---
title: "Documentation"
description: "Task-oriented Noxtica documentation for installation, risk decisions, investigations, agent controls, integrations, and customer operations."
canonical_url: "https://noxtica.com/docs/"
markdown_url: "https://noxtica.com/docs/index.md"
last_updated: 2026-10-24
published: 2026-01-01
section: "getting-started"
section_title: "Getting Started"
site: "Noxtica"
language: "en"
source: markdown
---

# Noxtica Documentation

Use these docs to move from an activated account to a measured, reviewable policy. Noxtica provides browser and device intelligence, calibrated risk, bot and agent controls, and operator workflows; your team chooses where those outputs influence a customer journey.

Availability is account-specific. Backoffice visibility, API scopes, module status, and your service agreement determine which surfaces you can use. A capability described in the directory may still require entitlement, tenant or domain activation, a supported client, or privacy/legal review.

## Choose a path by task

| I need to…                                       | Start here                                                                                  | Then use                                                                                                                     |
| ------------------------------------------------ | ------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| Install the browser collector                    | [Install & Browser Runtime](https://noxtica.com/docs/browser-runtime/)                                         | [Getting Started](https://noxtica.com/docs/getting-started/) for the evaluation path and application responsibilities                           |
| Make a trusted backend decision                  | [Backend Integration](https://noxtica.com/docs/backend-integration/)                                           | [Why Calibration, Not Verdicts](https://noxtica.com/docs/why-calibration/) for policy design                                                    |
| Verify a customer identity from my backend       | [Identity verification integration](https://noxtica.com/docs/identity-verification-integration/)               | [KYC Hosted Sessions](https://noxtica.com/docs/kyc-hosted-sessions/) for session lifetime and expiry                                            |
| Call a server API from my backend                | [API overview](https://noxtica.com/docs/api/)                                                                  | [Authentication](https://noxtica.com/docs/api/authentication/), [Webhooks](https://noxtica.com/docs/api/webhooks/) and the [API reference](https://noxtica.com/docs/api/reference/)  |
| Give an AI agent the docs or the API             | [Integrate with an AI agent](https://noxtica.com/docs/ai-agents/)                                              | The [OpenAPI files](https://noxtica.com/docs/api/openapi.json), [`/llms.txt`](https://noxtica.com/llms.txt) and the Markdown version of every page                |
| Understand a score or reason                     | [Detection Signals](https://noxtica.com/docs/detection-signals/)                                               | [Threat Categories](https://noxtica.com/docs/threat-categories/) and the fingerprint detail in Backoffice                                       |
| Roll out challenge or block actions              | [Use Cases](https://noxtica.com/docs/use-cases/)                                                               | [Engineering Principles](https://noxtica.com/docs/principles/) for shadow-first and low-confidence handling                                     |
| Investigate related activity                     | [Capability Reference → Account linking](https://noxtica.com/docs/features/#account-linking-and-investigation) | Compare, investigation, analytics, and eligible export surfaces in Backoffice                                                |
| Govern automated agents                          | [Capability Reference → Agent identity](https://noxtica.com/docs/features/#agent-identity-and-control)         | [Agentic Security](https://noxtica.com/docs/concepts/agentic-security/) and [Know Your Agent](https://noxtica.com/docs/concepts/know-your-agent/)                  |
| Connect an AI agent or use the console assistant | [Capability Reference → AI operations](https://noxtica.com/docs/features/#ai-assisted-operations)              | [MCP Integration](https://noxtica.com/docs/concepts/mcp-integration/) or [AI Assistant](https://noxtica.com/docs/concepts/ai-assistant/)                           |
| Review privacy and operating boundaries          | [Engineering Principles](https://noxtica.com/docs/principles/)                                                 | [Capability Reference → Governance](https://noxtica.com/docs/features/#governance-and-data-controls) plus your contract and current legal pages |
| See everything customers can use                 | [Customer Capability Reference](https://noxtica.com/docs/features/)                                            | Follow any of the twelve family anchors to configuration, outputs, value, eligibility, and limits                            |
| See what changed in a collector release          | [SDK Changelog](https://noxtica.com/docs/changelog/)                                                           | [Install & Browser Runtime](https://noxtica.com/docs/browser-runtime/) for consent modes, events and the command queue                          |

