Project settings

Each project has settings that change what identify does with its events. They're set on the dashboard's Settings page, along with the allowed origins, support access and the risk score's weights; the webhook url has its own Webhooks page. Changes apply to new identifications right away; events already stored keep what they got.

Allowed origins

The sites that may identify with the project's public keys, one per line. While the list is empty, identification is accepted from any site; add your sites' origins to lock it down. How they're written and checked, and the error a page from another origin gets, is in Keys and billing › Allowed origins.

Zero trust mode

By default the browser learns its visitorId and whether it was seen before. In zero trust mode identify answers only:

{ "requestId": "1792578564800.yU4Ety" }

A bot then can't tell whether it got a new visitor id, and nothing in the browser can be trusted by mistake: your server reads the event with its secret key, or opens a sealed result. The agent keeps no visitor id in zero trust mode, in localStorage or a cookie, and removes one it stored before; the device is still read and matched on our side.

Data retention

Every event gets an expiry from the project's retention at the moment it's identified, and is removed after that, usually within a day or two. Changing the retention applies to events identified from then on; older events keep the expiry they got. "Indefinitely" keeps events until you erase them through the server API. An event's expiresAt in the server API, and Kept on its page in the dashboard ("Until" a date, or "Until deleted"), show when it goes.

A visitor is kept for the same retention after its last visit, and each visit moves its expiry on. A link between an external ID and a visitor ID or IP expires with the latest event that made it. So the retention is also how far back Related, a visitor's history and search can see; velocity only looks at the last 24 hours. Webhook deliveries are kept for 30 days whatever the retention.

The agent reads the device and stores an id in the browser (_fpvid_ cookie, fp: localStorage entries), so describe device fingerprinting for fraud prevention in your privacy policy, and check whether your visitors' consent rules apply: see Privacy and consent.

Page URLs

The agent sends the page url and the referrer as origin and path, and events keep them as url and referrer; query strings and fragments are never sent or stored, since they can hold personal data, like an email in a reset link. Paths can too, so the project picks how much is kept, for both:

A change applies to events identified from then on.

Sealed results

Each identification also returns the whole event to the browser, encrypted with the project's encryption key, for your server to open without an API call. Turning it on, the format and samples are in Sealed results.

Socket proof

Off by default. Turned on, the agent proves over a WebSocket that a browser is identifying, and any identification without a verified socket gets socket-proof-failed: a wrong challenge, a socket that failed or answered too late, or none at all. Leave it off when some of your visitors sit behind proxies or firewalls that block WebSockets, since their sockets fail too. How it works is in Smart signals › Socket proof.

Risk score weights

Each flag's weight, a whole number from 0 to 20; an empty field keeps the default (the defaults, and the families and their caps, are in Smart signals). A weight above its family's cap still counts in full. Change them when your traffic differs from the defaults' assumptions: raise vpn if VPN users are your fraud, lower incognito to 0 if private windows are normal for your users.

New weights only score events identified after the change. An event's riskScore and riskScoreBreakdown are worked out once, when it's identified, and stored, so older events keep the score they were given everywhere: the API, search, webhooks and the dashboard. When you compare scores across a change, filter by date.

Support access

Our support team can only read a project's events, usage and keys with its consent, read only and for 12 hours at a time: turn it on here, or accept a request from the dashboard's notifications. While support looks, a banner on every page says so, with a button to end it. The project's audit log records support's requests and the pages it opened.

Secrets

Two secrets are shown in full once, when you make them, and only masked after:

Deleting a project

The danger zone at the bottom of Settings deletes the project: its keys and webhook stop at once, so identifications and the server API stop, and it leaves every teammate's project list. Its events and the rest are removed for good after 90 days.

To stop one key without deleting the project, revoke or disable it on the API keys page.