Data Processing Information
最終更新:
For anyone completing a vendor security questionnaire about this tool. States plainly that we are not a processor of your code, because we never receive it.
本文書は当サイトの運営者が作成したものであり、法的助言ではありません。コンプライアンス判断の根拠とする場合は、あなたの法域の資格を持つ弁護士に確認してください。
この法的文書は英語版のみ提供しています。機械翻訳されたプライバシーポリシーは、利用者の法域に合わせて確認済みであると誤解させるおそれがあるため、訳文は公開しません。必要に応じてブラウザの翻訳機能をご利用ください。その訳文の責任はブラウザ側にあり、当方にはありません。
1. Why this page exists
Security and procurement teams increasingly ask whether a tool processes their data, and whether a Data Processing Agreement is required. This page answers that question directly so the answer does not have to be negotiated.
2. We are not a processor of your source code
We do not process your source code, because we never receive it. The Service is a static web application; parsing is performed by WebAssembly executing in the user's browser. There is no server-side component that accepts, stores, transmits or otherwise processes file contents.
Accordingly, no Data Processing Agreement is required in respect of source code, and we cannot offer standard DPA terms, because the subject matter of such an agreement — processing of personal data on a controller's behalf — does not arise.
You can verify this claim technically: inspect the deployed bundle for network calls, or observe the Network tab in a browser while using the Service. The only requests are for static assets from this origin.
3. What we do process
The limited technical data described in the Privacy Policy §3: IP addresses and connection metadata processed by Cloudflare as our infrastructure provider, and short-lived rate-limit counters keyed on a hash of the IP address and autonomous system number.
This is the same category of data processed by any website, and it does not include anything you submit to the Service.
4. Sub-processors
That is the complete list. There are no analytics sub-processors, no advertising sub-processors, no crash-reporting sub-processors and no email sub-processors, because the Service uses none.
If this list ever changes, this page and the Privacy Policy change first, and advertising or analytics are only enabled with user opt-in.
| Sub-processor | Function | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Static hosting, CDN, TLS termination, edge rate limiting | IP address, request URL, user-agent, timestamp | Global edge; see Cloudflare's privacy policy |
5. Security posture
- No server-side handling of user input on the data path, which removes an injection class entirely.
- Content-Security-Policy permitting no third-party origin by default.
- All user-derived strings escaped at render time on the client.
- TLS enforced by Cloudflare for all requests.
- Dependency auditing in continuous integration; no runtime dependency outside the published bundle.
- No credentials, keys or secrets exist in the client bundle, because the Service calls no API.
6. Contact for security review
If your organisation requires a security review, a questionnaire response or written confirmation of the above, contact hello@contextbridge.app. We will respond within 30 days.
Vulnerability reports: abuse@contextbridge.app.