> ## Documentation Index
> Fetch the complete documentation index at: https://docs.withheadlight.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security appendix

# Security and compliance appendix

## What Headlight servers receive

Token mint metadata (organization ID, API key ID, frame origin, expiry) plus normal HTTP request metadata (IP, Referer on asset loads). Never chart payload content.

## What Headlight JavaScript receives

The full chart payload in the browser to lay out and render the graph.

## CSP (chart surface)

```
default-src 'none';
script-src 'self';
style-src 'self' 'unsafe-inline';
img-src 'self' data:;
font-src 'self';
connect-src 'none';
form-action 'none';
frame-src 'none';
object-src 'none';
base-uri 'none';
worker-src 'self' blob:;
frame-ancestors https://<partner-origin>;
```

Playground (`/playground/*`) uses the same base policy with `frame-src 'self'` so the host page may iframe the chart on the embed CDN origin. Chart and playground both keep `frame-ancestors` restrictions on who may embed those pages.

There is no `report-uri`. Violation reports would leak page fragments and are intentionally omitted.

## Subprocessor status

This design reduces breach blast radius, retention, residency, and legal-hold exposure. It does not automatically remove processor obligations. Expect a DPA and vendor review.

## Parent sandbox

Require `sandbox="allow-scripts allow-same-origin"` and omit navigation/popup allowances. Top-level navigation is not CSP-blockable from inside the iframe.