## What is Noxtica?

Noxtica collects eligible browser, device, network, and interaction context, checks the available evidence for consistency, and returns a calibrated assessment. A result can help you recognize a returning browser installation, identify suspicious automation or infrastructure, verify supported agent identities, prioritize an investigation, or apply a route-specific policy.

The result is not proof that a visitor is a particular person, a guaranteed bot verdict, or a replacement for authentication. Read risk, confidence, and reasons together and combine them with the value and reversibility of the action your application is considering.

### Key Capabilities

- **Device and browser intelligence:** receive a tenant-scoped device handle and a calibrated assessment from an activated collector.
- **Bot, abuse, and network defense:** combine automation, consistency, infrastructure, and interaction reason families without making one signal decisive.
- **Risk and decisioning:** use score, five-level risk tier, confidence, and reasons in customer-owned allow, observe, challenge, review, or block policies.
- **Agent identity and control:** apply separate trust policies to supported signed agents and unknown automation when the module is enabled.
- **Investigation and operations:** review device records, trends, policy outcomes, audit history, alerts, and eligible exports in Backoffice.
- **Integrations:** consume browser events, scoped backend reads, SDKs, event delivery, exports, and eligible read-only MCP access.

See the [Customer Capability Reference](https://noxtica.com/docs/features/) for every public family, where it appears, what it produces, and what must be enabled.

### Platform Components

| Component               | Customer purpose                                                                              | Availability boundary                                                                            |
| ----------------------- | --------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
| **Browser collector**   | Collect and submit an eligible assessment; return browser events and cache state              | Requires an activated domain and Site Key; optional signal families have separate policy gates   |
| **Collector service**   | Score submissions and expose supported verification and lookup APIs                           | Endpoints, quotas, and modules vary by tenant and contract                                       |
| **Backoffice**          | Configure domains and eligible modules; review analytics, records, actions, access, and usage | Pages and actions are filtered by operator role, tenant scope, and entitlement                   |
| **Server API and SDKs** | Read results and make decisions from trusted backend code                                     | Requires a secret key with the necessary scope; never place server credentials in the browser    |
| **Integration outputs** | Deliver eligible events through webhooks, sinks, exports, or read-only MCP                    | Requires destination/token configuration and any applicable module, role, and data-policy review |

## Quick Start

### 1. Get Your Site Key

Request access through [Contact](https://noxtica.com/contact/). After your account is provisioned, sign in to [Backoffice](https://backoffice.noxtica.com), add the exact production or staging origin under **Domains**, and copy its Site Key. Keep environments separate; a Site Key is public but origin-bound.

### 2. Add the Collector

Copy your domain's snippet from **Backoffice → Integrations & API → Script & Consent**, then follow the [install walkthrough](https://noxtica.com/docs/browser-runtime/#install-core-on-every-page-extensions-after-consent). It is the single source for the core and extensions scripts, stable or pinned tags, the replay recorder head, CSP, consent modes, protected actions, and the check that it works.

### 3. Receive Risk Scores

Listen for the documented result event after successful collection or a cache hit:

```javascript
document.addEventListener('noxtica:collected', (event) => {
	const { fingerprintId, score, risk_level, confidence, flags, fromCache } = event.detail;

	// Send the device handle to your backend with the customer action.
	// Treat score, confidence, and flags as policy inputs—not an identity verdict.
});
```

Do not put a secret Server API key in this handler. Use the browser result to shape reversible experience choices or send its device handle to your backend for a trusted lookup.

