Configure telemetry
Make the browser Editor telemetry behavior explicit.
Telemetry is enabled by default. The browser Editor sends one document-open event when each DOCX becomes ready. Configure it when you create the Editor. Set its license identity separately.
Each request body uses this structure:
{
"superdocVersion": "2.10.0",
"browserInfo": {
"userAgent": "Mozilla/5.0 ...",
"currentUrl": "https://app.example.com",
"hostname": "app.example.com",
"screenSize": { "width": 1440, "height": 900 }
},
"metadata": { "application": "contract-review" },
"events": [
{
"timestamp": "2026-08-29T12:00:00.000Z",
"documentId": "document-123",
"documentCreatedAt": "2026-08-01T09:30:00.000Z"
}
]
}superdocVersion, browserInfo, and optional metadata are request-envelope fields. Each item in events contains only timestamp, documentId, and documentCreatedAt. browserInfo.currentUrl contains the page origin. The payload does not include the page path, query string, fragment, or document content.
Choose telemetry behavior
Disable telemetry explicitly when the deployment must not initialize the telemetry integration:
const superdoc = new SuperDoc({
selector: '#editor',
document: '/contract.docx',
telemetry: { enabled: false },
});When telemetry is enabled, endpoint selects the destination and metadata adds application-defined context:
const superdoc = new SuperDoc({
selector: '#editor',
document: '/contract.docx',
telemetry: {
enabled: true,
endpoint: 'https://telemetry.example.com/v1/events',
metadata: {
application: 'contract-review',
environment: 'production',
},
},
});The Editor serializes metadata into the request body. Do not include document text, comments, personal data, credentials, signed URLs, or other sensitive values. Allow the selected endpoint in connect-src. For a cross-origin endpoint, allow the Editor page's origin, the POST method, and the Content-Type and X-License-Key request headers in its CORS policy.
Continue with Secure integration to review every document and metadata boundary.