What a session records
Off the connection
Heretic reads the following passively from the wire at the edge, before any JavaScript runs:- TCP options — SYN window size, scaling factor, SACK, timestamps, and option ordering used to construct a transport-stack fingerprint
- TLS ClientHello — cipher suite list, extension ordering, supported groups, and ALPN to construct a
tls-constructionfingerprint - HTTP/2 framing — SETTINGS frame values and stream ordering
- Connecting IP — used for RTT geometry; not stored in the dashboard (see Where it lives)
- ASN and country — derived from the connecting IP at the edge; stored as network classification
- Network classification — residential, datacenter, proxy, or mobile, derived from the ASN
Measured on the machine
The@heretic-hq/collector script runs active measurements in the browser and sends the results to the edge:
- Compute — CPU parallelism workload, microarchitecture inference, and clock resolution
- GPU — shader output hashes used to detect GPU class mismatches
- Parallel timing — concurrent task throughput versus declared core count
- Frame timing — rAF cadence and compositor behaviour
- Canvas fingerprint — rasterisation output used for render clustering (disable with
render: false) - Audio fingerprint — OfflineAudioContext output used for render clustering (disable with
render: false)
Declared by the browser
The collector reads the following browser-declared surfaces. Heretic treats every value here as a claim to be tested, never as a ground-truth fact:navigatorproperties —userAgent,platform,hardwareConcurrency,deviceMemory,language,languagesscreenproperties —width,height,colorDepth,pixelRatioIntl— resolved locale and timezonenavigator.userAgentData— brand list, mobile flag, platform string- WebGL renderer and vendor strings
What is NOT recorded
Heretic is intentionally narrow in what it stores. The following are explicitly out of scope:
- No advertising IDs — Heretic does not read, store, or transmit IDFA, GAID, or any advertising identifier
- No cookies — the collector does not set or read cookies
- No persistent browser storage — any browser-side session state is short-lived (approximately 15 minutes) and scoped to the edge session
- High-entropy surface values are stored as shape, not raw value — canvas pixel buffers, audio sample arrays, and GPU shader outputs are reduced to counts, hashes, or bucket classifications before leaving the edge; the raw values are never written to the dashboard store
Where it lives and for how long
Heretic has three storage layers with distinct retention windows.1
Edge memory
The full session record — including the connecting IP and all raw measurements — lives in memory on the edge node that handled the connection. It is held for 15 minutes from the time the session was created. After 15 minutes the record is evicted. This window is why you should call the
explain endpoint promptly after the collector returns a session ID.2
Edge log
An append-only structured log is written on each edge node. The retention window is set by the edge operator. The connecting IP is present in this log.
3
Dashboard store
The dashboard persists a compact verdict projection for each session: verdict, signals fired, network classification (ASN + country), and timestamps. The raw connecting IP is not stored in the dashboard. Dashboard records are swept after 90 days.
Deleting records
You can delete all session records associated with a site key from the Keys page in the dashboard. Deletion is logged with a full audit trail so you have a record of when the deletion was requested and confirmed. The edge log clears on its own schedule — deletion from the dashboard does not purge the edge log ahead of its configured retention window. For data requests that go beyond the self-serve deletion flow, email hello@heretic.quest with your site key and the nature of the request.Device fingerprinting
Theidentity.same-origin-cluster signal is produced by the render family. It clusters a device’s canvas and audio fingerprint against other sessions observed on the same origin to detect cases where multiple sessions share an identical rendering environment. This is the only signal that compares one session against others.
If your use case requires you to disable this signal — for example, because your users operate in a jurisdiction with strict fingerprinting rules — set render: false in the collector configuration:
render: false removes the entire render family from the session. All other evidence families — network geometry, transport stack, TLS construction, compute, and declared — continue to operate normally.