### 4. Server-side Lookups (Optional)

Create a Server API key in **Backoffice → API Config**, select the narrowest required scope, save the secret when shown, and call the supported endpoint from your backend:

```bash
curl -H "Authorization: Bearer sk_prod_your_api_key" \
  "https://collect.noxtica.com/v1/device/DEVICE_ID"
```

Handle `401`, `403`, `404`, and `429` explicitly. A missing or expired device should follow your `unknown` path rather than being treated as safe or malicious. See [Backend Integration](https://noxtica.com/docs/backend-integration/) for response fields, caching, and error handling.

## Guides

### Integrate

- **[Getting Started](https://noxtica.com/docs/getting-started/):** account prerequisites, the evaluation path, and application responsibilities.
- **[Install & Browser Runtime](https://noxtica.com/docs/browser-runtime/):** the single install guide: core and extensions scripts, stable or pinned tags, replay recorder head, CSP, consent modes, protected actions, single-page apps, storage disclosure, and the check that it works.
- **[Backend Integration](https://noxtica.com/docs/backend-integration/):** scoped server keys, trusted lookups, errors, rate limits, and backend decision patterns.

### Decide and investigate

- **[Detection Signals](https://noxtica.com/docs/detection-signals/):** what each evidence layer contributes and how missing evidence affects confidence.
- **[Threat Categories](https://noxtica.com/docs/threat-categories/):** public reason families, appropriate uses, and common false-positive boundaries.
- **[Why Calibration, Not Verdicts](https://noxtica.com/docs/why-calibration/):** map risk and confidence to route-specific policy.
- **[Use Cases](https://noxtica.com/docs/use-cases/):** reference patterns for marketplaces, financial services, identity-sensitive flows, and agent governance.

### Operate and govern

- **[Customer Capability Reference](https://noxtica.com/docs/features/):** the complete customer-facing capability directory with surfaces, outputs, eligibility, and limits.
- **[Impact by Audience](https://noxtica.com/docs/impact-audiences/):** responsibilities and outcomes for security teams, platforms, end users, and agent owners.
- **[Platform Overview](https://noxtica.com/docs/platform-overview/):** the reference version of the home-page sections, from customer value and the platform tour to capability families, principles, replay context, AI guardrails, and next steps.
- **[Pricing Reference](https://noxtica.com/docs/pricing/):** the explanatory text behind the pricing page — billing disclosures, comparison dimensions, add-ons, KYC and metered-module notes, estimator definitions, and commercial FAQ.
- **[Engineering Principles](https://noxtica.com/docs/principles/):** the operational review checks behind defensible decisions.
- **[Concepts & Glossary](https://noxtica.com/docs/concepts/):** shared terms for device intelligence, agent controls, browser security, MCP, and the assistant.

<!-- docs-map:start -->
## Browse by section

Every customer-facing feature has one task-oriented page with the same layout: what it is, prerequisites, steps, how to verify, troubleshooting and related pages. The Server APIs section is the generated API reference.

### Server APIs

- [Server API reference](https://noxtica.com/docs/api/): authentication, errors, rate limits, webhooks, the MCP server and the generated endpoint reference.

