Data Processing Information
最后更新:
For anyone completing a vendor security questionnaire about this tool. States plainly that we are not a processor of your code, because we never receive it.
本文件由本站运营者编写,不构成法律建议。如果你要依据它做出合规决定,请让你所在司法辖区的执业律师审阅。
本法律文件仅提供英文版本。我们不发布译文,因为机器翻译的隐私政策可能让人误以为它已按您所在司法辖区审阅过,而实际上并未审阅。如有需要,请使用浏览器自带的翻译功能;该译文由浏览器负责,而非我们。
1. Why this page exists
Security and procurement teams increasingly ask whether a tool processes their data, and whether a Data Processing Agreement is required. This page answers that question directly so the answer does not have to be negotiated.
2. We are not a processor of your source code
We do not process your source code, because we never receive it. The Service is a static web application; parsing is performed by WebAssembly executing in the user's browser. There is no server-side component that accepts, stores, transmits or otherwise processes file contents.
Accordingly, no Data Processing Agreement is required in respect of source code, and we cannot offer standard DPA terms, because the subject matter of such an agreement — processing of personal data on a controller's behalf — does not arise.
You can verify this claim technically: inspect the deployed bundle for network calls, or observe the Network tab in a browser while using the Service. The only requests are for static assets from this origin.
3. What we do process
The limited technical data described in the Privacy Policy §3: IP addresses and connection metadata processed by Cloudflare as our infrastructure provider, and short-lived rate-limit counters keyed on a hash of the IP address and autonomous system number.
This is the same category of data processed by any website, and it does not include anything you submit to the Service.
4. Sub-processors
That is the complete list. There are no analytics sub-processors, no advertising sub-processors, no crash-reporting sub-processors and no email sub-processors, because the Service uses none.
If this list ever changes, this page and the Privacy Policy change first, and advertising or analytics are only enabled with user opt-in.
| Sub-processor | Function | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Static hosting, CDN, TLS termination, edge rate limiting | IP address, request URL, user-agent, timestamp | Global edge; see Cloudflare's privacy policy |
5. Security posture
- No server-side handling of user input on the data path, which removes an injection class entirely.
- Content-Security-Policy permitting no third-party origin by default.
- All user-derived strings escaped at render time on the client.
- TLS enforced by Cloudflare for all requests.
- Dependency auditing in continuous integration; no runtime dependency outside the published bundle.
- No credentials, keys or secrets exist in the client bundle, because the Service calls no API.
6. Contact for security review
If your organisation requires a security review, a questionnaire response or written confirmation of the above, contact hello@contextbridge.app. We will respond within 30 days.
Vulnerability reports: abuse@contextbridge.app.