scanned May 30, 2026

Fingerprint

fingerprint.dev

securityVisit site →

Fingerprint provides a stable visitor ID that survives cookie clearing, incognito, and storage wipes for fraud, growth, and security teams

57/100

Tier 3 · Agent-Accessible

Content answers55/100
Protocol plumbing63/10010 of 16 checks pass
Re-audit2439h ago· 1 credit

Scored by asking 15 questions a buyer of a security product asks, then grading this site’s own pages: answered, hedged (partial or vague), or silent (no page answers it). How scoring works

15 buyer questions · graded against the site’s own pages

3 of 15 come back answered. 8 get a hedge. 4 meet silence.

3 answerable8 half-answers4 silent

Goes silent · technical · high importance

Your fraud-detection page mentions bot signals. Is the bot probability score returned in the standard /events API payload by default, or is it only available as part of the Smart Signals add-on?

Goes silent · technical · high importance

Your iOS SDK collects device signals. On iOS 14.5 and later, does integrating the SDK trigger the App Tracking Transparency (ATT) prompt, or do you rely on non-IDFA signals that keep us exempt from NSUserTrackingUsageDescription?

This report is public. Own fingerprint.dev? Claiming is free: crawl every page, re-audit as you fix, and track your score over time.

Sign in to claim

The fix queue

43 points sit between fingerprint.dev and 100: 12 open questions and 6 missing protocol checks, ordered by estimated payoff.

Point estimates are per fix under scoring v2. They are not additive to a promised total.

01technical · importance highGoes silent+7 content pts est.

Your fraud-detection page mentions bot signals. Is the bot probability score returned in the standard /events API payload by default, or is it only available as part of the Smart Signals add-on?

What the pages say

None of the retrieved chunks mention a bot probability score, bot signals, or a Smart Signals add-on. The example /v1/events response shows fields including visitor_id, confidence, signal hashes, first_seen, last_seen, and request_count, but no bot probability field.

The fix

Add documentation clarifying whether bot probability scores are included in the standard /events API payload or gated behind a Smart Signals add-on.

Where we looked: /reference, /quickstart, /reference, /guides/fraud-detection, /guides/fraud-detection, /solutions/fraud-detection

confidence high · grounding synthesized · weight 0.00 · Absent

02technical · importance highGoes silent+7 content pts est.

Your iOS SDK collects device signals. On iOS 14.5 and later, does integrating the SDK trigger the App Tracking Transparency (ATT) prompt, or do you rely on non-IDFA signals that keep us exempt from NSUserTrackingUsageDescription?

What the pages say

No page on the site addresses this.

The fix

Publish a native iOS SDK guide or FAQ that clarifies whether the SDK accesses the IDFA (triggering ATT) or relies on non-IDFA signals, and whether NSUserTrackingUsageDescription is required.

Where we looked: docs.fingerprint.dev, /how-it-works

confidence high · grounding synthesized · weight 0.00 · Absent

03migration · importance mediumGoes silent+7 content pts est.

We're already using the open-source FingerprintJS library in production. If we upgrade to your hosted Visitor ID, will the visitorId string format remain identical so we don't have to migrate our existing user tables?

What the pages say

No page on the site addresses this.

The fix

Add a migration guide or FAQ entry that addresses upgrading from the open-source FingerprintJS library to the hosted service, explicitly stating whether the visitorId string format is identical and whether existing database tables require changes.

confidence high · grounding world-knowledge · weight 0.00 · Absent

04technical · importance mediumGoes silent+7 content pts est.

Your homepage cites 99.5% accuracy. Is that metric measuring correct returning-user identification, and what's the documented false-positive rate for incorrectly flagging two different devices as the same visitor?

What the pages say

None of the retrieved chunks mention a '99.5% accuracy' metric or a documented false-positive rate for incorrectly flagging two different devices as the same visitor. The chunks describe a `confidence` score (0.0 to 1.0) returned with each `visitor_id`, but do not publish accuracy or false-positive statistics.

The fix

Add a dedicated accuracy / metrics page that defines the 99.5% claim, clarifies what it measures, and documents false-positive and false-negative rates.

Where we looked: fingerprint.dev, fingerprint.dev, fingerprint.dev, docs.fingerprint.dev, docs.fingerprint.dev

confidence high · grounding synthesized · weight 0.00 · Absent

Hedged · 8 of 15 questions

A buyer gets something, then has to guess the rest. Expand any row for the evidence and the fix.

05You mention GDPR compliance on the site, but I can't find the default TTL for raw browser signals. What's the exact retention period for unaggregated fingerprint data, and can I shorten it in the dashboard settings?complianceHedges+2 pts est.

