Device Fingerprint API — Developer Compliance Guide

Device Fingerprint API — Developer Compliance Guide

Effective Date: May 19, 2026 Document Version: May 2026 Legally Binding Original Language: English

This guide is for B2B integrators using the PaperOffice Device Fingerprint / Device Intelligence API. It does not replace legal advice. The English version is binding.

1. Role Allocation (Default)

PaperOffice does not provide consent banners or per-call legal-basis validation. Maximum API features remain available; compliance obligations stay with Customer as Controller.

2. Integration Checklist

Before production use, Customer should confirm:

1. Lawful basis documented (e.g. Art. 6(1)(f) GDPR legitimate interest where applicable — Customer decides).
2. Privacy notice updated to describe device fingerprinting, purposes (fraud prevention, authentication, abuse detection), and retention.
3. DPA generated and accepted via the in-platform Compliance Package.
4. Bearer authentication — all data endpoints require a valid account context.
5. Tenant scope — fingerprint data is isolated per workspace (root account) by default.
6. Retention — default 90 days; configurable up to 365 days per account settings.
7. Art. 17 delegation — implement POST /privacy/forget when erasure is required.
8. Network Intelligence — cross-tenant network_pool=true only after separate contractual approval (legal@paperoffice.ai).
9. No raw signal storage expectation — PaperOffice stores hashes and metadata, not raw canvas/audio payloads in the database.
10. Sub-processors — review the public Sub-Processor List and generated Compliance Package.

3. Key API Endpoints

Each identify response includes a compliance object with data_categories, tenant_scope, retention_default_days, and customer_responsibility_notice.

4. Art. 17 Forget (Example)

``bash curl -X POST https://api.paperoffice.ai/latest/privacy/forget \ -H "Authorization: Bearer YOUR_TOKEN" \ -H "Content-Type: application/json" \ -d '{"visitor_id": "VISITOR_ID_HERE"}' ``

Re-ingestion of forgotten identifiers is blocked (IDENTIFIER_FORGOTTEN).

5. Privacy Notice Snippet (Template for Customer)

> Where we use device fingerprinting through PaperOffice AI, we process technical device and network characteristics (such as browser signals, hashed canvas/WebGL fingerprints, IP-derived metadata, and fraud-prevention scores) to secure our services, prevent abuse, and detect fraud. PaperOffice Enterprise Operations, S.L.U. acts as our processor under Article 28 GDPR. Data is processed in the EU. Default retention is 90 days unless we configure a shorter or longer period (maximum 365 days). You may exercise your rights under applicable data protection law by contacting us at [CUSTOMER CONTACT]. We will instruct our processor to delete relevant fingerprint records where required.

Customer must adapt this text to its jurisdiction and legal basis.

6. Network Intelligence

The optional Network Intelligence addon enables cross-tenant similarity pools when network_pool=true is set and the addon is approved for the account. Without approval, pool requests return 403 NETWORK_INTELLIGENCE_NOT_ENABLED.

Customer must ensure end-user disclosure where required before enabling cross-tenant features.

7. Related Documents

• Sub-Processor List
• TOM Reference
• DPA Reference
• Postman: https://api.paperoffice.ai/latest/docs/postman

Last updated: May 19, 2026

© 2002–2026 PaperOffice Enterprise Operations, S.L.U. All rights reserved.