Measurement that discards its own evidence, on purpose.
The design goal is insight about non-consented traffic at an accuracy that makes the absence of user-level data tolerable, without at any point holding a re-identifiable record beyond a bounded window that is then destroyed.
Six steps, then nothing is left.
Steps 1 to 6 target a p99 of under 15 ms of added latency. By the end of step 6 there is no artefact from which a visitor could be reconstructed.
- 01
Edge collection
A Cloudflare Worker reads only what the HTTP request already carries: headers, TLS metadata, provider-supplied geo and ASN. It runs no device-interrogation JavaScript.
- 02
Enrichment
Country, coarse region, ISP name, connection type, VPN/proxy/Tor flag, device family, OS family, page group and referrer host. All derived in memory at the edge.
- 03
Security scoring
Signals go to the isolated security lane, which keeps its own copy under its own TTL and returns a bot label and a confidence score. Nothing else crosses back.
- 04
Token derivation
An HMAC over the truncated IP, user-agent family, country and time bucket, keyed by a per-tenant per-window salt that exists only in locked process memory.
- 05
Sketch update
The token updates a HyperLogLog sketch keyed by tenant, date, country, page group, device family and bot label. The sketch stores no raw values.
- 06
Discard
The token, the truncated IP and the raw user-agent are zeroised. Nothing from steps 4–5 reaches durable storage except the sketch itself.
A key that destroys itself at the window boundary.
Counting unique visitors needs a way to recognise a repeat. INSIGHTS derives a token per request, uses it to update a probabilistic sketch, then destroys it. The token never enters a log, a trace, a queue, a cache, an error message or any durable store.
The salt that keys the token is per-tenant and per-window, held in locked process memory. When the window ends, the salt is destroyed, which makes linking a visitor across two windows cryptographically impossible rather than merely forbidden.
Windows are restricted to 1, 7, 14 or 30 days, and a tenant’s jurisdiction profile governs which of those they may select.
token = HMAC-SHA256( salt[tenant, window], truncated_ip ‖ ua_family ‖ country ‖ time_bucket )
Why the monthly number is an estimate, and says so.
Deduplication removes repeats inside a window. It cannot remove them across windows, because cross-window linkage is deliberately impossible. So summing daily uniques over a month over-counts: someone who visited on five days is counted five times.
A revisit factor corrects for it: the mean number of distinct days a visitor appears in a month, estimated from the consented cohort where cross-day linkage is lawful.
What keeps this lawful
- The training query returns aggregates only. A per-visitor table is never materialised into the modelling service.
- Model artefacts contain coefficients, not embeddings and not per-visitor features.
- A minimum cohort size (default 500) per segment. Any segment below it falls back to its parent’s coefficient, so no coefficient can describe a handful of identifiable people.
- Coefficients are per-tenant and never pooled across tenants.
Small groups are withheld, not estimated.
When a cell falls below the suppression threshold it is returned as suppressed. It is never inferred from its neighbours, never back-filled, and never reconstructed by differencing two queries. A withheld cell stays withheld, which is the whole point of it.