You mention GDPR compliance on the site, but I can't find the default TTL for raw browser signals. What's the exact retention period for unaggregated fingerprint data, and can I shorten it in the dashboard settings?

What the pages say

The JavaScript SDK 'hashes browser evidence before sending it to fingerprint.dev' (docs.fingerprint.dev/guides/advertising), and the matcher 'keeps per-axis browser hashes internally' (docs.fingerprint.dev/concepts). The privacy policy states that 'Identify-event records are retained per the plan you select' (fingerprint.dev/legal/privacy). However, the chunks do not specify an exact default TTL for raw browser signals or unaggregated fingerprint data, nor do they mention whether retention can be shortened in dashboard settings.

The fix

Explicitly state whether raw browser signals are retained (or note they are not transmitted because hashing happens client-side), publish the default retention period, and document any dashboard settings that let customers shorten retention.

Where we looked: /guides/advertising, /concepts, /legal/privacy, /legal/privacy

confidence medium · grounding synthesized · weight 0.65 · Vague

06We need strict EU data residency. Can I configure our account so that every fingerprint request is processed exclusively in your EU region, with zero failover to US points of presence, or is there always a fallback route?complianceHedges+2 pts est.

We need strict EU data residency. Can I configure our account so that every fingerprint request is processed exclusively in your EU region, with zero failover to US points of presence, or is there always a fallback route?

What the pages say

Fingerprint.dev states that EU-only data residency—and EU-only processing—is configurable on enterprise plans: 'EU-only or US-only data residency is configurable on enterprise plans.' However, none of the retrieved chunks specify whether this guarantees that every fingerprint request is processed exclusively in the EU region with zero failover to US points of presence, or whether a fallback route exists.

The fix

Add explicit documentation clarifying whether EU-only data residency prevents all request routing or failover to US points of presence, or describe the traffic architecture for region-locked enterprise accounts.

Where we looked: /security, /legal/dpa, /legal/dpa, /security

confidence medium · grounding synthesized · weight 0.65 · Vague

07The enterprise page says 'industry-leading SLA' but doesn't quote the number. What is the exact monthly uptime percentage guaranteed, and does that SLA cover both the identification API and the CDN that serves the agent script?enterpriseHedges+2 pts est.

The enterprise page says 'industry-leading SLA' but doesn't quote the number. What is the exact monthly uptime percentage guaranteed, and does that SLA cover both the identification API and the CDN that serves the agent script?

What the pages say

The enterprise tier includes a 99.9% uptime SLA with service credits. The retrieved chunks do not specify whether this SLA covers the CDN that serves the agent script in addition to the identification API.

The fix

Add explicit SLA scope language to the enterprise page or legal terms stating whether the 99.9% guarantee applies to the identification API, the CDN serving the agent script, or both.

Where we looked: /enterprise, /pricing

confidence high · grounding synthesized · weight 0.70 · Vague

08What's the per-second burst limit for Server API calls on the standard Pro plan, and when rate-limited, does the API return a Retry-After header measured in seconds or milliseconds?limitsHedges+2 pts est.

What's the per-second burst limit for Server API calls on the standard Pro plan, and when rate-limited, does the API return a Retry-After header measured in seconds or milliseconds?

What the pages say

The API documentation notes that a `429` status is returned when the rate limit is exceeded, but the retrieved chunks do not specify the per-second burst limit for Server API calls on the standard Pro plan, nor do they indicate whether rate-limited responses include a `Retry-After` header or its unit of measurement.

The fix

Add explicit rate-limit documentation that lists per-plan burst limits and describes the `429` response format, including whether a `Retry-After` header is sent and its unit.

Where we looked: /reference

confidence high · grounding synthesized · weight 0.70 · Vague

09We have a lot of Safari mobile users. Does your JS agent generate the same stable visitor ID in Private Browsing mode out of the box, or do I need to toggle any specific extendedResult or storage flags?technicalHedges+2 pts est.

We have a lot of Safari mobile users. Does your JS agent generate the same stable visitor ID in Private Browsing mode out of the box, or do I need to toggle any specific extendedResult or storage flags?

What the pages say

The chunks state that fingerprint.dev is cookieless and does not rely on browser storage or client-side identifiers (chunk [6]), and the homepage explicitly claims you can 'reload in incognito and we'll still recognize you' (chunk [20]). Other chunks note the service recovers 'the conversion path Safari and iOS broke' (chunk [2]) and provides a 'first-party visitor ID that survives the modern browser' (chunk [4]). However, none of the chunks specifically confirm that the JavaScript agent generates the same stable visitor ID in Safari mobile Private Browsing mode, and no chunk mentions any extendedResult or storage flags.

