> ## Documentation Index
> Fetch the complete documentation index at: https://docs.heretic.quest/llms.txt
> Use this file to discover all available pages before exploring further.

# Heretic FAQ: Integration, Verdicts, Privacy, and Access

> Answers to common questions about Heretic's measurement approach, integration, verdict interpretation, privacy, and early access program.

Below you'll find answers to the questions that come up most often when teams are evaluating Heretic, integrating the collector, or interpreting verdicts in production. If your question isn't covered here, email [hello@heretic.quest](mailto:hello@heretic.quest).

<AccordionGroup>
  <Accordion title="How is Heretic different from a WAF or bot detection score?">
    A WAF fires rules against request patterns and a bot detection score gives you a probability that you then threshold yourself. Both approaches put the interpretation burden on you: you decide what score is "high enough" to block, and you tune that threshold as adversaries adapt.

    Heretic works differently. It measures physical and cryptographic properties of the connection — round-trip timing against the speed-of-light floor, TCP SYN fingerprint against declared OS, TLS group negotiation against declared browser — and returns a **verdict with attached evidence**, not a score. The verdict is one of five values: `contradicted`, `refused`, `disputed`, `uncontradicted`, or `insufficient`. Each is backed by the specific signals that produced it, so you know *why* the verdict was reached, not just *what* it was.

    Because Heretic is physics-based rather than behavioural-AI-based, it does not need a training corpus of "known bad" sessions, it does not drift as adversaries change their behavioural patterns, and it does not require you to pick or maintain a threshold. A contradiction either exists in the physics or it does not.
  </Accordion>

  <Accordion title="Does Heretic require changes to my DNS or CDN?">
    No. Heretic runs on your origin and operates entirely out of band. There are no reverse-proxy tollbooths in the request path, no DNS handovers to a third-party infrastructure, and no changes required to your CDN configuration.

    The `@heretic-hq/collector` script loads client-side on your page and sends its measurements directly to the Heretic edge (`probe.heretic.quest`). Your server calls the `explain` endpoint after receiving a session ID from the collector. Both of those interactions are additive — they do not modify how your existing traffic flows.
  </Accordion>

  <Accordion title="What does 'uncontradicted' mean? Is the session safe?">
    `uncontradicted` means that Heretic did not detect a contradiction between the session's measured properties and its declared identity. It does **not** mean the session is clean, safe, or human. It means that all evidence families Heretic was able to measure aligned with the declared claims — there was nothing to contradict.

    Think of it like an alibi that checked out: the witness accounts were consistent, but you haven't proven innocence, only the absence of a detected lie. A sophisticated adversary who spoofs every measurable surface consistently will receive an `uncontradicted` verdict. Your policy should treat `uncontradicted` as "no evidence of tampering found" rather than "verified legitimate."

    For comparison: `contradicted` means at least one signal found a direct conflict between measurement and declaration; `refused` means the session declined to provide evidence in a way that is itself suspicious; `disputed` means signals point in different directions across families; `insufficient` means not enough evidence was collected to reach any conclusion.
  </Accordion>

  <Accordion title="Why does the collector need to run client-side JavaScript?">
    Heretic's six evidence families split across two measurement modes.

    The **passive wire signals** — network geometry, transport stack, and TLS construction — are read server-side, directly off the TCP/TLS/HTTP/2 connection as it arrives at the edge. No JavaScript is required for those families.

    The **active measurement signals** — compute, render, and the declared-values harvest — require code running inside the browser. CPU parallelism workloads, GPU shader outputs, canvas rasterisation, audio synthesis, and the `navigator`/`screen`/`userAgentData` surfaces can only be measured or read from inside the page context. That is what the `@heretic-hq/collector` script does.

    You need both halves to get six-family coverage. A session that skips the collector has only three families available, which reduces the maximum achievable verdict confidence and leaves the compute and render families silent.
  </Accordion>

  <Accordion title="Can I turn off device fingerprinting?">
    Yes. Set `render: false` in the collector configuration:

    ```js theme={null}
    import { createCollector } from "@heretic-hq/collector";

    const collector = createCollector({
      key: "YOUR_SITE_KEY",
      render: false,
    });
    ```

    This disables the entire render family — canvas measurement, audio measurement, and the `identity.same-origin-cluster` render clustering signal. All other evidence families continue to operate: network geometry, transport stack, TLS construction, compute, and declared values are unaffected.

    The render family is the only family that compares one session against others on your origin. If your deployment context or jurisdiction makes that comparison problematic, `render: false` removes it cleanly without degrading the rest of the measurement.
  </Accordion>

  <Accordion title="How quickly do sessions expire?">
    Session records live in edge memory for **15 minutes** from the moment the session is created. After that window, the record is evicted and the session ID can no longer be resolved by the `explain` endpoint.

    Call the `explain` endpoint promptly after the collector resolves its session ID — the typical pattern is to send the session ID to your server in the same request that submits a form or triggers a sensitive action, then call `explain` server-side before processing that action. Do not queue session IDs for batch resolution: batching against a 15-minute window is fragile in production.

    The compact verdict projection (verdict + signals + network classification) is written to the dashboard store during the same 15-minute window and is retained there for 90 days, so you can review historical verdicts after the edge record has expired.
  </Accordion>

  <Accordion title="What happens if the session has insufficient evidence?">
    If Heretic cannot collect enough signal data to reach a conclusion, the verdict is `insufficient`. This is not the same as `contradicted` — it means Heretic found no contradiction, but also did not gather enough evidence across families to be confident in any verdict direction.

    Do not block sessions on `insufficient` alone. Some legitimate environments produce `insufficient` verdicts by design: virtual machines often suppress or abstract hardware signals, headless environments may lack GPU and audio contexts, and heavily privacy-hardened browsers may reduce the fidelity of declared-value surfaces. Blocking `insufficient` broadly will catch adversaries who deliberately suppress evidence, but it will also catch a meaningful slice of legitimate traffic.

    The recommended approach is to use `insufficient` as a signal for stepped-up friction — a CAPTCHA, an additional authentication factor, or a manual review queue — rather than an outright block. Reserve `contradicted` and `refused` for hard enforcement.
  </Accordion>

  <Accordion title="How do I get access during early access?">
    Request access at **[heretic.quest/#access](https://heretic.quest/#access)**. Approval grants you an API key on the **apostate** tier, which includes the full signal catalogue, the `explain` endpoint, and the live bare-metal Warsaw edge — at no cost.

    There are no feature restrictions during early access. You are integrating against the same signal set and the same edge infrastructure that paid tiers will use. The `@heretic-hq/collector` npm package is available immediately after your key is issued.

    If you need dedicated edges, custom signal co-design, or an enterprise agreement, email [hello@heretic.quest](mailto:hello@heretic.quest) to start an inquisition-tier conversation.
  </Accordion>
</AccordionGroup>


## Related topics

- [Enforce Traffic Policy Using Heretic Verdicts and Signals](/integration/policy-enforcement.md)
- [Install and Configure the Heretic Collector for Your Site](/integration/collector.md)
- [Heretic Privacy: Data Collection, Retention, and Deletion](/reference/privacy.md)
- [Heretic Quick Start: Collect Sessions and Read Verdicts](/quickstart.md)
- [Heretic Pricing: Apostate, Heretic, and Inquisition Tiers](/reference/pricing.md)