Security and compliance appendix

What Headlight servers receive

Token mint metadata (organization ID, API key ID, frame origin, expiry) plus normal HTTP request metadata (IP, Referer on asset loads). Never chart payload content.

What the chart receives in the browser

The full chart payload, used only to lay out and draw the graph.

CSP (chart surface)

default-src 'none';
script-src 'self';
style-src 'self' 'unsafe-inline';
img-src 'self' data:;
font-src 'self';
connect-src 'none';
form-action 'none';
frame-src 'none';
object-src 'none';
base-uri 'none';
worker-src 'self' blob:;
frame-ancestors https://<partner-origin>;

Only allowlisted origins may embed the chart.

Subprocessor status

Chart payload data stays in the browser. Expect a DPA and vendor review for the mint metadata Headlight does receive.

Parent sandbox

Require sandbox="allow-scripts allow-same-origin" and omit navigation/popup allowances. Top-level navigation is not CSP-blockable from inside the iframe.