Check beyond the email address
A new email address does not establish a new customer. Trial cycling, referral farming, and repeat registrations after a ban all exploit that gap. Your application needs a way to compare the new attempt with accounts it already holds.
Browser identifiers help with that comparison, but they need context. Anti-detect profiles can change reported values. People can also share a device, and stock devices can produce matching inputs. Treat a match according to your account policy.
Three identifiers to compare
The machine identifier uses normalized display, platform, timezone,
and core-count inputs. The instance identifier adds rendering and
font inputs. A separate rendering signature uses stable Canvas and
WebGL output without timezone or display declarations.
All three are conditional and use browser-supplied inputs. Heretic also returns connection and integrity findings that help you assess the session. Those findings do not turn a hash match into proof of a unique device or person.
Keep an account record
Store the available identifiers with their scope and version. Compare probe identifiers within one site key. Keep challenge identifiers separate, within their tenant scope. Missing identifiers must stay missing; an empty value is not a device match.
Your rule can reject a known browser instance before offering another trial, or require an existing-account login after a machine and address match. A household or carrier can share an address. The signup rules guide shows how to bind the result to an attempt and create the account once.
Add a phone challenge
A challenge adds recorded phone movement, a timed workload, and a fresh passkey signature. Store the outcome and measured device records with the account. These records remain useful for comparison if a visitor later deletes a credential.
Detected concealment holds the ceremony and lets the visitor disable a VPN, proxy, or relay before retrying within the original expiry. A pass means the required checks completed. The signature does not authenticate the motion sensor, passkeys can sync, and a QR code does not establish that a phone and desktop share a location.
Data and retention
Heretic requires no identity document or face scan. The probe returns browser data, connection observations, and available identifiers scoped to your site. Zero-retention mode allows one authorized read within ten seconds. Your application stores the account history it needs.