Data sent and retention

What InlineShield receives with each sign-up, what it keeps and for how long. InlineShield does no device fingerprinting.

Last updated 2026-11-03

What /verify receives

The fields your server sends:

Field	Type	Required	Description
`email`	string	yes	The address the player signed up with.at least 1 character
`ip`	string	no	The player's IP address (IPv4 or IPv6). Without it, the IP of the calling connection is used, which is your server's. Anything that is not an IP address gets 400 INVALID_IP.
`userAgent`	string	no	The player's browser User-Agent. Only this field is read; the request's own User-Agent header (your HTTP client) is ignored. Without it the User-Agent counts as empty.
`username`	string	no	The username the player chose, if any.
`clientDwellMs`	number	no	Milliseconds the sign-up form was open before it was submitted, if you measure it. Not measured means unknown, never a fast submission.
`honeypot`	string	no	The value of a hidden form field that people leave empty. A non-empty value is a bot signal.

The fields the browser script sends; the IP address and User-Agent come from the browser's request:

Field	Type	Required	Description
`siteKey`	string	yes	Your site key (`bs_site_…`, or `bs_site_test_…` for test mode).
`email`	string	yes	at least 1 character
`username`	string	no
`clientDwellMs`	number	no	Milliseconds the form was open before it was submitted.
`honeypot`	string	no	The value of a hidden field people leave empty.
`signals`	object	no	Browser signals collected by inlineshield.js. Invalid values are ignored.
`signals.webdriver`	boolean	no
`signals.tz`	string	no	IANA time zone, e.g. Europe/Berlin.at most 64 characters
`signals.langs`	array of string	no	Up to 5 browser languages are kept.
`signals.automationHints`	array of string	no	Values: `webdriver, cdc_props, no_languages, headless_ua_ch, phantom, nightmare, selenium_props`

Each screening is recorded for your account: the email, IP address, User-Agent and username it was given, and the result. You see them in the console's History.
After 180 days (the default retention period), the raw email, username, IP address and User-Agent of a screening are blanked; the result stays. The same applies to the stored webhook payloads.
Outcome labels, and the per-screening data used for learning, are removed after 13 months.
Test screenings are kept and blanked the same way.

registration.allowed and registration.blocked webhooks contain the player's email and IP address. signup.approved and signup.rejected contain neither.