SECURITY
privacy posture for cookieless visitor evidence
Overview
No cookies. No local storage. No client-side identifier that your users need to keep alive.
Fingerprint.dev evaluates request evidence and optional hashed browser evidence, then returns a visitor ID and confidence score. Treat that result as device evidence for your product decisions.
Privacy posture
Browser evidence is hashed before it is sent.
Missing browser capabilities are represented as null, not as fake fallback values.
Raw API keys are not shown again after creation.
Allowed origins are enforced server-side.
Compliance
Signed MSA and custom DPA available on enterprise plans.
EU-only or US-only data residency is configurable on enterprise plans.
API key controls
Create keys from the dashboard and add an origin allowlist for browser usage. Revoke keys immediately when they are no longer needed.
IP allowlisting for API access is available on enterprise plans.
What not to log
Avoid logging request bodies, raw browser evidence, raw API keys, or anything that would let another system reconstruct a user profile.
Log request IDs, visitor IDs, confidence scores, and aggregate status instead.
Use it as evidence
Fingerprint.dev does not authenticate users. Use it alongside your own account, session, rate-limit, and review systems.