Draft · Safety and privacy
Safety and privacy
What we do, what we do not do and what is still open. Only what is built and tested is stated as fact.
01
What keeps your page safe
| Capability | What it does | More |
|---|---|---|
| Shadow DOM | Each component renders in its own shadow root. In the compatibility matrix a hostile page stylesheet does not restyle it, and it does not restyle the page. | Docs |
| Error boundary | A component that throws is contained; the page keeps working and the fallback content you wrote stays visible. | Docs |
| Small, async loader | The loader is a small async script with a hard size ceiling, checked before every Taggor release. If Taggor or a bundle is unreachable, the page is left as it was. | Docs |
| Build in a sandbox | Source is built in an isolated container, apart from your machine and from Taggor's own servers. | Docs |
| Scan on every publish | Every publish is scanned: code that uses eval, writes cookies or storage, or reaches an undeclared network address is refused, and so is a secret in the source. | Docs |
| Immutable versions | Each publish is a new version addressed by its content. A version never changes; a change is a new version. | Docs |
| Rollback | Point a channel back at the previous version from the CLI or the portal. Nothing is rebuilt. | Docs |
| A separate domain for components | Components are served from a domain apart from the brand's, with a strict set of security headers. | Docs |
| Allowed domains | A site lists the domains where its components mount. It stops a copied snippet from working elsewhere; it is not access control. | Docs |
02
What keeps your visitors and your data safe
| Capability | What it does | More |
|---|---|---|
| No cookies for visitors | The loader and the runtime set no cookie and do not fingerprint the visitor. This site sets none either. | Docs |
| Collected data | A component declares collections in its manifest; submissions are validated against the schema, checked for spam and stored for you. | Docs |
| Consent | When a component declares personal data, it shows Taggor's consent box and each submission carries a proof of what the visitor accepted. | Docs |
| Export | Submissions are listed in the portal and exported as CSV or NDJSON from the portal and the CLI. | Docs |
03
Who decides what is collected
You are the controller of the data your components collect. You decide whether a component collects anything, what it collects, and whether that counts as personal data. Declaring personal data is optional and off by default.
Taggor does not classify what a form collects and does not decide it for you. When you do declare personal data, the consent box, the stored proof of consent and the link to your privacy policy become required for that component.
04
What we do not do, and what is open
These are the limits of what this page says.
- We do not run your code on our servers outside the build sandbox.
- No security certification is claimed, and no external audit has been done.
- An independent human security review is planned before any real customer data. It has not happened yet.
- The threat model is an internal document today. A public summary is not published yet.
- The list of allowed domains is not access control: the loader and the bundles are public.
- We do not classify the content of your forms.
The privacy policy and the terms are drafts, in Portuguese for now, and not in force: see the privacy page and the terms.Privacy policy, Terms of use.