Allowing the
Candela Recorder.

Someone in your organisation is making a product film with Candela and needs the Candela Recorder, a Chrome extension (Manifest V3) that records a workflow in your own web application. If your managed browser blocks extensions or Developer mode, this page has what you need to review it and deploy it with a policy. It is a summary for review, not a contract; the data processing terms are in your agreement with Candela.

1. The extension at a glance
2. Permissions and why
3. Data handling
4. Web Store or self-hosted
5. Chrome policies
6. Windows Group Policy and registry
7. Microsoft Intune
8. macOS configuration profile
9. Google Admin console
10. Microsoft Edge
11. Network and TLS inspection
12. Email to IT
13. Sources

The extension at a glance

Permissions and why each is needed

Exactly what the package's manifest.json asks for.

Data handling

• What is recorded. Only the tab where the user pressed Record, only until Stop, never while paused. Each click, Enter, form submit, select change and page change becomes a step: a screenshot, the page's DOM and styles (recorded with rrweb), the element clicked, the URL and the viewport size. The toolbar badge shows REC while recording.
• Masking. Password fields are always masked, including fields with secret autocomplete hints (passwords, one-time codes, card numbers); no setting turns that off. All other inputs are masked by default. Users can mask any element on a site (names, amounts, panels); masked areas are covered in screenshots. Developers can mark elements with data-candela-block so they are never captured.
• Upload only on Send. Until the user presses Send to Candela on the review screen, the recording stays in the browser (the extension's IndexedDB). The user can delete steps or discard it.
• In transit. HTTPS (TLS) to https://candela.mov only, authenticated by the capture link's token, which allows uploads for one film and expires after 7 days. The server stores only a hash of the token.
• On the server. Candela is hosted on Infomaniak Public Cloud in Geneva, Switzerland (compute, database and object storage). The server masks password-like values again, deletes the raw upload once the product kit is built, and keeps the scrubbed result to build the film.
• Retention. Product kits: 90 days without use. Films: 180 days after their last activity. Database backups: 14 days. All earlier when the customer deletes the film.
• Export and deletion. On request, or by the customer's account owner in the app: an export of the organisation's data, deletion of a film and everything made from it, deletion of an account. Details: candela.mov/privacy.
• AI processing. To write the film, Candela sends screenshots and copy from the kit to its AI provider (Anthropic, United States) under a data processing agreement; see the sub-processors in the privacy notice.

Web Store or self-hosted

Two ways to deploy the same extension. Choose one and use its ID and update URL in the policies below.

Chrome policies

Pick what fits your current policy. Policy names are the same on every platform; the sections below show where to set them.

If extensions are blocked (ExtensionInstallBlocklist contains *)

Add the ID to ExtensionInstallAllowlist so users can install it themselves, or force-install it (next).

pemkanpgneajllajfenhcebakboijecl

Install it for everyone: ExtensionInstallForcelist

Each entry is the extension ID, optionally followed by ; and an update URL. A force-installed extension cannot be removed or disabled by the user, and is allowed even when * is blocklisted.

pemkanpgneajllajfenhcebakboijecl;https://candela.mov/recorder/update.xml

All in one: ExtensionSettings

The JSON policy that supersedes the per-ID lists above. This example force-installs the self-hosted package, pins it to the toolbar, and shows where to limit the sites it may be granted. update_url is used for the installation; with override_update_url Chrome also takes updates from it.

{
  "pemkanpgneajllajfenhcebakboijecl": {
    "installation_mode": "force_installed",
    "update_url": "https://candela.mov/recorder/update.xml",
    "override_update_url": true,
    "toolbar_pin": "force_pinned"
  }
}

• Web Store instead: use the Web Store ID with "update_url": "https://clients2.google.com/service/update2/crx" and no override_update_url.
• Allow but do not force: "installation_mode": "allowed" (or "normal_installed" to install it but let users disable it).
• Sites it may record: the Recorder asks the user for one site at a time. If your default ("*") entry sets runtime_blocked_hosts, add the web applications to be recorded to this ID's runtime_allowed_hosts (for example ["*://app.example.com"]), and never block *://candela.mov, which it needs to upload. An ID-specific entry does not inherit runtime_blocked_hosts from "*", only installation_mode and update_url.
• Blocked permissions: if "*" sets blocked_permissions, make sure activeTab, scripting and storage are not blocked for this ID.

ExtensionInstallSources

Not needed for policy installs. Only if users should install the CRX themselves by opening it from a link: allow both the CRX location and the page linking to it, e.g. https://candela.mov/*.

Developer mode

The manual install (Load unpacked) needs Developer mode on chrome://extensions. Chrome disables it when DeveloperToolsAvailability is 2 (DevTools disallowed), or, from Chrome 128, when ExtensionDeveloperModeSettings is 1. A policy install does not need Developer mode, so you can leave both as they are.

Windows: Group Policy and registry

With the Google Chrome ADMX templates installed: Computer Configuration › Administrative Templates › Google › Google Chrome › Extensions:

• Configure the list of force-installed apps and extensions (ExtensionInstallForcelist): Enabled, add pemkanpgneajllajfenhcebakboijecl;https://candela.mov/recorder/update.xml.
• Configure extension installation allow list (ExtensionInstallAllowlist), Extension management settings (ExtensionSettings, one line of JSON).

