November 2026, 2.6.8: CSP (Content Security Policy) update for the Paradox widget
Updated at October 14th, 2026
Table of Contents
Ahead of the widget release on November 10, 2026, customers with custom Content Security Policies (CSP) who previously whitelisted olivia.paradox.ai must update their connect-src directive to cover *.paradox.ai. This FAQ compiles the questions and answers raised by the Client Success team in the release thread.
CSP configuration is entirely determined and managed by your organization's security policies. Because Paradox has no administrative access to your website's security headers (unless you are on a Paradox owned/managed career site), any CSP updates must be made directly by your IT, Security, or Web Development team.
Why is this update needed?
To ensure API communication and WebSocket connections work without hitting CSP restrictions, please add our domain to your web server or CMS Content Security Policy (CSP) headers:
Widget Endpoint
Timelines:
- November 10th 2026, 2.6.8's release, when the release of the new Widget calling directly to Olivia Backend at api.paradox.ai goes live to PROD and STG
Domains to Whitelist:
-
*.paradox.ai (Includes subdomains such as olivia.paradox.ai and api.paradox.ai)
- Note: If the customer cannot allow for a wildcard *.paradox.ai then the specific CSP directives to include will be the following olivia.paradox.ai, api.paradox.ai, and cdn.olivia.paradox.ai.
Required CSP Directive to Update:
- connect-src — Allows API calls and WebSocket connections.
Example 1: Fine Grained Full Header / JS Configuration Object (Domain + Protocol)
contentSecurityPolicy: {
'default-src': ["'self'"],
'connect-src': [
"'self'",
'https://olivia.paradox.ai',
'https://api.paradox.ai',
'wss://ws.paradox.ai'
],
'script-src': [
"'self'",
'https://olivia.paradox.ai',
'https://cdn.olivia.paradox.ai'
],
'img-src': [
"'self'",
'https://olivia.paradox.ai',
'https://cdn.olivia.paradox.ai'
],
'style-src': [
"'self'",
'https://olivia.paradox.ai',
'https://cdn.olivia.paradox.ai'
]
}Example 2: Allow all from Paradox (Quick, short settings)
contentSecurityPolicy: {
'default-src': ["'self'"],
'connect-src': [
"'self'",
'*.paradox.ai'
],
'script-src': [
"'self'",
'*.paradox.ai'
],
'img-src': [
"'self'",
'*.paradox.ai'
],
'style-src': [
"'self'",
'*.paradox.ai'
]
}Example 3: Fine Grained HTML Meta Tag Implementation
If your site enforces a Content Security Policy (CSP) via an HTML <meta> tag, add our domain to the connect-src directive:
HTML
<meta
http-equiv="Content-Security-Policy"
content="
default-src 'self';
connect-src 'self' https://olivia.paradox.ai https://api.paradox.ai wss://ws.paradox.ai https://ai-paradox-prod-use1-mediaservice.s3.us-east-1.amazonaws.com;
script-src 'self' https://olivia.paradox.ai https://cdn.olivia.paradox.ai;
img-src 'self' https://olivia.paradox.ai https://cdn.olivia.paradox.ai;
style-src 'self' https://olivia.paradox.ai https://cdn.olivia.paradox.ai;
"
>Example 4: HTML Meta Tag Implementation, allow all from Paradox (Quick, short settings)
HTML
<meta
http-equiv="Content-Security-Policy"
content="
default-src 'self';
connect-src 'self' *.paradox.ai;
script-src 'self' *.paradox.ai;
img-src 'self' *.paradox.ai;
style-src 'self' *.paradox.ai;
"
>If you use a CMS or ATS site builder (e.g., SAP SuccessFactors, Workday, Adobe Experience Manager), add *.paradox.ai under your platform's Custom Allowed Domains / Security Settings panel.
Frequently asked questions (FAQ)
Scope: who is affected
Does this change only affect Career Sites customers, or all customers with custom widgets on any site?
All customers who have a widget on their career site will have to make this change. However, for customers with Paradox Career Sites the change will be automatically applied.
If a customer has CSP toggled off, do they need to make any changes?
No. If CSP is off, no changes are needed.
