Content Security Policy

If the survey page uses CSP, allow the Ramon embed origin in script-src and the collector API origin in connect-src.

Content-Security-Policy:
  script-src 'self' https://embed.getramon.com;
  connect-src 'self' https://api.getramon.com;

Use the origins returned during provisioning if your deployment uses custom production or staging endpoints. The browser never needs the private organization integration key, so it must not appear in CSP sources, markup, or client logs.