[{"data":1,"prerenderedAt":168},["ShallowReactive",2],{"doc:\u002Fdocs\u002Fsecurity":3},{"page":4,"toc":156,"updated":167},{"path":5,"title":6,"seoTitle":7,"description":8,"blocks":9},"\u002Fdocs\u002Fsecurity","Security","Security at Fingerly: Keys, Secrets, Regions and Reporting","How Fingerly protects your keys, webhook secrets and visitor data, what stays in your region, what you are responsible for, and how to report a vulnerability.",[10,13,18,26,29,35,38,40,58,62,64,67,72,75,77,80,86,89,94,97,99,102,128,131,133,139,143],{"type":11,"text":12},"p","This page describes how Fingerly is built to protect your integration and your visitors' data. It describes only what Fingerly does today.",{"type":14,"level":15,"text":16,"id":17},"heading",2,"Keys","keys",{"type":19,"items":20},"list",[21,22,23,24,25],"**Stored as keyed hashes.** The secret part of every SDK key, proxy key and management key is stored only as an HMAC-SHA256 hash, under a hashing key that is itself protected by a cloud key management service in the key's region. Fingerly cannot show a key again, so each is shown once, when it is created. Afterwards the dashboard shows only its prefix and last four characters.","**Separated by power.** Public keys can only submit identifications. Secret keys read events and are refused when a request carries a browser `Origin` header; the only exception is a development secret key used from the Try it panel on these docs, which reads development events. Proxy keys only forward identify requests and can never read events. Management keys manage keys, webhook endpoints and risk weights with the permissions of their role, are always refused from browsers, and cannot issue other management keys.","**Bound to origins.** In browsers, a public key is accepted only from origins that exactly match its allowed list, and a key with no allowed origins refuses every browser request.","**Uninformative when refused.** An unknown, revoked, expired or disallowed key receives the same `401`, so a refusal reveals nothing about which keys exist.","**Scoped.** Every key belongs to one organization and one region, and every SDK key and proxy key to one environment. A key sent to another region's API is refused.",{"type":14,"level":15,"text":27,"id":28},"Webhooks","webhooks",{"type":19,"items":30},[31,32,33,34],"**Secrets encrypted at rest.** Each endpoint's signing secret is encrypted with AES-256-GCM and bound to its endpoint, under an encryption key protected by a key management service in your region. The secret is shown once.","**Signed deliveries.** Every delivery carries an HMAC-SHA256 signature over a timestamp and the body, so you can reject forged and replayed requests. Secrets can be rotated with an overlap window. See [webhooks](\u002Fdocs\u002Fwebhooks#verify-the-signature).","**HTTPS to public addresses only.** Endpoint URLs must use `https:\u002F\u002F`, without credentials in the URL, and every address they resolve to must be public: private, loopback, link-local and reserved ranges are refused. The check runs again at each delivery, which connects only to the address it checked, through no proxy.","**No redirects.** Deliveries do not follow redirects, and time out after 10 seconds.",{"type":14,"level":15,"text":36,"id":37},"Regions","regions",{"type":11,"text":39},"Each region is a separate deployment and security boundary. The data about your visitors, and what protects it, stays in your organization's region.",{"type":41,"columns":42,"rows":45},"table",[43,44],"In your region","In the United States control plane",[46,49,52,55],[47,48],"Identification events, archived submissions and visitor identities","Accounts and sign-in",[50,51],"SDK keys, proxy keys and their hashing key","Organizations, members and invitations",[53,54],"Webhook endpoints, encrypted secrets and deliveries","Billing",[56,57],"Risk weights, analytics and backups","",{"type":19,"items":59},[60,61],"When you view visitor data in the dashboard, your browser reads it directly from your region's API with a short-lived grant. It does not pass through the control plane.","Control-plane data and regional data are kept in separate databases with separate database roles and credentials.",{"type":11,"text":63},"See [regions and data residency](\u002Fdocs\u002Fregions).",{"type":14,"level":15,"text":65,"id":66},"Infrastructure","infrastructure",{"type":19,"items":68},[69,70,71],"**No exposed services.** The API is reached only through Cloudflare. Databases, caches and internal services accept no connections from the internet.","**Encrypted backups.