Skip to main content
For your web, privacy and security teams. Lists what baselayer.js sends from your pages to Baselayer.

​
For Security Review

For the Content Security Policy entries, see Set Up baselayer.js.

​
Record Kinds

baselayer.js sends four kinds of record. Each carries a record ID, when it happened, the visit’s cookie value and the page’s path template. At most 200 records are sent for one page. A page_exit always goes, and carries the number dropped past that limit as dropped_count.

​
Path Templates

A record carries a path template, never the URL. The query string and fragment are removed, and each segment shaped like an identifier becomes {id}: a UUID, a number of 4 or more digits, a long hex or mixed-case token, or anything holding @. /orders/8812/items is sent as /orders/{id}/items. Other segments are sent as they are. If your paths can hold a name or another personal value in a lowercase segment, pass your route templates in routes or exclude those pages with excludePaths. See Options.

​
What Is Never Sent

  • Typed text, form values, query strings and fragments.
  • The text, value or href of an element anyone clicks.
  • Anything on a copy or paste in a password field or a card field (autocomplete="cc-*").
  • Anything at all from a page that matches excludePaths.
  • Anything at all when init gets consent: false.
The snippet keeps one first-party cookie, baselayer_visit: 32 random hex characters, SameSite=Lax, Secure on https pages, 30 minutes from the last record. It is not HttpOnly, because your KYA SDK reads it to join your server’s requests to the same visit. Its value travels inside the records, never as a cookie sent to Baselayer.

​
Detection

The snippet loads a detection script from your application’s collect host, https://<application id>.collect.baselayer.com, and Baselayer reviews every version of that script before it is served. The detection result stays with Baselayer: the snippet only gets the token that token() returns, which your KYA SDK checks. The snippet never receives a verdict about a visitor. It cannot block, challenge or change anything on your page. Decisions are made by your KYA SDK, on your server.

​
Humans Are Never Stored

KYA records agent traffic only. The snippet can’t tell a person from an agent, so it sends the same records for every visit. Baselayer holds a visit’s records for up to 2 minutes while detection decides, and drops them unwritten when the verdict is a person or when no agent verdict arrives in time. To see browser records while you set up, test on staging.

​
Delivery

Records are sent to the API origin you passed as apiOrigin every 5 seconds, sooner when 50 are queued, and when the page is hidden or closed. A failed send is retried with backoff. A record carries a unique ID, so a retried record is never counted twice.