The fix

Add a dedicated FAQ or SDK reference entry that explicitly states Safari mobile Private Browsing behavior and lists any available configuration flags such as extendedResult or storage options.

Where we looked: fingerprint.dev, docs.fingerprint.dev, /why-cookieless, /attribution, fingerprint.dev

confidence medium · grounding synthesized · weight 0.65 · Vague

10For security, we require subresource integrity on all third-party scripts. Do you publish a SHA-384 SRI hash for your latest JS loader, and is it updated automatically in the docs with each release?technicalThin on specifics+2 pts est.

For security, we require subresource integrity on all third-party scripts. Do you publish a SHA-384 SRI hash for your latest JS loader, and is it updated automatically in the docs with each release?

What the pages say

The retrieved chunks do not mention SHA-384 SRI hashes, CDN script tag loading, or automatic documentation updates for releases. The JavaScript SDK documentation describes installation via package manager (`bun add fingerprint.dev`) and ES module imports (`import { identify } from "fingerprint.dev"`), but does not cover a browser loader script or subresource integrity.

The fix

Add a section to the JavaScript SDK docs covering CDN script tag integration, published SHA-384 SRI hashes, and whether they are updated automatically with each release.

Where we looked: /sdk/js, /sdk/js, /sdk/js

confidence high · grounding synthesized · weight 0.70 · Absent

11Under your standard MSA, what is the notice period for termination for convenience, and does the Data Processing Agreement referenced in your legal hub automatically apply upon signup or require a separate countersignature?legalHedges+2 pts est.

Under your standard MSA, what is the notice period for termination for convenience, and does the Data Processing Agreement referenced in your legal hub automatically apply upon signup or require a separate countersignature?

What the pages say

The chunks do not specify the notice period for termination for convenience under the standard MSA; they only state that the MSA covers 'term and termination' without providing the duration. Regarding the DPA, it does not automatically apply upon signup for self-serve customers—self-serve plans operate under the standard Terms of Service and Privacy Policy, and custom DPA terms are available only when an enterprise contract is in place. For enterprise customers, the DPA is 'executed alongside the Master Services Agreement,' indicating it is part of a separately countersigned contract rather than applying automatically.

The fix

Publish the specific termination-for-convenience notice period from the standard MSA on the legal hub, and clarify on the DPA page whether the DPA is deemed accepted via click-through for self-serve or requires a countersigned enterprise agreement.

Where we looked: /legal/dpa, /legal/dpa, /legal/dpa, /legal/msa, /legal/msa, /legal/msa, /enterprise

confidence medium · grounding synthesized · weight 0.65 · Vague

12If a user clears all browser storage and revisits within one minute using the same hardware profile, will the requestId immediately link back to the previous visitorId, or is there a documented reconciliation lag I should account for in my fraud rules?technicalHedges+2 pts est.

If a user clears all browser storage and revisits within one minute using the same hardware profile, will the requestId immediately link back to the previous visitorId, or is there a documented reconciliation lag I should account for in my fraud rules?

What the pages say

Fingerprint.dev claims the same visitor_id is returned for the same device even after a full browser wipe, incognito mode, or clean reinstall, but none of the retrieved chunks specify whether a requestId immediately links back to the previous visitorId within one minute or document any reconciliation lag to account for in fraud rules.

The fix

Add explicit documentation on the latency or reconciliation behavior for visitor_id association after browser storage is cleared, including whether the linkage is immediate or subject to a processing delay.

Where we looked: /fraud, fingerprint.dev

confidence medium · grounding synthesized · weight 0.65 · Vague

What the pages already answer cleanly

3 of 15. Answered with enough specificity for a buyer to act on. This is the bar the queue above is chasing.

pricingAnswered

I'm evaluating the Pro plan for a high-traffic site—once I hit the included monthly API quota, what's the exact per-request overage fee, and do I need to prepay for a volume tier or is it purely pay-as-you-go?

What the pages say

On the Pro plan ($199/mo, 250,000 requests included), overages are billed at tiered volume-discount rates: $0.80 per 1,000 additional requests to 500k total, $0.60 per 1,000 to 5M total, and $0.40 per 1,000 after 5M total. You do not need to prepay for a volume tier; paid accounts automatically continue serving traffic and bill additional requests at the plan’s overage rate (pay-as-you-go). Prepaid committed-use discounts and annual billing are only offered on the Enterprise tier.

Source: /pricing, /faq, /pricing, /enterprise

confidence high · grounding synthesized · weight 0.95 · Answered

securityAnswered

Our InfoSec team needs the SOC 2 Type II report before we can onboard. Is the report available in your trust center for immediate download, or does it require an NDA and manual request?

