What a Session Records
A session is one visit that ran the collector. Heretic records three categories of information for each session.Off the connection
Off the connection
Heretic reads your visitor’s TCP options, TLS ClientHello, and HTTP/2 framing directly off the wire — none of these values are forgeable by page-level code. The edge also sees the connecting IP address and derives the network it belongs to: autonomous system (ASN), country, and a coarse network classification (datacenter, residential, and so on).
Measured on the machine
Measured on the machine
Outputs of work the hardware actually performed: compute · GPU · parallel · frames · microarch · canvas · audio. These are the measurements a verdict leans on most heavily, because a client cannot simply assert them — they are the result of real execution.
Declared by the browser
Declared by the browser
What the browser reports about itself: navigator · screen · intl · userAgentData · webgl · declared surface. Heretic reads these only as claims to check against the measured values, never as facts on their own.High-entropy surface values — font lists, plugin enumerations, and similar — are stored as their shape (counts, families, coarse buckets) by default. A site can opt into raw values, but shape-only is the default.
Where It Lives
1
Edge memory — 15 minutes
The full session record (every measurement, the connecting IP, the deep evidence) lives in the edge node’s memory for 15 minutes after collection. During this window, the explain endpoint reads directly from this in-memory store for the lowest possible latency.
2
Append-only edge log — operator-set window
After 15 minutes, the record moves to an append-only log on that edge node. This log is the source of truth for the raw measurement data. An operator-set retention window governs how long records persist here; past the window, records are dropped automatically. You cannot query this log from the dashboard.
3
Dashboard store — 90 days
A compact projection of each verdict is copied to Heretic’s control-plane database and associated with your account. This projection contains: the verdict outcome, the signals behind it, the network classification, and timestamps. It does not contain the raw connecting IP address. Projected verdicts are swept after 90 days. This is what the dashboard verdict history and the verdict read API serve.
What Is Not Stored
Heretic does not set advertising identifiers. The collector reads no cookies and writes none. The only thing written to the visitor’s browser storage is a short-lived routing note — approximately 15 minutes — that records which edge node answered the session, so a follow-up call routes correctly. That note expires automatically; nothing else persists in the browser.If you disable device fingerprinting with
render: false in the collector, the render-clustering signal family is excluded entirely. All other measurement families — network geometry, transport stack, locale, hardware compute — continue to run. See the collector docs for configuration options.Deleting Records
You can delete a site’s verdicts from the dashboard store at any time.- Go to heretic.quest/dashboard/keys.
- Locate the site whose records you want to remove.
- Select the delete option for that site’s verdicts.
What the Deletion Log Contains
The deletion log is separate from the verdict data — removing verdicts does not remove the audit entry for that removal.