Compliance

The short answer

The Granularity core declares 0 runtime dependencies. That is not a turn of phrase and not a rounding: in the manifest of the installed 1.1.1 package the dependencies section is empty, and a dependency audit on your side comes down to a single package.

The portal itself is static HTML, CSS and fonts. Not one request goes to a third-party host — not for a font, not for a stylesheet, not for analytics. The full composition of what it is built from is one request away in machine-readable form — CycloneDX.

What reaches the browser

The difference between "a dependency of the project" and "code on the user’s device" matters here, and nearly everything in the list further down is the former. What reaches the device is this.

• The Inter typeface — SIL Open Font License 1.1. 3 subsets are served: inter-cyrillic.woff2, inter-latin-ext.woff2, inter-latin.woff2. A further 4 files are read by the Open Graph card generator; they never leave the build. A copy of the licence sits in the repository next to the font, and a gate watches its fingerprint: replacing the font fails the build.
• The lucide icons — ISC. The @iconify-json/lucide package is build-time, but its data is baked into the CSS as masks — that is, it does reach the user and falls under its own licence. There is not a single separate request for an icon.
• The JavaScript of the islands — Vue and the Granularity components. A prose page loads not a byte: script appears where there is a live demo, a playground or the search.
• The search index — Pagefind, MIT. The index and its WebAssembly are served from the same origin and load only on the user’s request.

Two third-party hosts, and both are named

The claim is checkable, and it is checked: a build gate walks every page served and every stylesheet and requires that every loadable resource — script, style, font, image, frame — come from the site’s own origin. A link to somebody’s CDN appearing there fails the build instead of surviving unnoticed until an audit.

The exceptions are named, and there are two: cloud.umami.is and static.cloudflareinsights.com. Both are cookie-less counters — the first ours, the second injected by the host. They receive the address of the page opened and nothing that could identify the visitor: no cookie, no identifier, no fingerprint. The security policy allows these hosts and only these, and a gate fails the build on any origin missing from the declaration — privacy.

One caveat, and it is named here rather than hidden in a gate exception. The GrFilePreview demo shows the "image failed to load" state and uses an address in the .invalid domain for it. Such names are reserved by RFC 2606 and never resolve anywhere — that is their whole purpose — so it does not become a request to a third-party host and sends no data anywhere.

What the portal itself is built from

The closure of the portal’s production dependencies — 410 packages under 14 licences, 30 of them direct. The tree installed on disk is read rather than the list in the manifest: what matters in a licence registry is what actually arrived, transitive included, and the version comes from there too — a "^0.41.0" range is a promise, not a version.

Almost everything in this list is build tooling. It turns sources into static files and never reaches a browser. Do not read the table as "four hundred packages reach the user": not one of them does.

The SEE LICENSE IN LICENSE row is the Granularity packages themselves: npm manifests have no identifier for such a licence, and it lives in the file. The breakdown is on the licensing page. Licensing.

SBOM and machine-readable answers

• /api/v1/sbom.json — CycloneDX 1.6 with a purl for every package.
• /api/v1/licenses.json — the same delivery as a licence summary.

The boundary is stated plainly, because blurring it would be convenient and therefore dishonest: this is the composition of the portal. A full SBOM for each package of the library is assembled in its own release process, and passing one off as the other is the kind of inaccuracy a corporate review does not forgive.

Rights to the materials of this site

The row about code examples matters practically. Without an explicit permission, copying an example into your project formally inherits the library’s licence with all of its clause — plainly not what the author wants, and that is why it is written down rather than implied.

VPAT and ACR

There is no conformance report (VPAT 2.5 / ACR) yet. It is planned, and it needs more than automated runs: it needs the manual screen-reader verification that has not happened yet. Filling it in from automation alone would mean issuing a document whose very first line is untrue.

What exists instead right now: an accessibility statement with the declared level, the method of verification and — most importantly — a list of the known exceptions. It answers the same questions, only without the form. Accessibility statement.

Ready answers for a vendor questionnaire

Contact

Questions from a legal department and requests for documents — [email protected]. We answer within five working days. For vulnerabilities — security.