Privacy and Data
This page lists the categories of data Octet Browser processes, where each is collected, and how long it is held. Use it for your privacy notice, your records of processing, and your data processing agreement with Octet.
Data collected in the browser
The collector reads these categories from the user's browser and sends them to your edge:
| Category | Examples |
|---|---|
| Device and browser configuration | Time zone, language and regional format settings, screen properties, hardware properties such as processor count |
| Device rendering characteristics | Hashes of how the device draws graphics and produces audio, including a small canvas check that shows whether a privacy protection is active. The collector draws the same test image on the page and in a Web Worker. The check doesn't identify a person. |
| Browser environment | Permission states the browser reports without prompting, signs of automation tools, and signs of browser extensions |
| Network information | Network addresses seen by the browser, including IP addresses |
| Connection timing | How long network requests take, in full and lite mode |
| A device key | The public half of a key pair the collector keeps in the browser. Octet uses it to check the collection and to refuse copies of it. Octet derives the verdict's deviceKey from it with a secret, separately for each license. The device key itself is not returned to you. See Device key. |
The collector never asks for permission to use location, camera, microphone or notifications. It reads no cookies, no local storage and no page content.
In passive mode the collector makes no network measurements and collects no network addresses. The other categories are still collected.
Data stored in the browser
The collector stores one item in the browser: the device key pair, in the IndexedDB database octet on your origin (store keys, entry device-v1). The private key is non-extractable, so page scripts can use it but can't read it out. It stays until the browser or the user clears your site's data, and some browsers clear script-written storage sooner. If the browser blocks storage, the collector keeps a key in memory for that page load and stores nothing.
Data added by your edge
Your edge adds data about the connection itself:
| Category | Examples |
|---|---|
| IP address | The user's public IP address, taken from the TCP connection |
| Request headers | User agent, accepted languages, and browser client hints |
| Connection properties | Timing and other properties of the browser's TCP and TLS connections to the edge. From v1.7.0, when your edge serves HTTPS itself, also two numbers about how steady the browser's connection was during the check, with no personal data |
| Connection fingerprints | When your edge serves HTTPS itself: a fingerprint of the browser's TLS connection (JA4, the encryption settings the browser offers), and from v1.6.0 a fingerprint of how the browser opens its TCP and HTTP/2 connections. They describe the browser and its network software, contain no personal data, and don't identify a person. |
Where the data goes
- The collector encrypts the browser's data to Octet and sends it to your edge over HTTPS. Your edge can't read it. Scripts on your own page can read it before it is encrypted, because the collector runs in the page.
- Your edge adds its own data about the connection, and forwards everything to the Octet API over mutual TLS.
- Octet computes a verdict and returns only the verdict to your backend.
If your backend sends the user's IP address as clientIp when it requests a challenge, Octet puts only a keyed tag of the address's network into the challenge, and stores nothing. The verdict token carries only whether the networks matched.
In full and lite mode the browser also sends requests to three Octet network hosts, which see the user's IP address. See Network and CSP.
How long data is held
| Where | What | How long |
|---|---|---|
| The user's browser | The device key pair | Until the browser or the user clears your site's data |
| Your edge | Network timing for a session | In memory, up to 60 seconds, deleted when forwarded |
| Octet API | The session's data and its verdict | In memory, up to 2 minutes |
| Octet API | A hash of each accepted collection, to refuse copies of it | In memory, up to 1 hour |
| Octet API | The location and network type found for the user's network, with no IP address | In memory, up to 1 hour |
| Octet network hosts | A keyed tag of each network that contacted them, with no IP address | In memory, up to 1 minute |
| Your backend | The verdict you fetched | Your choice |
Octet keeps no per-user record and builds no profile across sessions.
By default your edge logs no end-user data. Its diagnostic setting, EDGE_DEBUG, logs end-user IP addresses, so keep it off in production. See Edge Configuration.
Roles
You decide to use Octet and what to do with each verdict. Describe Octet Browser in your privacy notice as a fraud and compliance check that determines the country a session operates from. The Octet Browser terms set out Octet's obligations. For questions about data processing, write to privacy@octetproof.com.