Privacy Policy
Last Updated: July 17, 2024
This Privacy Policy explains how the FDS Scoring Engine collects, encrypts, processes, and stores your end-users' Device Fingerprints via our SDK integrations (Web and Mobile) for fraud prevention purposes.
1. Data We Collect
When your end-users interact with your application or website integrated with our SDK, we collect hardware and network attributes. We do not collect direct Personally Identifiable Information (PII) such as names, emails, or passwords.
A. General Data (Web & Mobile)
| Attribute | Description |
|---|---|
| Device ID | Unique browser or hardware identifier. |
| Network | IP address, ISP, and VPN usage detection. |
| Characteristics | Screen resolution and automated bot/emulator indicators. |
B. Web SDK Specific Data
- User Agent, browser language, and time zone.
- Canvas Fingerprint (Graphical rendering hash to identify the same physical machine).
- Device pixel ratio and graphics card (GPU) renderer information.
- Indicators of consistency between self-reported mobile User Agents and actual devices.
C. Mobile SDK Specific Data (Android & iOS)
- Hardware: Operating System (e.g., "Android 14"), device model, manufacturer, battery percentage, charging status, and device uptime.
- Network & Location: Connection type (WIFI/4G/5G), carrier name, and GPS coordinates (Latitude/Longitude with meter accuracy).
- Advanced Security: Root/Jailbreak detection, Mock Location (fake GPS) usage, attached debugger presence, and app binary hash tampering/mismatch.
2. Data Usage & Graph Analytics
The collected data is transformed into analytical nodes to build a fraud detection graph network. Our system maps:
- How many accounts are linked to the same Device ID, IP, or Canvas Fingerprint.
- Cross-connections (Fraud Rings) between devices sharing the same IP addresses.
- Location clusters (using a rounded GPS radius of ±1.1km) to detect concentrated activity from the same hyper-local area.
- The network proximity (hop-count) of a transaction to a known rooted or emulated device.
3. Data Security & Encryption
We implement rigorous cryptographic standards to protect your and your users' data:
- At-Rest Private Key Encryption: All RSA private keys are stored in the database in an encrypted format using the AES-256 GCM algorithm.
- On-Demand Decryption: Encryption keys are only accessed and decrypted in memory during active processing, and are never logged or exposed in plaintext.
- Secure Transmission: All SDK data payloads transmitted from the end-user's device are RSA-encrypted (base64 encoded).