If a widget does not sit on the customer's career site (non-Paradox hosted), is any action needed?
Only the final destination where the widget actually lives needs the update. If the host site's CSP does not block anything, nothing needs to be done. But many sites do block by rule, which is why all clients are being notified to check.
Does this apply if a customer uses an XML feed that redirects candidates to their job list site?
Yes, but it only affects the final destination — the job list site where the widget actually lives.
If a client has a Paradox-hosted career site, does their IT team still need to take action?
No action is needed for clients on Paradox career sites — these have already been updated.
Does this affect clients whose experience does not include a widget living on their actual site?
Confirmed case-by-case: where there is no widget on the site itself, there is no impact.
Does this change only affect Career Sites customers, or all customers with custom widgets on any site?
Accordion Body
Technical details: domains and directives
Why is this change needed, what's the technical background?
The application, previously served entirely from olivia.paradox.ai, has been split into two pieces: the UI (olivia.paradox.ai) and the backend/API (api.paradox.ai). The widget will now call api.paradox.ai instead of olivia.paradox.ai. Sites with strict CSP rules that only allow olivia.paradox.ai specifically will block this new call unless they expand their allowlist.
What are the exact domains customers need to allow if they can't use a wildcard?
- olivia.paradox.ai (connect-src, script-src, style-src, and img-src)
- cdn.olivia.paradox.ai (script-src, style-src, and img-src)
- api.paradox.ai (connect-src)
- ws.paradox.ai (connect-src)
If a customer adds the wildcard *.paradox.ai, does that cover everything?
Yes. *.paradox.ai covers all paradox.ai subdomains, including olivia.paradox.ai, api.paradox.ai, ws.paradox.ai and cdn.olivia.paradox.ai. This is the recommended approach for customers who prefer convenience over a strict, itemized list.
Will cdn.olivia.paradox.ai still be used once the switch to api.paradox.ai happens?
Yes, the other domains will continue to be supported.
Does this update use any WebSocket (wss) connections that need a separate CSP entry?
*.paradox.ai covers WebSocket connections as well, unless the customer wants to use specific schemes — in which case they would need both https://*.paradox.ai and wss://*.paradox.ai listed separately.
What if a site has no connect-src directive at all (e.g. no CSP restriction configured)?
If there is no blocking rule in place, nothing needs to be done.
A customer's site (SAP Career Site) only supports CSP domain allowlisting, not a connect-src override, and already allowlists https://olivia.paradox.ai, wss://ws.paradox.ai, and https://cdn.olivia.paradox.ai. Do they just need to add the new domain?
Yes — add api.paradox.ai to their existing allowlist.
A customer says their platform (SAP) is too restrictive to add individual domains — is there other guidance?
If the customer wants convenience over maintaining a strict list, they can replace their itemized entries with the single wildcard *.paradox.ai.
Does a customer also need to update the CSP on their staging site if the widget is hosted there too?
Yes — the same *.paradox.ai update is recommended for staging site policies, not just production.
Data privacy and security
Will this update install or drop a cookie? Are there data privacy, data processing, or security implications? Will candidate data be transmitted differently?
A temporary configuration cookie is being used strictly to identify impacted accounts. It does not track candidate activity or collect personal data, and it will be removed completely once the rollout is complete. There are no additional implications, and no changes to candidate data.
Release timeline and testing
Will this be released to staging (STG) before it goes live in production, or will STG and PROD go live at the same time?
It will be released in staging first, the same way releases have always been handled, giving customers the chance to test before the November 10, 2026 production release.
- LTS STG - Oct 28th
- STG - Nov 10th
- Production release - Nov 10th
Customer communications
Which customers receive the automated email communications about this change?
Only clients who have registered via the designated HubSpot sign-up form receive the email communications. Teams were asked to confirm their key technical contacts are registered.
Can the standard email be updated to tell franchise customers who don't use a JavaScript widget to disregard it?
Because many franchise customers do use the widget (on Paradox or non-Paradox career sites), it's difficult to reliably identify who can disregard the notice. The team committed to clarifying this guidance in release training and in the final reminder communication, rather than changing the mass email itself.