Agent-written components run in a sandbox
Each custom component runs in a sandboxed frame with its own opaque origin:- It has no network access. A content security policy blocks fetches, connections, external scripts, external images and form submissions.
- It cannot read the viewer’s cookies, the CanvasView session or the page around it.
- Links inside it do not open, and it cannot open pop-ups.
- npm packages it uses are checked, bundled and stored by CanvasView in advance. Viewers receive only the stored copy, and no install script runs.
The data proxy is the only network path
A component or a canvas tool reaches an outside service only through a data source you approved. Tools run on CanvasView’s servers, each isolated, with no network of their own. CanvasView makes each call on their behalf:- The call must stay under the source’s base URL and path prefix, use a method you allowed, and come from a canvas that declares the source. A tool may call only the sources its manifest names.
- CanvasView builds each request from scratch. It sends the source’s secret headers and the content type and accept headers the component set. It never sends the viewer’s cookies, sign-in or IP address. It sends the viewer’s verified email only if you turned that on, and only on canvases that need sign-in.
- The component gets back the status, content type and body. No other response header reaches it.
- Redirects are not followed. Requests and answers are limited in size and time, and rate limited per viewer and per canvas.
Data source secrets are encrypted
Secret header values are encrypted before they are stored. Each encrypted value is bound to its organization, source and header name, so it cannot be used anywhere else. CanvasView never shows a value again after you save it, and never sends one to an agent, a component or a viewer.Keys and secrets
- API keys are shown once. CanvasView stores a hash of each key and a short prefix to recognise it by, not the key.
- A canvas repository token is short-lived, shown once and never stored.
- A connected agent can be disconnected at once on the API keys page.
- A webhook signing secret is shown once and is used only to sign deliveries.
Who can open a canvas
A person can open a canvas when they own it and are still a member of its organization, are an Admin of its organization, are a member and the canvas is shared with the organization, have a verified email on its invite list, or the canvas’s access mode admits them. See Sharing and access.- Access is checked on every request and every live connection, never granted for good.
- When a canvas becomes more restricted, people who no longer qualify are disconnected at once.
- When someone leaves your organization, their access through membership ends, and the keys and connected agents they created are revoked. Access through a canvas’s invite list stays until you remove the address. See Organizations and members.
- A person without access learns nothing about the canvas, not even its title.
Viewers who sign in are shown to the owner
The canvas owner and Admins can see who opened a canvas. People who are signed in are listed by name and verified email. People who open a link canvas without signing in are listed by the name they typed, marked as not verified. A signed-in viewer sees The owner can see that you opened this canvas. on the canvas. See Who opened it.What CanvasView stores
Event log entries, notifications and the access log carry no canvas content.
Analytics
CanvasView uses PostHog for product analytics. The Privacy Policy has the details.- In the browser. Analytics keeps a random identifier in a cookie and in your browser’s storage. Visitors in the EU, the EEA, the UK and Switzerland, and visitors whose country is unknown, are asked first. You can turn it off in Cookie settings, or with Global Privacy Control.
- Session recording. PostHog records what is on screen and what people click. Signed-in people are recorded while analytics is on. People who are not signed in, on a shared canvas or on the website, are recorded only after they accept. A recording of a canvas shows its content, answers and comments. What people type into fields is hidden, components written by an agent show as blank boxes, and sign-in screens and secrets such as a new API key are left out. Turning analytics off stops recording.
- From the servers. CanvasView’s servers send account events, such as an account being approved, a canvas being created and credits being bought. For each tool call your agent makes over MCP they send the tool’s name, whether it failed, how long it took and the names of its arguments, never their values or results. Cookie settings does not change these.