Data and Privacy

The SDK runs in your user’s browser.

File contents stay in the browser

Spreadsheet data, file contents, and anything a person types into the editor never leave the browser. Parsing, validation, column matching, and editing all run on the user’s machine. Your code decides when data goes to your own backend.

These details can change between versions, so check them against the version you have installed.

One network request

The SDK makes one network call to Updog, when the editor opens.

Method and URL	GET https://api.updog.tech/v1/validate
Header we read	X-API-Key, carrying your license key
Header the browser adds	Origin, carrying the domain your app runs on
Body	None

Our server also receives the IP address of whoever opened the editor, because every HTTP request carries one. We use it for rate limiting, at 120 requests a minute per address, and it does not outlive our transient server logs.

Loading a file, editing, validating, and exporting all send nothing.

The call happens on every host

The SDK sends the same request on localhost, on a preview URL, and in production.

When the Origin header matches one of the permitted environments listed in the license, the server returns valid without a database lookup. Permitted environments include localhost, 127.0.0.1, the reserved .local and .test domains, deploy previews such as .vercel.app and .netlify.app, and the cloud IDEs and tunnels named in the same list. Any other domain needs an active license key tied to that domain.

One key in localStorage

After a successful validation the SDK stores a license grant under the key updog_license_grant on your domain. The grant holds a SHA-256 hash of your API key, the domain, and an expiry timestamp. It contains no personal data and nothing about your users.

Our server signs the grant with ECDSA P-256. The SDK ships the matching public key, which can verify a signature but cannot produce one.

Turn the grant off if you want nothing written before your user has consented:

<DataEditor localStorage={{ licenseGrant: false }} />  {/* grant only */}
<DataEditor localStorage={false} />                    {/* all local storage */}

Without the grant every open needs a live network call, and the editor cannot start while our API is unreachable.

What happens when our API is down

A 4xx response clears the cached grant at once, with no grace period, so a revoked key stops working on the next open.

A 5xx response or a network failure falls back to the stored grant. The SDK verifies the signature, the key hash, the domain, and the expiry before it accepts one. Grants last seven days, so a short outage on our side is invisible to your users. A longer outage shows, and editors stop validating until we are back.

Our current status is at status.updog.tech, where we monitor the same validation endpoint the SDK calls.

What ships inside the package

npm installs nine runtime dependencies alongside the React package: @floating-ui/react, @lexical/react, chardet, clsx, lexical, lucide-react, papaparse, react-dropzone, and uuid.

Two more are compiled into the file workers and never appear in your dependency tree. One is write-excel-file, which writes XLSX exports. The other is SheetJS (xlsx, version 0.20.3), which reads XLSX, XLS, XLSB, and ODS files.

SheetJS is distributed as a tarball on cdn.sheetjs.com, outside the npm registry, so we install it from that URL. It does not appear in your lockfile, so npm audit, Dependabot, and Snyk do not scan it.

Full license texts for all eleven packages are in THIRD_PARTY_NOTICES.txt inside the installed package.

How we publish

Both packages reach npm through Trusted Publishing from GitHub Actions, so no long-lived npm token exists in our CI. The published package.json has no scripts field, which means nothing runs on install.

The packages carry no provenance attestation. npm grants an attestation to a public repository, and ours is private.

Check all of this yourself

The whole check takes about five minutes.

1. Open DevTools, go to Network, filter on updog, and open the editor. One request to api.updog.tech appears.
2. Import a large file and edit some cells with that filter still running. Nothing further appears.
3. Open Application, then Local Storage, and look at your own origin. One key, updog_license_grant.
4. Run npm pack @updog/data-editor and extract the tarball. Find the SheetJS version in THIRD_PARTY_NOTICES.txt, then confirm the shipped code carries the same one:

tar -xzf updog-data-editor-*.tgz
grep -o 'version="0\.20\.3"' package/*.js

For how we handle account and billing data on updog.tech, see the privacy policy. To report a vulnerability, see the security policy.