Embeddable Widget Due-Diligence Kit

The Charge Port is committed to building and maintaining every embeddable widget to conform to the Web Content Accessibility Guidelines (WCAG) 2.1, Level AA. Accessibility is treated as a build requirement and an ongoing remediation obligation, not a one-time checkbox.

What that means concretely for these widgets

• Labeled controls. Every input, select, and interactive control has a programmatic label, so assistive technology announces what each field is for.
• Announced results. When a calculation updates, the result is exposed through an ARIA live region so screen-reader users hear the new value without having to hunt for it.
• Contrast in both themes. Text and meaningful UI are designed to meet the WCAG AA contrast targets (4.5:1 for normal text, 3:1 for large text and interface components) in both the light and the dark theme.
• Keyboard operability. Every function can be reached and operated with the keyboard alone, in a logical order, with a visible focus indicator — no mouse or touch required.
• Adequate target size. Interactive targets are sized to at least 44 × 44 CSS pixels so they are usable by people with limited dexterity and on touch devices.
• Robust structure. Semantic headings and markup, a sensible reading order, and text that reflows and remains legible when zoomed or resized.

Reporting an accessibility issue

If you or one of your users encounters an accessibility barrier in any Charge Port widget, please contact contact@thechargeport.com. We aim to acknowledge accessibility reports within one business day and to work with you on a remediation path.

The widgets are designed to be privacy-preserving by default. They are built so that a partner can embed them without taking on new obligations for their visitors' personal data.

What we collect from your visitors

• No personal information. The widgets ask for nothing that identifies a person — no name, email address, phone number, login, or account. Calculations run in the visitor's browser against data compiled into the widget.
• No cookies. The widgets set no cookies on the host site's visitors and write nothing to the browser's local or session storage.
• No visitor data stored. No record about the host site's visitors is created or retained. The widgets keep no visitor profiles.

The only telemetry

The widgets are instrumented to emit only anonymous, aggregate usage counts — how often a widget is viewed or interacted with — associated with the partner's license key. These counts are used solely to produce that partner's own usage and engagement reports. No usage event carries anything that identifies an individual visitor.

What we never do

• We do not sell data. Visitor or usage data is never sold.
• We do not share with third parties beyond the single analytics sub-processor that tallies the anonymous usage counts (named in Section 3). No one else receives any data from the widgets.
• No advertising. No visitor data crosses into advertising, ad-targeting, or ad-measurement systems. The widgets carry no advertising and set no advertising identifiers.

The security posture follows from the architecture: because the widgets are static, isolated, and hold no data, most of the risks a vendor review looks for are removed by design rather than mitigated after the fact.

Architecture

Each widget is a static, server-rendered page — pre-built HTML and JavaScript with its data baked in at build time. There is no application server processing visitor input at request time, no database, and no visitor-facing API. It is delivered to your page inside a cross-origin iframe, which the browser isolates from the host page under the same-origin policy: the widget cannot read your page's DOM, cookies, storage, or systems, and your page cannot read the widget's. Hosts may additionally apply the iframe sandbox attribute for defense in depth. Nothing is installed on your site — integration is a single <iframe> tag, plus an optional resize script.

Delivery

HTTPS only, served from a global edge CDN (Vercel). Traffic between the visitor's browser and the widget is encrypted in transit.

Data storage

None. The widgets are stateless — they hold no visitor data at rest because they collect none. There is no data store to breach, export, or misconfigure.

Update model

Data refreshes and fixes are deployed centrally by The Charge Port. Because each widget loads live from our CDN, you always receive the current version automatically. You never patch, update, or maintain anything, and there is no third-party package for you to keep current on your side.

Cancellation

Billing is month-to-month (annual optional). On cancellation the widget keeps functioning through the end of the term you have already paid for. After that it switches to a preview state — still rendered, with a license notice, never a broken or blank section on your page. Removal is deleting one line of HTML; there is no data to migrate or export because none is stored.

Sub-processors

These are the only third parties involved in operating the widgets. No other party receives data.

Security contact & incident response

Report a suspected security issue to contact@thechargeport.com. We commit to acknowledging security reports within one business day and to keeping affected partners informed through resolution.