The same as registry values (machine-wide, under HKLM; each list entry is a string value named 1, 2, 3…):

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist]
"1"="pemkanpgneajllajfenhcebakboijecl;https://candela.mov/recorder/update.xml"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist]
"1"="pemkanpgneajllajfenhcebakboijecl"

If those keys already hold values, use the next free number instead of 1. Check the result on chrome://policy (Reload policies), then chrome://extensions.

Microsoft Intune

Devices › Configuration › Create › New policy, platform Windows 10 and later, profile type Settings catalog. Search for Google Chrome › Extensions (the Chrome settings are built in) and set Configure the list of force-installed apps and extensions to Enabled with pemkanpgneajllajfenhcebakboijecl;https://candela.mov/recorder/update.xml. For Edge, the setting is under Microsoft Edge › Extensions › Control which extensions are installed silently. Assign to the users' or devices' group.

If the Chrome settings are not available in your tenant, import Google's ADMX templates into Intune (Google's guide "Manage Chrome browser with Intune", in Sources) and set the same policy there. menu names may vary by tenant

macOS configuration profile

Deploy with your MDM (Jamf, Kandji, Intune, Mosyle…) as a custom settings payload for the preference domain com.google.Chrome (Edge: com.microsoft.Edge):

<key>ExtensionInstallForcelist</key>
<array>
  <string>pemkanpgneajllajfenhcebakboijecl;https://candela.mov/recorder/update.xml</string>
</array>
<key>ExtensionInstallAllowlist</key>
<array>
  <string>pemkanpgneajllajfenhcebakboijecl</string>
</array>

Google Admin console (Chrome Enterprise)

1. Menu › Chrome browser (or Devices › Chrome) › Apps & extensions › Users & browsers, choose the organisational unit.
2. Click + (Add), then Add Chrome app or extension by ID.
3. Enter pemkanpgneajllajfenhcebakboijecl. Choose From the Chrome Web Store, or From a custom URL with https://candela.mov/recorder/update.xml for the self-hosted package.
4. Set the installation policy to Force install (optionally Force install + pin to browser toolbar) or Allow install, and save.

Browsers enrolled in Chrome Enterprise Core apply it at their next policy fetch.

Microsoft Edge

Edge uses the same policy names under its own keys. Edge's default update source is Microsoft's Edge Add-ons, so a Chrome Web Store ID needs the Chrome update URL written out:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist]
"1"="pemkanpgneajllajfenhcebakboijecl;https://candela.mov/recorder/update.xml"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallAllowlist]
"1"="pemkanpgneajllajfenhcebakboijecl"

Group Policy (Edge ADMX): Administrative Templates › Microsoft Edge › Extensions › Control which extensions are installed silently. Microsoft documents that self-hosted extensions on Windows need the device joined to Active Directory (or Microsoft Entra hybrid joined).

Network and TLS inspection

Exempt candela.mov from TLS inspection (SSL deep inspection on Fortinet, Zscaler, Palo Alto, Netskope and similar). Uploads are large binary requests; inspection proxies that re-sign certificates or buffer bodies cause failed uploads and certificate errors. If inspection must stay on, make sure the proxy's root certificate is trusted by the browser and the upload size limit is at least 16 MB per request.

Email to IT

For the person who needs the Recorder: copy this, or open it in your mail program.

Subject: Please allow the Candela Recorder browser extension

Hello,

For a product film we are making with Candela (candela.mov), I need the Candela Recorder extension in Chrome or Edge. Our browser policy blocks installing it.

Extension: Candela Recorder (Manifest V3), published by Dafin SA
Extension ID: pemkanpgneajllajfenhcebakboijecl
Self-hosted update URL: https://candela.mov/recorder/update.xml
Force-install entry (ExtensionInstallForcelist): pemkanpgneajllajfenhcebakboijecl;https://candela.mov/recorder/update.xml

It only records the tab I start it in, masks passwords and inputs by default, and uploads nothing until I review the recording and press Send. Data is hosted in Switzerland (Infomaniak).

Permissions, data handling and ready-to-use policies for Windows, Intune, macOS, Google Admin and Edge:
https://candela.mov/recorder/it

Thank you!

Sources

Policy names, registry paths and the managed-device rule were checked against these on October 13, 2026. Items marked menu names may vary describe consoles whose menus change often.

• Chrome Enterprise policy list: ExtensionInstallForcelist, ExtensionSettings, ExtensionInstallAllowlist, ExtensionInstallSources, ExtensionDeveloperModeSettings, DeveloperToolsAvailability
• Google: Set Chrome app and extension policies (Windows), Set Chrome app and extension policies (Mac), Configure ExtensionSettings policy, Manage Chrome browser with Intune (import administrative templates)
• Chrome for developers: Self-host for Linux (the update manifest format), externally_connectable
• Microsoft: Edge ExtensionInstallForcelist, Self-host Microsoft Edge extensions