Skip to main content

​
Web Edge

Web Edge Sessions Shown but not edited: the CNAME target, the DNS records, the four-step progress rail, the bot-check sitekey and the hostnames it covers. Allowed origins are stored with the Form Processing settings, which is why their change history appears on that screen. Format is scheme://host[:port]: no path, no wildcard, exact match. One list governs both form capture and event capture.

​
Form Processing

Settings → Form Processing Two-sided settings. A form’s own honeypot field name overrides the account default, but switching the check off account-wide beats both. Bot protection needs the account provider and the form’s opt-in. Settings → Consent Provider Consent text versions are append-only: no edit, no delete.
No tracking before opt-in does not gate page views or the identity cookie on landing pages allGood hosts. See What consent gates.

​
Web Tracking

Settings → Web Tracking Key lifecycle: Issue, then Rotate (the old key works until the new one lands) or Revoke (every event refused; the record is kept). See Rotate or revoke.

​
Landing Page

Settings → Landing Page

​
Per-form settings

Not on a settings screen — these live on the form itself and reach allGood when the form is registered. Publishing the form registers it, so registration requires a published version. An unregistered form refuses every submission.
Because the endpoint is schemaless, a hand-built POST isn’t checked against the declared fields. That’s deliberate — the field check exists so a visitor can fix their input, which is only possible in a browser.

​
Fail-closed defaults

If allGood finds no settings for an account, it falls back to the strictest position rather than a permissive one. A missing value never means “allow”. “The sync hasn’t landed yet” must never quietly become “the allowlist is off”.

​
Change history

Every settings screen records who changed what and when, append-only, at the bottom of the page. Saving any of these settings, including the origin allowlist, and issuing, rotating, or revoking a tracking key, needs the Admin or Power user role. There is no separate permission per screen. The Standard role can view but not change them.