Questions & answers
The things developers, security reviewers and procurement actually ask. If your question isn't here, ask it — we'll answer, and it'll probably end up on this page.
Product
What does Sqwig actually do?
It's a drop-in rich text box with a Word-style formatting toolbar and dictionary spellcheck built in — red wavy underlines, a suggestion popover at the word, add-to-dictionary. It handles paste from Word and Google Docs, and it works on phones.
What doesn't it do?
Deliberately narrow in v1: no real-time collaboration, no table authoring UI, no grammar or AI rewriting, no image hosting. Pasted tables render and their cells are editable, but there's no table builder. If you need a 300-feature editor, Sqwig isn't it — that's the point.
Which frameworks does it work with?
@sqwig/core is framework-agnostic and works anywhere you have a DOM. @sqwig/react is a thin wrapper with no logic of its own. Angular, ASP.NET and Blazor integrations are documented in the developer docs, and there are working examples in the repository.
Does it work on mobile?
Yes. It's tested on iOS Safari and Android Chrome. Native autocorrect is suppressed so you don't get two sets of underlines, and the keyboard doesn't cover the editor at small screen sizes.
How big is it, and how fast is the first spellcheck?
The dictionary is split so you download about 381KB over the wire for the core word list. The spellcheck engine runs in a Web Worker, so it doesn't block your page while it loads. On a 4G connection the first underline typically appears within about two seconds.
Does it work under a strict Content-Security-Policy?
Yes. The component needs wasm-unsafe-eval for the spellcheck engine and a worker source — no unsafe-inline, no unsafe-eval, no remote hosts. Exact directives are in the CSP section of the docs.
What happens if the dictionary fails to load?
You get a working text box without squiggles. Spellcheck is non-blocking by design — a slow network or a blocked asset degrades the feature, not the editor.
Privacy & data
What does the component transmit to Sqwig?
Nothing. Not on load, not while typing. Spellcheck runs against a dictionary downloaded with the component and executes on the device. License keys are signed tokens verified offline, in code — there is no license server and no phone-home.
You can confirm it yourself: open your browser's network tab on our homepage, where the editor is the shipped component, and type. Use a clean profile or an incognito window — browser extensions inject their own requests into every page.
Where is our data stored?
Your users' text is never sent to us, so there is nothing of theirs to store. The only personal data we hold is your own purchase and correspondence data — name, email, and the application domain your key is issued for — processed in the United States. Details in the privacy policy.
Who are your subprocessors?
Cloudflare (hosting) and Stripe (payments, as merchant of record). Neither is in the path of your users' text, because nothing about the component reaches a network.
Will you sign a DPA?
We'll provide a signed attestation instead, and for most reviewers it closes the item faster than a DPA would:
If your process requires a countersigned DPA regardless, email [email protected] and we'll work it out.
Do you use cookies or analytics?
No tracking cookies. We may use privacy-preserving analytics on the marketing site; the component itself reports nothing. See the privacy policy.
Security
How is the editor's output protected against XSS?
Everything the editor emits passes through a single whitelist serializer — an allowlist, not a blocklist. Only the tags, attributes and styles in the published output contract survive; <script>, <style>, <iframe>, event-handler attributes and unknown elements do not survive it, and href values are scheme-checked, so javascript: and data: URLs are rejected. Pasted content goes through the same filter on the way in. Detail: the security model in the docs.
Do we still need to sanitize on our side?
Yes. Sqwig sanitizes its own markup, not the meaning of your users' text — a code block holding a SQL snippet is stored verbatim, because that's legitimate writing. Client-side filtering shouldn't be anyone's only boundary, ours included: re-sanitize server-side before stored HTML is rendered again, and set a strict CSP.
Do you have SOC 2 or ISO 27001?
No. A SOC 2 report audits a service organization's controls over the customer data it processes, and Sqwig processes none — the component transmits no user content and we operate no service in the data path. There is no processing environment for an auditor to examine.
What are the runtime dependencies?
Two: @noble/ed25519 and @noble/hashes, audited cryptography libraries used for offline license verification. Everything else in the repository is build and test tooling that never reaches your bundle.
How do we report a vulnerability?
Email [email protected] with the package version and a minimal proof of concept. We'll act on it as quickly as we can.
Licensing
What counts as one application?
A distinct product or service, identified by its primary domain. Staging, development and test environments of a licensed application don't count as extra applications, and unlimited developers can work with it under any plan.
Is there an account to create?
No. The free tier is one line of configuration — license: "free" — and paid keys arrive by email. There is no portal, no password, and nothing to log into.
What is the "Powered by Sqwig" badge?
A small attribution in the editor's footer on the free tier. Paid plans remove it. If you're running without any licence choice at all it reads "Powered by Sqwig · unlicensed" until you either set license: "free" or add a purchased key — the editor works fully either way.
Can we use it inside an Electron or Capacitor app?
It runs, but packaged shells — Electron, Capacitor, Cordova, Ionic, browser extensions — aren't a licensed environment: Sqwig runs there on the free tier with the badge, and a paid key won't remove it. Building one? Tell us at [email protected] — we want to hear about it.
What happens if we stop renewing?
Your application keeps working — all of it. A key covers the term you bought; after it ends the key stops removing the badge, and the component returns to the free tier. Nothing is disabled, degraded or switched off remotely, and there's no license server that could do so. You also stop receiving new versions, fixes and support until you renew.
Does the licence check reach the network?
No. Keys are Ed25519-signed tokens verified in code on the device. We don't learn that your application is running, how often, or by whom.
Pricing
Do you charge per developer or per seat?
No. Pricing is per application. Five developers or five hundred, the price is the same.
Do you meter usage?
No — no "editor loads", no per-check counters, no overage line because your product grew. Spellcheck runs on your users' devices, so the millionth check costs us what the first one did: nothing.
Is spellcheck an add-on?
No. It's the product. There's no partner integration to buy and no per-word pricing.
Do you offer discounts, purchase orders or Net-30?
Ask. Email [email protected] and tell us what you need — we'd rather have the conversation than lose the deal to a form.
What does support include?
Every paid plan includes support, in the price rather than as a separate invoice. Starter gets email support with a first-response target of five business days; Enterprise gets priority support and a named contact, targeting three. Those are response targets, not resolution guarantees. The free tier is self-serve — the documentation is public.
The company
Who is behind Sqwig?
Learn Wise Solutions LLC, a Pennsylvania limited liability company. That's the entity you contract with.