What FingerTrackID is

FingerTrackID is a B2B device intelligence and access risk service for Web products. At the critical moments of your product — a login, a withdrawal request, a trade order — your backend asks FingerTrackID for an assessment and receives, in the same call, an explainable answer: the assessment status, a trust score when there is evidence for one, the observed indicators and a recommendation.

What FingerTrackID does

Collects browser signals through the approved Web SDK, bundled into your frontend and sending collection to a domain that belongs to you (collect.<your-domain>).
Assesses the access at the moment your backend asks, with a versioned policy.
Recommends an action: ALLOW, MONITOR, STEP_UP, REVIEW or BLOCK_RECOMMENDED.
Shows the history in the console, so your team can understand each assessment.

What FingerTrackID does not do

It does not decide or execute anything in your product. It does not block a login, hold a withdrawal, cancel an order or move money. The recommendation reaches your system, and your system decides and acts.
It does not turn a score into a decision. The trust score (trust_score) is an index from 0 to 100 where higher is better, and it is only returned when the assessment is COMPLETED. It is not a probability of fraud and not a reputation of the person.
It does not treat an event as fraud. An assessed access is a fact; fraud is only confirmed by evidence on your side.
It does not recommend blocking on privacy alone. Under FingerTrackID’s managed policy, private browsing, Tor, a proxy, a VPN or a shared device, on their own, never lead to BLOCK_RECOMMENDED. Your company’s own risk rules are the exception. Any rule, including the access context items, can be active, but only your company can activate it. Your administrator chooses each rule’s points, the context rulers and the blocking band, and a BLOCK_RECOMMENDED produced by them is still a recommendation your backend executes. Missing evidence never recommends blocking (recommended action).

Shadow mode

Start your integration in shadow mode (SHADOW): FingerTrackID assesses and recommends, and your team compares the recommendation with the decision your system already makes. Keep your existing decisions during this validation. Production is the deployed environment; shadow mode describes how your application uses recommendations, not a temporary environment or an automatic blocking feature.

Privacy by design

Your backend identifies the person and the account through pseudonymous references that you create. Do not send national ID numbers (such as a CPF), e-mail addresses, phone numbers, names, account numbers or any reversible identifier.
The Web SDK sends canvas, WebGL, audio and font characteristics only as derived values (hashes, a GPU family, counts), never pixels, audio samples or font names. Its code does not read or write cookies, localStorage or sessionStorage; it uses a temporary IndexedDB database only to check for a private window, and deletes it. Continuity between visits uses an HttpOnly cookie on your collection domain, which the browser manages and the script cannot read.
Each customer company’s data is isolated; there is no correlation across customers.

Registration and activation

Each company has its own workspace, applications, members and integration credentials. Registration uses the same onboarding workflow for every company. A completed registration does not by itself enable collection or signed calls: the application also needs its verified domain, installed credential and active policy.

Today the console and the signed assessment API are live in production, in shadow mode: FingerTrackID recommends and your system decides. Web SDK collection is deployed there too, and its end-to-end operation from a customer page is still being measured. See production status.

Next step: how the integration works.