Security and compliance appendix

What Headlight servers receive

Token mint metadata (organization ID, API key ID, frame origin, expiry) plus normal HTTP request metadata (IP, Referer on asset loads). Never chart payload content.

What Headlight JavaScript receives

The full chart payload in the browser to lay out and render the graph.

CSP (chart surface)

default-src 'none';
script-src 'self';
style-src 'self' 'unsafe-inline';
img-src 'self' data:;
font-src 'self';
connect-src 'none';
form-action 'none';
frame-src 'none';
object-src 'none';
base-uri 'none';
worker-src 'self' blob:;
frame-ancestors https://<partner-origin>;

Playground (/playground/*) uses the same base policy with frame-src 'self' so the host page may iframe the chart on the embed CDN origin. Chart and playground both keep frame-ancestors restrictions on who may embed those pages. There is no report-uri. Violation reports would leak page fragments and are intentionally omitted.

Subprocessor status

This design reduces breach blast radius, retention, residency, and legal-hold exposure. It does not automatically remove processor obligations. Expect a DPA and vendor review.

Parent sandbox

Require sandbox="allow-scripts allow-same-origin" and omit navigation/popup allowances. Top-level navigation is not CSP-blockable from inside the iframe.

⌘I