### Browser SDK

- **[Install & Browser Runtime](https://noxtica.com/docs/browser-runtime/):** The one install guide for the Noxtica collector: core and extensions scripts, stable or pinned tags, recorder head, CSP, consent, protected actions, and checks.
- **[Script attributes and client options](https://noxtica.com/docs/sdk/script-attributes/):** Every data-* attribute on the Noxtica script tag and every createClient or init option, with accepted values, defaults and effect.
- **[Client API, events and the command queue](https://noxtica.com/docs/sdk/client-api/):** The page globals, the methods of window.noxticaClient, every noxtica:* event, the window.noxtica command queue and the checkOnce result, as the loader implements them.
- **[Consent modes, GPC and Google Consent Mode](https://noxtica.com/docs/sdk/consent/):** Set a consent mode per domain, declare it on the tag, connect your banner to the four categories, handle GPC and DNT, bridge Google Consent Mode v2 and test it.
- **[Protected actions: client trigger and server check](https://noxtica.com/docs/sdk/protected-actions/):** Declare protected actions per domain, trigger the minimal check from a form or code, carry the request id to your backend and redeem it with the verify call.
- **[Single-page apps, frameworks and tag managers](https://noxtica.com/docs/sdk/single-page-apps/):** Load the Noxtica collector once in a single-page app, handle route changes and framework forms, and install it through a tag manager or a CMS theme.
- **[Content Security Policy, hosts and first-party relay](https://noxtica.com/docs/sdk/csp-and-relay/):** Allow the collector and ingest hosts in your Content Security Policy, know what degrades without WebAssembly, and serve the collector from your own subdomain.
- **[Browser SDK troubleshooting](https://noxtica.com/docs/sdk/troubleshooting/):** Match a browser collector symptom to its cause and fix: token errors, consent gating, extension load reasons, CSP, duplicate tags and browser limits.
- **[SDK family and availability: browser, server and mobile](https://noxtica.com/docs/sdk/family/):** What the browser script, the typed browser wrapper, the server and mobile SDKs, Postman and OpenAPI are for, their source versions and how to get access.
- **[SDK Changelog](https://noxtica.com/docs/changelog/):** Release notes for the Noxtica browser collector SDK: what changed in each version, who is affected, what to do, and which @noxtica/sdk version pairs with which collector release.

### Identity verification

- **[Identity verification integration](https://noxtica.com/docs/identity-verification-integration/):** Create a hosted identity verification session from your server, send the customer to the link, and read the outcome by status read or signed event.
- **[Self-hosted identity verification (direct API)](https://noxtica.com/docs/identity-verification-self-hosted/):** Call the identity verification API directly from your server: mint a nonce, run a verification, read the result, and learn what the direct route does and does not cover today.
- **[Invitations and hosted verification settings](https://noxtica.com/docs/identity-verification-invitations/):** Set up the hosted verification page in Backoffice, record the legal basis, send a customer a one-time verification link without code, and read the result.
- **[Identity verification events and webhooks](https://noxtica.com/docs/identity-verification-webhooks/):** Register a signed HTTPS endpoint in Backoffice, verify every delivery, and handle each identity verification event: when it fires, its fields, retries and duplicates.
- **[Noxtica Verification ID (NVID)](https://noxtica.com/docs/identity-verification-id/):** Read a Noxtica Verification ID from the session status or an event, understand its statuses and validity, share the public status link, and revoke or resend it in Backoffice.
- **[Business and merchant verification (KYB and KYM)](https://noxtica.com/docs/identity-verification-business/):** Create hosted business (KYB) and merchant (KYM) onboarding sessions, follow them in Backoffice and receive notify-only events. Availability depends on your organisation.
- **[Verification data: storage, access and deletion](https://noxtica.com/docs/identity-verification-data/):** What happens to identity, business and merchant verification details and evidence over time, who can see them, and how a tenant administrator deletes them.
- **[Identity verification FAQ and troubleshooting](https://noxtica.com/docs/identity-verification-faq/):** Short answers to the questions integrators ask about hosted identity verification: statuses, review, links, keys, events, the Verification ID and data, plus a five-step triage.
- **[Identity verification operations in Backoffice](https://noxtica.com/docs/identity-verification-operations/):** Work the Backoffice KYC pages day to day: read cases, decide the review queue, follow processes, manage policies, screening, recovery, delegations, evidence access and device trust.
- **[KYC Hosted Sessions](https://noxtica.com/docs/kyc-hosted-sessions/):** How long a hosted KYC verification link stays open, and what your backend sees once it expires.

