Smart Signals

Smart Signals are server-side enrichment signals computed from browser fingerprints, IP intelligence, and behavioral analysis. They provide deep context about every visitor without collecting any personally identifiable information.

Smart Signals — the enriched decision, risk, network, and bot signals — reach your server two ways: pushed to you as webhooks (see Webhooks) and readable on demand through the Server API. They are also surfaced in the dashboard. The examples below consume the webhook payload shape; the same fields appear on a session read from the API.

Signal Reference

A visit resolves into 35+ smart signals across network, browser, device and behavioral analysis. The reference below names the ones you will reach for most often, including:

Network Intelligence

Browser Analysis

Device Analysis

Native-only detections. Root, jailbreak, cloned/dual-app and Frida instrumentation depend on signals only a native mobile SDK can collect. TRACIO ships browser SDKs, so these are not effective in the web agent — rely on the automation, headless, antidetect, emulator and behavioral verdicts instead.

Behavioral

Detailed Signal Descriptions

VPN, Proxy & Tor Detection

VPN, proxy, Tor, and datacenter flags are resolved server-side from the visitor's IP using commercial IP intelligence databases (IP2Location / MaxMind). The public webhook payload surfaces the combined results as booleans on the network object — network.vpn, network.proxy, network.tor, network.datacenter — with no per-method breakdown or confidence string. See IP Intelligence for details.

Incognito Detection

Private browsing is inferred across Chromium, Firefox and Safari and reaches you as identification.incognito. There is no browser API that reports it, so the verdict comes from weighted voting over how storage behaves in a private window — origin private file system errors, storage durability, and platform-specific quirks each contribute.

It is a probabilistic signal, not a certainty: treat it as one input among several rather than a fact to act on alone. Because private windows also suppress the _vid_t cookie, an incognito visit is identified from signals only, and its identification.confidence is correspondingly lower.

Browser Tampering

The tampering detector identifies visitors who have modified their browser to misrepresent their identity:

• User-Agent spoofing: Cross-references UA string with Client Hints, navigator properties, and JavaScript engine behavior
• Property injection: Detects extensions that modify navigator properties by comparing getter prototypes
• Plugin manipulation: Verifies PluginArray.prototype and MimeType.prototype chains
• Native function override: Tests if Function.prototype.toString, Object.getOwnPropertyDescriptor, and other critical functions have been replaced with Proxies

The anomalyScore (0.0-1.0) quantifies the degree of inconsistency. Values above 0.5 indicate significant tampering.

Risk and Suspect Score

The webhook decision object carries the aggregated risk for a request: decision.riskScore (integer 0-100), decision.suspectScore (number), and decision.action (the recommended action). The score aggregates the smart signal outputs; the bands below describe how riskScore maps to risk levels:

The score aggregates the active smart-signal outputs — primarily IP intelligence (VPN/proxy/Tor/datacenter), the bot verdict, and browser tampering. Confirmed human interaction (mouse/keyboard) lowers the score.

Privacy Browser Detection

Four privacy-focused browser configurations are detected:

Using Smart Signals

Smart Signals reach your server through the webhook payload (see Webhooks for the full shape and signature verification) and on a session read from the Server API. The examples below read fields directly off the webhook payload; the field names are the same either way.

Risk-Based Access Control

// `payload` is the webhook delivery body (/docs/webhooks)
const score = payload.decision.riskScore
const isVPN = payload.network.vpn
const isBot = payload.bot.result === "bot"

if (isBot) {
  return block("Automated access")
}

if (score > 60) {
  return requireMFA()
}

if (isVPN && score > 30) {
  return requireCaptcha()
}

return allow()

Fraud Scoring Pipeline

// `payload` is the webhook delivery body (/docs/webhooks)
function computeFraudRisk(payload: WebhookPayload): string {
  let risk = "low"

  if (payload.decision.riskScore > 60) risk = "high"
  else if (payload.decision.riskScore > 30) risk = "medium"

  // Escalate when multiple network signals agree
  if (payload.network.vpn && payload.network.proxy) risk = "high"
  if (payload.network.tor) risk = "high"
  if (payload.bot.result === "bot") risk = "high"

  return risk
}