins.
• A toolbar button, with a paste box for URLs. Its menu holds the only two extras: a Workspace SSO field (see the rollout section) and a shortcut into your Guard.ch dashboard.
• A keyboard shortcut. Ctrl+Shift+G (Cmd+Shift+G on macOS) sends the current tab's page into an investigation. Rebind it at chrome://extensions/shortcuts.

Install it

The extension is a free install from the Chrome Web Store:

1. Open the Guard.ch extension on the Chrome Web Store.
2. Click Add to Chrome and confirm with Add extension.
3. Optional: click the puzzle icon in the toolbar and pin Guard.ch Companion, so the paste box stays within reach.
4. Right-click any link and choose Open in Guard.ch. The extension stores no account; its popup menu contains the optional Workspace SSO setting and a dashboard shortcut.

To inspect what you install, download the packed build, unzip it, open chrome://extensions, switch on Developer mode and choose Load unpacked with the unzipped folder. A manual install does not update itself; the store one does.

What a launch does

Every launch action opens a tab on guard.ch carrying the target address in encoded form. The suspect page never loads in your Chrome. What loads is the Guard.ch launcher, which starts an isolated browser in our cloud, streams it into the tab and opens the live investigation. The extension makes no API request and holds no account; the tab uses the Guard.ch session the browser is already signed into.

That session is the only requirement. Signed out, the tab meets the Guard.ch sign-in first; on a managed install it goes to your own sign-in instead (see the rollout section). Investigations are part of the paid product, so the account needs an active plan or trial, and the tab says so plainly when it does not.

What counts as a link

The extension is strict about what it will launch, so a sloppy selection cannot start an investigation of nonsense. It accepts:

• Full addresses with http:// or https://.
• Bare domains such as example-shop.com; https:// is assumed in front.
• IP addresses and localhost, with or without a port.
• Selected text that spells one of the above; surrounding whitespace is ignored.

Managed rollout

The extension is built to be pushed. IT force-installs it through Chrome's policy channel and sets the workspace's sign-in slug in the same policy. Every launch on a managed device then routes through your own Microsoft sign-in: a colleague with a live session never sees a form, and accounts can be provisioned on first sign-in.

The per-tool rollout steps live in your workspace settings under Configure extensions, and the sign-on behind them has its own guide. Without IT in the loop, the same routing can be set by hand: open the toolbar popup's menu, choose Workspace SSO and enter the slug. A policy-pushed value always wins over a hand-set one, and the popup then shows it read-only.

Incognito windows

Extensions stay out of Incognito until you allow them, so the right-click item will not appear there at first. Open chrome://extensions, choose Details on Guard.ch Companion and switch on Allow in Incognito. Installs are per profile as well: each Chrome profile carries its own copy with its own settings.

What it can and cannot do

The extension does not record browsing activity or read page content. Its launch permissions cover the context menu, local error notifications, momentary access to the active tab when you fire the shortcut, and storage for the optional Workspace slug. A content script is limited to the Guard.ch sign-in entry page and only reads the policy-managed slug to route managed users through company SSO.

The investigation itself runs entirely in our cloud. The target never loads in your Chrome, nothing lands on the machine, and the extension calls nobody: no analytics, no requests of its own. The only thing it does to the network is open a guard.ch tab.

Works with

Google Chrome

Install

Chrome Web Store, free

Permissions

Context menu, notifications, active-tab access on invocation, Workspace-slug storage, Guard.ch sign-in entry page

Languages

English and German, following the browser language

Network calls

No fetch or API calls; it only opens or redirects Guard.ch tabs

Runs

In an isolated cloud browser, never on your endpoint

Troubleshooting

Extension problems come down to a short list:

“That isn't a URL Guard.ch can open.” The launch was refused before a tab opened: what you right-clicked or pasted does not parse as an address. Full URLs, bare domains, IPs and localhost pass; anything else does not, and a stray word inside the selection is the usual cause.

“There's no page to investigate in this tab.” The keyboard shortcut needs a real page in the active tab. A blank new tab or a browser-internal page has nothing to hand over; use the toolbar popup instead.

The right-click item is missing. Three usual causes: an Incognito window without Allow in Incognito (see above), a different Chrome profile (each profile installs its own extensions), or a managed browser whose policy blocks store installs, in which case IT rolls the extension out centrally.

The shortcut does nothing. Another extension claimed Ctrl+Shift+G first, or the binding was cleared. chrome://extensions/shortcuts shows who owns which key and lets you rebind it.

The tab lands on a sign-in screen. Expected when the browser is signed out: sign in once and relaunch. On a managed install it usually means the pushed slug does not match the workspace's sign-in link. The rollout wizard in the dashboard shows the exact value to push.

The tab shows an upgrade screen. The account is signed in but carries no active plan or trial. Extension launches are part of the paid product: start the trial, or ask a workspace manager for a seat.

Other entry points

However a link reaches Guard.ch, it lands in the same investigation. The other ways in are on the integrations page; what the analysis shows you while a session runs is on the product page.