### Observability: RUM, replay, APM and SEO

- **[Observability overview: RUM, replay, APM and ingest](https://noxtica.com/docs/observability/overview/):** Map each browser observability tool to what it measures, the Backoffice page that shows it, what you install, and the consent and legal-basis gates it needs.
- **[Real user monitoring and Web Vitals](https://noxtica.com/docs/observability/rum/):** Turn on real user monitoring for a domain, record its consent and Do Not Track decision, and read Web Vitals, errors and SDK health in Backoffice.
- **[Browser errors, console logs and source maps](https://noxtica.com/docs/observability/errors-and-source-maps/):** Capture redacted JavaScript errors and masked console logs, upload source maps from your build, and read grouped errors on the Issues page.
- **[Session replay: setup, masking and playback](https://noxtica.com/docs/observability/session-replay/):** Arm session replay for a domain, choose what is masked, set sampling and limits, then find and play back recorded sessions in Backoffice.
- **[Custom events, session tags and request tracing](https://noxtica.com/docs/observability/events-and-tracing/):** Send custom events, tag and identify sessions without sending raw ids, and join a browser request to your backend with W3C trace headers.
- **[Behavior analytics: heatmaps, journeys and funnels](https://noxtica.com/docs/observability/behavior-analytics/):** Switch on the tracker for a domain, then read click and scroll heatmaps, page-to-page journeys and app-event funnels in Backoffice.
- **[APM and the ingestion service (OTLP)](https://noxtica.com/docs/observability/apm-and-ingest/):** Mint an Ingestion API key in Backoffice, point an OpenTelemetry exporter at the ingestion service, send a test trace and a release marker, and find them in the APM explorers.
- **[SEO tools: page checks, site crawls and search score](https://noxtica.com/docs/observability/seo-tools/):** Prove you own a hostname, run a single-page SEO check or a bounded site crawl in Backoffice, read the issues and the search score, and see Core Web Vitals history.
- **[Connect Google Search Console for a domain](https://noxtica.com/docs/observability/search-console/):** Connect a domain to its own Google Search Console property with a service account key or your own OAuth client, test the connection, and use it as ownership proof for SEO tools.
- **[Uptime checks, alerts, status reports and the status page](https://noxtica.com/docs/observability/uptime-alerts-status/):** Add verified uptime checks, route alerts to Slack, Teams, Telegram, e-mail or a signed webhook, turn periodic status reports on or off, and follow the public status page and its Atom feed.

### Hunter, Spot and Pulse

- **[Hunter browser extension](https://noxtica.com/docs/hunter/extension/):** Run a local audit of which scripts on one page probe browser fingerprinting APIs, read and export the report, and optionally send one previewed report to your Noxtica workspace.
- **[Hunter reports in Backoffice](https://noxtica.com/docs/hunter/reports/):** Create a short-lived upload token, review Hunter page-audit reports your team sent to the workspace, download the stored JSON, and delete one report or every report from one reporter.
- **[Spot captures](https://noxtica.com/docs/hunter/spot/):** Connect the Spot extension with a short-lived token, record one tab or desktop capture with bounded developer context, then review, share and delete captures in Backoffice.
- **[Noxtica Pulse: endpoint telemetry overview](https://noxtica.com/docs/pulse/overview/):** Understand what Noxtica Pulse is, who sees what, how Backoffice configures it, what the desktop client and the player site do, and where the privacy controls and server API are.
- **[Pulse in Backoffice: applications, profiles, bundles and rollouts](https://noxtica.com/docs/pulse/backoffice/):** Register a Pulse application, author and validate a profile, publish it as a signed bundle, follow the staged rollout, and halt, resume or roll back from Backoffice.
- **[Pulse detections, response, devices and privacy](https://noxtica.com/docs/pulse/detections-and-privacy/):** Review Pulse detections with a person in the loop, answer appeals, set the response ladder, manage devices and attestation, read the privacy page, and use the tenant API and webhooks.

