Private by default: the grid never phones home
At some point before a third-party component ships in your product, somebody asks the question that stops the deal or clears it: what does this thing send, and where does it go. A UI dependency that sits over your customers’ data and opens a connection you did not ask for is a finding, and a finding is a meeting, and the meeting is the one where a component gets removed.
Lattice Grid is built so that the answer is short. It sends nothing anywhere. The grid talks to your data and to nothing else.
The licence check happens in your browser
Most licensed software proves it is paid for by asking a server, which means it opens a connection to the vendor, on a schedule, carrying something about you: the key, the domain, sometimes more. That connection is the finding.
Lattice Grid does not have one. A licence is a signed token, and the grid verifies that signature in the browser against a public key built into the product, using the cryptography the platform already ships. Nothing about the key, the domain, or your data leaves the page to do it. There is no licence server to reach, no activation call to make, and no check-in on a timer. Pull the network cable and the grid behaves exactly the same, because the validation never needed the network in the first place.
That has a practical consequence beyond the security review. The grid runs inside an air-gapped network, behind a strict egress policy, or on a machine that has never seen the internet, and it works the first time, with no allow-list entry to request and no proxy exception to argue for.
No telemetry, ever
There is no analytics in the grid. It does not count how many rows you load, which features you use, how often it runs, or anything else. There is no usage signal because there is no code that gathers one. This is not a setting you switch off. It was never there to switch.
When something goes wrong and you want to send us a diagnostic bundle, that bundle is assembled on your machine, you can read every byte of it before it moves, and it goes nowhere unless you decide to send it. Support is something you start, not something that happens to you in the background.
The only calls go to your own servers
The grid does make network requests, and it is worth being exact about which ones. When you point it at a REST, GraphQL or OData endpoint, it calls that endpoint. That is a server you chose, on infrastructure you control, answering to an address you configured. There is no path in the grid that routes any of it through us, aggregates it, or copies it somewhere on the way. Your data goes from your source to your user’s browser, and we are not on the route.
So the full network picture is one line: the grid talks to the data sources you give it, and to no one else. Not to us, not to a licence authority, not to an analytics collector.
Why this is unusual
Plenty of components in this category do the opposite as a matter of course. They call home to check a licence, they ship an analytics SDK that reports usage by default, or they proxy your data through a hosted service that becomes a second place your customers’ records live. Each of those is a line item in a security review and a question you have to answer for the life of the product.
Private by default means there is nothing to answer. The grid does its job in the browser, keeps your data on the path you designed for it, and tells no one you are running it.
Read how licensing works and put the grid in front of your security team. The shortest audit is the one where the answer is nothing.