What the pages say

SOC 2 is listed as “in progress.” The current scope and timeline are “shared on request,” and the SOC 2 program status is shared under NDA. The chunks do not mention a trust center or an immediate download option for a completed SOC 2 Type II report.

Source: /enterprise, /legal/dpa

confidence high · grounding synthesized · weight 0.95 · Answered

pricingAnswered

Before I commit, is there a free developer tier with a hard monthly API call cap, and if so, what's the specific request limit where the service stops responding?

What the pages say

Yes. Fingerprint.dev offers a free tier with 1,000 included `POST /v1/identify` requests per month and no credit card required. It is not a time-limited trial. Free accounts stop when the included quota is exhausted—once the 1,000-request cap is reached, further identify requests are rejected and the API returns a `402 Payment Required` error.

Source: /faq, /usage-billing

confidence high · grounding synthesized · weight 0.95 · Answered

Protocol plumbing · 63/10010 of 16 checks pass · each fix +6 protocol pts est.

The other half of the score: 16 checks for the files and headers agents look for. The 6 below are installs, not judgment calls, and most are an afternoon. Expand any for the snippet and the standard it follows. They sit after the queue because none of them changes what your pages say.

Markdown negotiationRendering+6 pts est.

StandardRFC 9110 + 7763IETF RFC

MCP cardInteraction+6 pts est.

Sitedex generates this file from your crawl. Grab it in Files from this audit below.

StandardModel Context ProtocolCommunity spec

OpenAPI specInteraction+6 pts est.

StandardOpenAPI SpecIndustry standard

WebMCP widgetInteraction+6 pts est.

Sitedex generates this file from your crawl. Grab it in Files from this audit below.

StandardW3C WebMCP draftW3C / WHATWG

Meta descriptionsHygiene+6 pts est.
Install snippet
<meta name="description" content="fingerprint.dev: [outcome you deliver] for [who you help]. One sentence, 50-160 characters." />

StandardHTML Living StandardW3C / WHATWG

Sitemap lastmodDiscoverability+6 pts est.

Standardsitemaps.orgIndustry standard

Already passing 10 of 16: robots.txt, sitemap.xml, llms.txt, AI crawler access, Content signal, Clean crawl, Server-rendered content, Canonical URLs, HTML lang attribute, Organization schema.

Ask this site’s index

Sitedex already serves fingerprint.dev as an MCP endpoint. Ask fingerprint.dev anything an AI agent might ask, and see what its index returns. (To score your own site, use the form below.)

Snippets & configs

For developers and the engineer-on-call: copy these into your tools or your site.

Files from this audit

Built from this crawl. Download or copy each, then install it at the path noted.

llms.txt

Built from this crawl. Install at /llms.txt so agents start here.

organization.json

Organization JSON-LD, pre-filled from this crawl. Wrap in a ld+json script.

server-card.json

MCP server card built from this crawl. Host at /.well-known/mcp/server-card.json.

webmcp.json

WebMCP discovery manifest built from this crawl. Host at /.well-known/webmcp.json.

MCP endpoint

https://mcp.sitedex.dev/s/fingerprint-dev/mcp

The URL anyone's agent points at. Read-only; safe to share.

Claude Code

claude mcp add fingerprint --transport http https://mcp.sitedex.dev/s/fingerprint-dev/mcp

One command, then the agent has it.

Cursor / Continue

{
  "mcpServers": {
    "fingerprint": {
      "url": "https://mcp.sitedex.dev/s/fingerprint-dev/mcp"
    }
  }
}

Drop into mcp.json.

WebMCP: two parts

WebMCP-capable browsers run the widget at runtime. Crawlers without JS rendering need the discovery manifest to find your tool surface. Install both.

1 · Widget script

<script async src="https://sitedex.dev/widget.js"></script>

Drop in <head>. WebMCP-capable browsers (Chrome 146+ Origin Trial) call navigator.modelContext.provideContext() via this script.

2 · Discovery manifest

{
  "$schema": "https://wellknownmcp.org/schemas/webmcp.json",
  "name": "fingerprint.dev",
  "tools": [
    { "name": "search", "description": "Search fingerprint.dev's indexed content." },
    { "name": "get_page", "description": "Fetch a page from fingerprint.dev as markdown." }
  ]
}

Host alongside the script at /.well-known/webmcp.json. Crawlers that don't render JS rely on this.

Your turn

See which of these questions your site goes silent on.

Free, about 5 minutes. We crawl your site, test it against the buyer questions your category asks, and name what’s vague, contradictory, or missing, plus the files AI agents look for.

ComingEmbeddable grade badgeScore history and deltasOpt-in public board