### Security administration and attestation

- **[Device and app attestation](https://noxtica.com/docs/security/attestation/):** Register Android and iOS apps for Play Integrity and App Attest, call the two mobile attestation routes from your backend, and read the results in Backoffice.
- **[Sign-in, SSO, SCIM, MFA and IP allowlist](https://noxtica.com/docs/security/sign-in-and-access/):** Set up how your team signs in to Backoffice: passwords, authenticator apps, security keys, SSO, SCIM, a tenant-wide MFA rule, IP allowlists, sessions and invitations.
- **[Roles and permissions](https://noxtica.com/docs/security/roles-and-permissions/):** See what the viewer, analyst, admin and billing roles can do in Backoffice, which actions need a step-up MFA check, and how admins manage users, disabling and MFA resets.
- **[Audit log and data export](https://noxtica.com/docs/security/audit-log-and-exports/):** Read who changed what in your Backoffice workspace, filter and export the audit log, run a data export, and review export history. Includes limits and the API export route.

### Backoffice guide

- **[Backoffice guide: navigation, roles and shortcuts](https://noxtica.com/docs/backoffice/overview/):** Find any Backoffice page, see which role can open it, and move faster with the command palette, G shortcuts, the workspace switcher and page help.
- **[Domains, site keys and the install card](https://noxtica.com/docs/backoffice/domains/):** Register a domain, copy its public site key, open the install card, and manage the per-domain settings, key rotation and deletion in Backoffice.
- **[Fingerprints, analytics and live monitoring](https://noxtica.com/docs/backoffice/fingerprints-and-analytics/):** Search device fingerprints, read a device record, watch live traffic, compare devices and use the analytics, geo-risk and hardware attestation views in Backoffice.
- **[Risk actions, investigations and entity lookup](https://noxtica.com/docs/backoffice/risk-actions-and-investigations/):** Use Risk Actions, Agentic Security, Bot Intelligence, Behavioral Corroboration, Investigations, Entity Lookup and Quality & Calibration to validate policy before you enforce it.
- **[Detection and collection settings](https://noxtica.com/docs/backoffice/detection-settings/):** Tune rules, risk scoring, client cost levels, verdict bands, honeypots, the collector refresh interval, probes and behavioral signals, and roll changes out in a safe order.
- **[Integrations and API pages](https://noxtica.com/docs/backoffice/integrations/):** A map of the Integrations & API sidebar group: what each page does, who can open it, which credentials it mints, and which documentation page covers it.
- **[Event sinks (SIEM export)](https://noxtica.com/docs/backoffice/event-sinks/):** Create an event sink that pushes signed verdict and audit events to your SIEM, arm it, send a test request, inspect deliveries and rotate its signing secret.
- **[AI assistant, MCP tokens and coding-agent keys](https://noxtica.com/docs/backoffice/ai-assistant-and-mcp/):** Open the Backoffice assistant, set model routing and provider keys, mint MCP tokens with read scopes, and create coding-agent keys, with the limits Backoffice shows.
- **[Workspace gates, feature flags, data operations and mobile operations](https://noxtica.com/docs/backoffice/workspace-settings/):** Use Workspace Gates, visitor Feature Flags, Data Operations, Mobile Operations and your personal Settings and Notifications in Backoffice, with the roles and MFA checks each needs.

### Billing and usage

- **[Plans, packages and add-ons](https://noxtica.com/docs/billing/plans-and-packages/):** Request a plan change or extra capacity, compare and subscribe to packages, turn module add-ons on, and read why an item is unavailable before you click it.
- **[Usage, quotas and metering](https://noxtica.com/docs/billing/usage-and-quotas/):** Read your usage against plan quotas in Backoffice: the Usage & Quotas tabs, the meters, how each quota counts, what happens at the limit, KYC usage, and how to set a quota alert.
- **[Wallet, invoices and reports](https://noxtica.com/docs/billing/wallet-invoices-reports/):** Add funds to your wallet, set a low-balance warning, read the ledger and AI credits, open invoices, review sent reports, and control status-report e-mails in Backoffice.
- **[Billing status, grace period and reminders](https://noxtica.com/docs/billing/status-grace-reminders/):** Understand the Backoffice billing banners, the package grace window and what pauses when it ends, and the schedule of billing reminder e-mails, so you can act before service pages pause.

