Encryption key protection
Encryption keys are protected by AWS KMS, and database credentials are kept server-side.
Your data is encrypted with a key of its own. The main key that protects it is held in AWS Key Management Service (KMS) and never leaves it. Worsley's database stores your key only in locked form: when your data needs to be read, the API asks KMS to unlock it, keeps it in memory for a few minutes, and never stores or logs it.
The credentials for Worsley's database are kept on Worsley's servers. Neither they nor any key are included in the browser extension or the website, so they can't be extracted from either.
The extension's key can only upload your sessions and read back your scores and insights. It can't reach anything else in your account.