Security · the page you forward to IT

What our script does, where your data goes and who can see it.

Each claim here describes behaviour your IT team can check in a browser, or that we’ll show them on a call. If something they need isn’t on this page, ask us rather than assume.

security@glassleaf.ai

Every change to this page is logged on Sources.

At a glance

The script: One async file. No cookies. Talks only to app.glassleaf.ai and our file storage.
Residency: Stored in the United States.
Training: Your manuals and your customers’ questions never train models.
Incidents: Owners told within 72 hours of a confirmed incident.

What the script does on your page

One script tag, loaded async. Everything below is visible in your browser’s developer tools on any page that runs it.

The whole install · sample for Aldous Home

<script src="https://app.glassleaf.ai/w.js"
        data-key="wk_live_7Hq2Xc9Lm4Rt8Vb3Nd6Kp1Zw" async></script>

The widget key is public by design: it sits in your page source. What protects it is your list of allowed domains, not secrecy.

It will

Load one file, w.js, without blocking your page.
Check the widget key against your allowed domains first.
Draw the widget in its own shadow root, apart from your styles.
Read one thing from your page: the font family.
Send the question, product and page language to app.glassleaf.ai.
Keep the open conversation in sessionStorage until the tab closes.

It won’t

Set cookies of any kind.
Read your page’s text, forms or other scripts.
Load fonts, analytics or ads from anywhere else.
Fingerprint visitors or follow them across sites.
Ask for a name or email, unless the visitor chooses to contact your team.
Run on a domain you haven’t allowed. Visitors see your contacts; developers see why in the console.

What your network tab shows

support.aldoushome.com · filtered to Glassleaf and its file storage

Request	Domain	Type	When
w.js	app.glassleaf.ai	script	Page load, async
config?product=br-200	app.glassleaf.ai	fetch	Page load
content	app.glassleaf.ai	fetch	Visitor opens Help
chat	app.glassleaf.ai	fetch, POST	Visitor sends a question
interaction	app.glassleaf.ai	fetch, POST	Visitor opens a guide or rates an answer
page-14.png	lftyojuuhgastersihyv.supabase.co	image	Visitor opens page 14
brio-2-owners-manual.pdf	lftyojuuhgastersihyv.supabase.co	document	Download the manual (PDF)

7 requests · 0 cookies set · 0 requests to other domains

If you use a Content Security Policy

script-src  https://app.glassleaf.ai;
connect-src https://app.glassleaf.ai;
img-src     https://lftyojuuhgastersihyv.supabase.co;

No 'unsafe-inline' or 'unsafe-eval' needed. Your developers find the lines for your own snippet in the dashboard under Widget › Install.

Where your data goes

Two paths: your customers asking questions, and your team preparing content. Everything inside the dashed line stays in the United States.

Glassleaf

Visitor’s browserOn support.aldoushome.com, running w.js

Widget APIapp.glassleaf.ai. Answers come only from your published content.

AI model providerSubprocessor. Writes drafts and answers.

Your organization’s data, encryptedManuals, drafts, questions, audit log

Email providerSubprocessor · email

Your teamSigned in as Owner, Admin, Editor or Viewer

Dashboard and processingapp.glassleaf.ai. Reads every PDF page and drafts content for your review.

Your endpointsWebhooks you add in Settings

Question, product, page language, widget keyAnswer, page citations, safety noticesQuestion and matching manual passagesNo visitor identifiersReads published content, logs questionsTeam names and emailsSaves drafts, releasesManual PDFs, edits, approvalsDrafts, insights, audit logEvent type and IDs, signedOnly to endpoints you add

Your customers asking

Visitor’s browserOn support.aldoushome.com, running w.js

Question, product, page language, widget keyAnswer, page citations, safety notices

Glassleaf

Widget APIAnswers come only from your published content.

Reads published content, logs questions

Your organization’s data, encryptedManuals, drafts, questions, audit log

Question and matching manual passagesNo visitor identifiers

AI model providerSubprocessor. Writes drafts and answers.

Your team preparing content

Your teamSigned in as Owner, Admin, Editor or Viewer

Manual PDFs, edits, approvalsDrafts, insights, audit log

Glassleaf

Dashboard and processingReads every PDF page and drafts content for your review.

Saves drafts, releases

Your organization’s data, encryptedManuals, drafts, questions, audit log

Team names and emails

Email providerSubprocessor · email

Event type and IDs, signedOnly to endpoints you add

Your endpointsWebhooks you add in Settings

Always onOnly if you add a webhookGlassleaf’s systemsSubprocessorPublished files are also cached at CDN edges worldwide.

Subprocessors

The current list of subprocessors is available on request: the companies that process customer data for us, what each one receives and where.

Ask for the subprocessor list

Residency and retention

You choose where your data lives when you create the organization: the United States. Manuals, drafts, questions, logs and backups stay there.

Manual PDFs and page images: Until you delete them

Hosting regions and the retention periods for questions, logs and backups are available on request from security@glassleaf.ai.

Export everything or delete the organization in Settings › Data and privacy.

Custom retention for questions, on Industrial Coming next

Encryption and AI

In transit: HTTPS only. All traffic is served over TLS.
At rest: Encrypted in our providers’ storage layers.
Webhooks: Every payload is signed, so you can check it came from us.
Model training: Your manuals and your customers’ questions never train models, ours or our providers’.

Audits and assurance

Questionnaires: CAIQ, SIG Lite or your own.

If a certification isn’t on this page, we don’t hold it. We’d rather you hear that here than in a questionnaire.

Ask for our security documentation

Who can see your data

Your team: Owner, Admin, Editor or Viewer. Safety approver is a separate permission for safety notices.
Sign-in: Email and password, or Google, with two-step verification.SAML SSO, on Scale Coming next
Glassleaf staff: Access to production data is limited to engineers with an operational need.
Widget keys: Separate live and test keys. The key travels in a request header, never in a web address. Allowed domains stay editable, and you can rotate a key at any time.

Incident policy

Tell youOwners emailed within 72 hours of confirming an incident that affects your data.

If our API is down, the widget still opens with your support contacts and the manual PDF.

Contact security

Questions and questionnaires: security@glassleaf.ai
Report a vulnerability: Same address.
Personal data requests: See the Privacy page.

Bring your IT lead to the pilot call. We’ll walk through this page on your own support site.

Book a pilot Start free