Account clusters

Find accounts that may belong to the same actor. Send account: {id, email} with successful /v1/verify requests. Either field is optional. Use your own opaque account id for id, instead of an email address.

What links accounts

Accounts join a cluster when they share a browser visitor id, fingerprint or normalized email address. Links are transitive: if A shares a browser with B and B shares an email with C, all three join one cluster. A shared email domain alone does not link accounts. Networks never join accounts because offices and carrier NAT can serve different actors. Treat a cluster as evidence rather than proof of fraud.

Clustering uses each site's most recent 20,000 eligible actor links from the last 30 days. Older links are omitted at high volume. The dashboard shows up to 100 clusters, largest first, and 50 members per cluster. Link counts measure distinct keys shared by at least two members. Cluster ids are opaque and can change when a smaller member joins or old links expire.

Backend API

curl https://nolgard.com/v1/cluster \
  -H 'Content-Type: application/json' \
  -d '{"secret":"sk_YOUR_SECRET","accountId":"user_123"}'

{"size":3,"accounts":["user_123","user_456","user_789"]}

Keep the secret on your backend. Results cover only its site. size includes email-only members; accounts contains only customer account ids, at most 100. An unlinked or unknown account returns size 1 and the supplied id. Requests are limited to 60 per minute per site (429). Invalid input returns 400; an invalid secret returns 401; the public demo returns 403. Test secrets return {"size":1,"accounts":["user_123"],"test":true}.

Review and alerts

Open Clusters next to Events. Expand a cluster to review its members. Choosing Fraud or Legit labels every member's last verification and applies the same device reputation feedback as individual event labels. Demo data is read-only. Hourly alerts use your existing integrations when a cluster reaches five accounts or grows beyond its last announced size.

Privacy

Account ids are stored exactly as sent (up to 256 characters). Account directory emails show only the first character and domain, such as a•••@example.com. Correlation identifiers use per-site salted hashes. No raw IP is stored. Account directory rows are removed after 30 days without verification. See Privacy and DPA.