Signals

Signals are the raw measurements Rupt collects from a user's environment when an evaluation runs. They aren't decisions on their own. They're the inputs that feed fingerprinting and, more broadly, our ability to spot risk.

Here are some of the kinds of signals we look at. This is by no means the full list, just a sense of what goes in and how we use it.

Network

• The IP address the connection is coming from.
• Rough location (city, region, country) derived from that IP.
• Whether the IP looks like a VPN, proxy, Tor exit, or hosting provider. That's a useful tell for things like scraping and account takeover.

Device

• Type: phone, tablet, or computer.
• Hardware details like CPU, memory, and touch support.
• Screen: resolution and window size.
• The operating system and platform.

Browser

• User agent and the related client hints.
• Language, timezone, and locale.
• Fonts and plugins that are installed.
• Smaller permission and configuration details. On their own they're nothing, but together they add up to a fairly specific setup.

Behavior

• Whether interactions look real or synthetic.
• Automation indicators: signs that a script or testing framework is driving the page rather than a person.

How the browser renders things

Browsers draw and compute certain things in tiny, consistent ways. The same device usually produces the same result every time. When it doesn't, that's often a sign something is being faked or masked.

Native apps (iOS and Android)

When you ship our mobile SDK, we can also tell whether a device is jailbroken or rooted, running in a simulator or emulator, or has a debugger attached.

How it comes together

No single signal tells you much by itself. IPs change, browsers update, people travel. The value is in the mix: we weigh all of it together, and the combination is what actually points to whether something's risky.