Data Processing Information
Last updated:
For anyone completing a vendor security questionnaire about this tool. States plainly that we are not a processor of your code, because we never receive it.
This document was prepared by the operator of this site and is not legal advice. If you are relying on it for a compliance decision, have a qualified lawyer in your jurisdiction review it.
1. Why this page exists
Security and procurement teams increasingly ask whether a tool processes their data, and whether a Data Processing Agreement is required. This page answers that question directly so the answer does not have to be negotiated.
2. We are not a processor of your source code
We do not process your source code, because we never receive it. The Service is a static web application; parsing is performed by WebAssembly executing in the user's browser. There is no server-side component that accepts, stores, transmits or otherwise processes file contents.
Accordingly, no Data Processing Agreement is required in respect of source code, and we cannot offer standard DPA terms, because the subject matter of such an agreement — processing of personal data on a controller's behalf — does not arise.
You can verify this claim technically: inspect the deployed bundle for network calls, or observe the Network tab in a browser while using the Service. The only requests are for static assets from this origin.
3. What we do process
The limited technical data described in the Privacy Policy §3: IP addresses and connection metadata processed by Cloudflare as our infrastructure provider, and short-lived rate-limit counters keyed on a hash of the IP address and autonomous system number.
This is the same category of data processed by any website, and it does not include anything you submit to the Service.
4. Sub-processors
That is the complete list. There are no analytics sub-processors, no advertising sub-processors, no crash-reporting sub-processors and no email sub-processors, because the Service uses none.
If this list ever changes, this page and the Privacy Policy change first, and advertising or analytics are only enabled with user opt-in.
| Sub-processor | Function | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Static hosting, CDN, TLS termination, edge rate limiting | IP address, request URL, user-agent, timestamp | Global edge; see Cloudflare's privacy policy |
5. Security posture
- No server-side handling of user input on the data path, which removes an injection class entirely.
- Content-Security-Policy permitting no third-party origin by default.
- All user-derived strings escaped at render time on the client.
- TLS enforced by Cloudflare for all requests.
- Dependency auditing in continuous integration; no runtime dependency outside the published bundle.
- No credentials, keys or secrets exist in the client bundle, because the Service calls no API.
6. Contact for security review
If your organisation requires a security review, a questionnaire response or written confirmation of the above, contact hello@contextbridge.app. We will respond within 30 days.
Vulnerability reports: abuse@contextbridge.app.