First/Third Party Connections

Use this table as a quick network dependency inventory for the Web SDK ecosystem. It identifies each external connection the code may make, explains why it is used, shows whether that connection is mandatory or conditional, and classifies it as first-party (Incode-owned domains) or third-party (vendor/external services). This helps with security/privacy reviews, vendor risk assessments, compliance documentation, and environment hardening by making it clear which integrations are required versus optional.

ConnectionDescriptionParty
cdn.incodesmile.comHosts SDK WASM kit, FFmpeg assets, and translation fallback assets.First-party
sdk.incode.comServes SDK tutorial/static assets.First-party
fingerprint.incodesmile.comFingerprintJS Pro endpoint + loader host.First-party
demo-aps.incodesmile.comDarwinium profiling script host.First-party
incode-production.firebaseapp.comFirebase app/auth domain used by raffle integration.First-party
incode-production.firebaseio.comFirebase Realtime DB endpoint used by raffle integration.First-party
api.i18nexus.comPrimary translations API for localization files.Third-party
cdnjs.cloudflare.comServes PDF.js worker.Third-party
cdn.jsdelivr.netServes Lottie player script.Third-party
ingest.us.sentry.ioSentry error/telemetry ingestion.Third-party
api.ipify.orgPublic IP lookup for fingerprint enrichment.Third-party
api.sardine.aiSardine risk SDK loader (production).Third-party
api.sandbox.sardine.aiSardine risk SDK loader (sandbox).Third-party
cdn.belvo.ioBelvo widget script host.Third-party
static.opentok.comOpenTok browser SDK script host.Third-party
featureassets.orgExternal asset host observed in network activity, not directly referenced. Used by StatsigThird-party
prodregistryv2.org
External asset host observed in network activity, not directly referenced. Used by StatsigThird-party
static.opentok.comOpenTok browser SDK script loaded for conferencing/video functionality.Third-party