** Backups are encrypted before they leave the server and are deleted after 35 days.","**Rate limits.** Identification is rate limited per organization. See [rate limits](\u002Fdocs\u002Frate-limits).",{"type":14,"level":15,"text":73,"id":74},"Payments","payments",{"type":11,"text":76},"Card payments are taken by Stripe on its hosted checkout. Card numbers never reach Fingerly: for each card on file, Fingerly keeps only the brand, the last four digits and the expiry date.",{"type":14,"level":15,"text":78,"id":79},"Visitor data","visitor-data",{"type":19,"items":81},[82,83,84,85],"The browser SDK sets no cookies and stores nothing on the visitor's device. The mobile SDKs keep one random installation identifier in your app's own storage.","Visitor IDs are scoped to your organization. The same device has a different visitor ID for every Fingerly customer, so visitor IDs cannot link people across companies.","Forwarded visitor details, such as a proxy's client address, are trusted only on requests authenticated with a proxy key or a secret key.","Identification events are readable for 30 days. See [data retention](\u002Fdocs\u002Fdata-retention).",{"type":14,"level":15,"text":87,"id":88},"Dashboard access","dashboard-access",{"type":19,"items":90},[91,92,93],"Members sign in with email and password, an email link, Google, Microsoft or GitHub.","Every member has one role, and the API enforces what each role may do. See [team and roles](\u002Fdocs\u002Fteam-and-roles).","Owners and admins can suspend or remove a member.",{"type":14,"level":15,"text":95,"id":96},"Certifications","certifications",{"type":11,"text":98},"Fingerly does not hold SOC 2 or ISO 27001 certification, and claims no other security or privacy certification.",{"type":14,"level":15,"text":100,"id":101},"Your part","your-part",{"type":41,"columns":103,"rows":106},[104,105],"Practice","Why",[107,110,113,116,119,122,125],[108,109],"Keep secret keys, proxy keys and management keys on your servers, in a secret manager.","Anyone holding a secret key can read your events for its environment, and a management key can issue new secret keys.",[111,112],"List only your own origins on public keys.","Allowed origins are what stop other sites spending your balance in browsers.",[114,115],"Decide on your server, from the event you read with a secret key.","Anything the browser or app reports can be edited. See [server-side verification](\u002Fdocs\u002Fserver-side-verification).",[117,118],"Verify every webhook signature over the raw body.","Your endpoint is public.",[120,121],"Resolve the visitor's address in your proxy from infrastructure you control.","Visitors can write `X-Forwarded-For`.",[123,124],"Revoke a key the moment it leaks, and rotate keys when people leave.","Revocation applies immediately.",[126,127],"Give members the least powerful role that works.","Developers and billing members cannot change weights, proxy keys or the team.",{"type":14,"level":15,"text":129,"id":130},"Report a vulnerability","report-a-vulnerability",{"type":11,"text":132},"If you believe you have found a security vulnerability in Fingerly, email [support@fingerly.io](mailto:support@fingerly.io) with **Security** in the subject. Include what you found, where, and the steps to reproduce it.",{"type":19,"items":134},[135,136,137,138],"Test only against an organization and keys of your own.","Do not access, change or delete other customers' data, and stop as soon as you reach data that is not yours.","Do not degrade the service, for example with load or denial-of-service testing.","Give us a reasonable time to fix the issue before you disclose it.",{"type":140,"tone":141,"text":142},"callout","note","Fingerly does not run a bug bounty programme.",{"type":144,"columns":15,"cards":145},"cards",[146,151],{"title":147,"text":148,"href":149,"icon":150},"Privacy and consent","What is collected, and your role under data protection law.","\u002Fdocs\u002Fprivacy-and-consent","lock",{"title":152,"text":153,"href":154,"icon":155},"API keys and environments","Create, restrict and revoke keys.","\u002Fdocs\u002Fapi-keys","key",[157,158,159,160,161,162,163,164,165,166],{"id":17,"text":16,"level":15},{"id":28,"text":27,"level":15},{"id":37,"text":36,"level":15},{"id":66,"text":65,"level":15},{"id":74,"text":73,"level":15},{"id":79,"text":78,"level":15},{"id":88,"text":87,"level":15},{"id":96,"text":95,"level":15},{"id":101,"text":100,"level":15},{"id":130,"text":129,"level":15},"2026-09-17T16:58:12.000Z",1789667797516]