### Compliance and legal

- **[Privacy and compliance controls in Backoffice](https://noxtica.com/docs/compliance/overview/):** Find every Privacy & Legal and Web Analytics & Privacy page in Backoffice, who can use it, what it records and which docs page explains it.
- **[Legal basis register and receipts](https://noxtica.com/docs/compliance/legal-basis/):** Record, change and withdraw the legal basis your organisation asserts for gated features, and learn which features refuse to start without a receipt.
- **[Data retention, raw IP storage and data locations](https://noxtica.com/docs/compliance/retention-and-locations/):** Set how long browser intelligence data is kept, decide whether full IP addresses are stored, and read where each kind of your data is stored.
- **[Data subject scope, erasure requests and account deletion](https://noxtica.com/docs/compliance/requests-and-deletion/):** Learn which deletion routes exist in Backoffice, how an administrator removes end-user data, and how identity verification data and accounts are deleted.
- **[Cookies, storage and consent categories for your site](https://noxtica.com/docs/compliance/cookies-and-storage/):** List the cookies and browser storage the Noxtica SDK writes, map each to a consent category, disclose them in your cookie policy and set DNT and GPC behaviour.
- **[DPA, sub-processors, DPIA pointers and assurance](https://noxtica.com/docs/compliance/assurance-and-subprocessors/):** Find the public DPA and sub-processor pages, accept the AI assistant as a sub-processor in Backoffice, and know where to ask for DPIA and assurance material.

<!-- docs-map:end -->

## Risk Levels

Every assessment can include a numeric score and one of five plain-language levels. The fixed ranges below describe the current public response contract; they are not universal action thresholds.

| Score  | Level      | Interpret as                                     | Common starting action                                 |
| ------ | ---------- | ------------------------------------------------ | ------------------------------------------------------ |
| 0–19   | `minimal`  | Little risk evidence in the available assessment | Allow; retain normal controls                          |
| 20–39  | `low`      | Minor or explainable anomalies                   | Allow and observe                                      |
| 40–59  | `medium`   | Mixed or incomplete suspicious evidence          | Observe or use a low-friction step-up                  |
| 60–79  | `high`     | Strong suspicious evidence                       | Challenge, hold, or review                             |
| 80–100 | `critical` | Multiple or strong reason families agree         | Strong challenge or block only under a reviewed policy |

Confidence answers a separate question: how much usable evidence supported the assessment. Low confidence should normally move a decision toward defer, collect more evidence, or a reversible challenge—not toward an irreversible block.

## Dashboard

Manage your activated account in **[Backoffice](https://backoffice.noxtica.com)**. Start with the selected tenant and domain, then use **Analytics** for population behavior, **Fingerprints** for individual records, **Risk Actions** for policy outcomes, and **Usage** for current limits. The pages you see depend on your role and enabled modules.

## At a Glance

- **Integration model:** domain-bound browser Site Key plus optional scoped server credentials.
- **Primary output:** score, five-level risk tier, confidence, named flags/reasons, and a tenant-scoped device handle.
- **Collection cadence:** cached and configurable; `checkOnce()` respects the applicable interval.
- **Decision owner:** your route-specific policy; Noxtica supplies evidence and eligible enforcement surfaces.
- **Availability:** plan, contract, role, tenant/domain configuration, client support, quota, and legal-basis gates can apply.
- **Performance:** measure your selected client, configuration, geography, network, and cache mix; this page makes no universal latency or availability commitment.

## Support

- **Access, provisioning, commercial eligibility, or technical support:** [Contact us](https://noxtica.com/contact/).
- **Before opening a ticket:** include the tenant and domain, timestamp, customer-visible symptom, relevant request or device handle, and whether the result was cached. Do not send Server API secrets or unnecessary personal data.
- **Capability question:** link the applicable [capability family](https://noxtica.com/docs/features/) and note whether its page or setting is visible in Backoffice.