> ## Documentation Index
> Fetch the complete documentation index at: https://docs.squid-id.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> How Squid ID secures and isolates the SDK on your site: a sandboxed iframe, a domain lock, encrypted transport, and a hardened API.

Squid ID is built to sit on your site without becoming a liability on it. The SDK runs in an isolated sandbox, is locked to the domains you register, and talks to our servers over encrypted, hardened endpoints. This page covers how that works.

## If you're coming from RB2B

Most visitor tools ship a script that runs in the page's own context. Squid ID isolates the work in a sandboxed iframe and locks the SDK to your domains.

<div className="compare">
  <table>
    <thead>
      <tr><th /><th>RB2B</th><th>Squid ID</th></tr>
    </thead>

    <tbody>
      <tr><td>Execution context</td><td>Script in the page context</td><td>Sandboxed iframe, isolated from your page</td></tr>
      <tr><td>Domain lock</td><td>Script tag on any page</td><td>SDK locked to the hostnames you register</td></tr>
      <tr><td>Page-level control</td><td>Limited</td><td>Inclusion or exclusion page rules</td></tr>
      <tr><td>Transport</td><td>HTTPS</td><td>HTTPS with hardened headers and a strict CORS policy</td></tr>
    </tbody>
  </table>
</div>

<p className="why"><strong>Why this matters.</strong> A tag that runs in your page context can read everything on it. Squid ID's iframe can't reach into your page, and your page can't reach into it, so adding Squid ID doesn't widen your attack surface.</p>

## Isolated execution

The SDK does its work inside its own iframe, a separate browsing context from your page. The two communicate only through a narrow `postMessage` channel, with a fixed set of allowed messages.

That boundary cuts both ways:

* The iframe cannot read your page's DOM, your cookies, your local storage, or any other script on the page.
* Your page (and anything else loaded on it) cannot reach into the iframe or its data.

So the identification logic is sealed off from the rest of your site. Nothing on your page can tamper with it, and it can't tamper with anything on your page.

## Locked to your domains

The SDK is served by a per-website key, and that website is locked to the exact hostnames you register on its URL list. The SDK only runs on those origins, so a key lifted onto another domain simply won't work. You can narrow it further with [page rules](/finding-visitors/restrictions#page-rules) to identify on, or skip, specific URLs.

<Info>This domain lock is also the most common reason a freshly installed snippet does not connect. If the page serves on a hostname you didn't register (for example `www.example.com` when you registered `example.com`), add it. See [Managing websites](/account/manage-websites) and [Troubleshooting](/troubleshooting).</Info>

## Encrypted, hardened transport

* <strong>HTTPS everywhere.</strong> All traffic is served over TLS. Plain HTTP requests are rejected.
* <strong>Hardened headers.</strong> Our API sets a strict set of security headers, including a content security policy.
* <strong>Strict CORS.</strong> Cross-origin requests are checked against an allowlist, and requests with a stripped or null origin are refused, which closes a common CSRF vector.

## Authenticated channels

* <strong>Realtime.</strong> The live connection that powers presence and the live feed is gated by a signed token issued per website, so only your authorized SDK can open it.
* <strong>API tokens.</strong> Programmatic access uses read-only Bearer tokens that work on GET endpoints only, scoped to your account. See [API tokens](/account/api-tokens).

## What the SDK collects

The SDK gathers anonymous behavioral signals (page views, referrer, basic device and connection data) and sends them to our servers. Identification and enrichment happen server-side, not in your visitor's browser. How that data is handled, and your responsibilities as the site owner, are covered in [Privacy and compliance](/privacy-compliance).

## Related

* [Privacy and compliance](/privacy-compliance)
* [Performance](/how-it-works/performance)
* [Managing websites](/account/manage-websites)
* [API tokens](/account/api-tokens)