---
title: "How we check traces"
description: "What we screen for after upload, what can get a trace held, what a fingerprint contains, and how to appeal."
canonical: https://selltraces.ai/docs/how-we-check-traces
markdown: https://selltraces.ai/docs/how-we-check-traces.md
agents: "Read https://selltraces.ai/SKILL.md before you help someone set up selltraces. Every page is listed at https://selltraces.ai/llms.txt."
---

# How we check traces

What we screen for after upload, what can get a trace held, what a fingerprint contains, and how to appeal.

Labs pay for real sessions, so we check every trace before we list it. The checks run on our servers after the server redaction pass. Most traces list normally, and you don't need to do anything.

## What we look for

Our servers compute a fingerprint from each redacted trace and compare it with traces from every contributor account and with public trace datasets we index. The fingerprint lets us spot:

- the same session uploaded twice, from your account or from someone else's
- near-copies with light edits, such as shifted timestamps, renamed files or re-run redaction
- a session stitched together from parts of other sessions
- a session copied from a public dataset, such as agent traces posted to Hugging Face
- logs that don't match how the agent writes them, for example tool results with no matching tool call, or an agent version released after the session started

## What a fingerprint contains

A fingerprint is a set of numbers. Our servers compute it from the redacted trace, so it never includes text the CLI removed on your machine.

- **Exact hash.** One hash of the whole trace after we normalize whitespace, timestamps, paths and redaction markers. Two traces with the same hash are the same session.
- **Similarity signature.** 128 hashes over short runs of words. We use them to estimate how much two traces overlap without comparing the full text.
- **Segment hashes.** Hashes of a sample of individual messages and tool calls. They catch a session that contains part of another one.
- **Shape signature.** Hashes of the sequence of event types, sizes and gaps. They help us spot scripted loops that repeat the same pattern.

We key every hash with a secret that only the screening service holds, and we keep only a sample of the values. A fingerprint can confirm a match. It can't be turned back into your text.

## What the CLI sends for screening

Along with the redacted trace, the CLI sends hashed IDs from your agent logs, token counts, agent version numbers and timing. It sends hashes of the IDs, never the IDs themselves, and never your account email, repo names or file paths.

When you run `selltraces login`, the CLI creates a signing key in `~/.selltraces/` and registers the public half with your account. It signs each upload with that key, so we can tell which install sent a trace.

## What can happen to a trace

| What we find | What happens | Earnings |
| --- | --- | --- |
| Nothing unusual | The trace lists. | Normal |
| The same session uploaded twice from your account | We keep one copy and reject the other as a duplicate. | Paid once |
| A resumed or forked session that repeats an earlier one | The trace lists. | Pays for the new part |
| An overlap with another account's trace | We hold both traces, and a person reviews them. | After review |
| A large match with a public dataset | We reject the trace. | None |
| A small overlap with a public dataset | We hold the trace for review. | After review |
| Logs that don't fit how the agent writes them | We hold the trace for review. | After review |
| A session run by a script or SDK | We label it and may list it at a lower price. | Lower rate |

The dashboard shows each trace's status. Held traces stay unlisted and don't earn until a person clears them.

## If your trace is held

A held trace waits for a person on our team. If the review clears it, it lists like any other trace and earns the same share. A hold on a real session delays its listing and leaves its earnings unchanged.

When two accounts upload the same session, we don't assume the first upload is the original. We compare session times, the hashed log IDs and the account history before we decide.

## If we confirm fraud

If we confirm that an account uploaded copied, spliced or fabricated sessions, we remove those traces, hold related earnings and may close the account. The [contributor terms](https://selltraces.ai/legal/contributor-terms) cover this in Section 6 (your promises), Section 10 (payouts) and Section 13 (termination).

## If we get it wrong

Email hi@selltraces.ai with the trace ID and a short note. A person reviews it and replies within 5 business days.

## Privacy

- We compute fingerprints from redacted content on our servers. We never see the text the CLI removed.
- The hashed log IDs link your sessions to one agent account. We treat them as personal data and use them to prevent fraud, one of the purposes in the [privacy policy](https://selltraces.ai/legal/privacy).
- If you exclude or delete an unsold trace that we never flagged, we delete its fingerprint with it.
- We keep fingerprints of rejected, flagged and sold traces. That stops the same session from coming back through another account.

## What the checks can't do

Every signal comes from files on your machine, so we can't prove a session happened. A careful forger can pass the checks, and some real traces will be held by mistake. We built the checks to make faking traces cost more than it pays, and a person reviews every hold. The [trust page](https://selltraces.ai/trust#cant-guarantee) lists the full set of limits.