Compliance
Notes on data localization, secret boundaries, and iOS privacy manifest requirements
Data Localization
Device Fingerprint supports multi-region clusters including Global, Europe, and North America, with localized data storage support. If your business has regional compliance requirements, define the region plan when creating the app.
Secret Boundaries
Integration responsibilities should be split as follows:
- Client: SDK initialization, collection, and reporting only
- Server: stores
private_key, performs final queries, and makes decisions
Do not expose private_key in client code, frontend bundles, or mobile resources.
iOS Privacy Manifest
The iOS SDK uses APIs related to disk capacity and environment inspection, including:
NSPrivacyAccessedAPICategoryDiskSpaceNSPrivacyAccessedAPICategoryFileTimestamp
If your app uses these APIs, configure the privacy manifest according to Apple's requirements.
Logging and Data Handling
- Avoid long-term logging of full tokens on the client
- Restrict access to server-side query logs
- Define retention windows for fingerprint results and risk labels based on your internal data classification policy
Recommended Practices
- Separate apps and secrets by region
- Separate production and testing configurations
- Add compliance review to your release checklist