Where does enforcement actually happen?

What is the difference between using Monocle to monitor vs. enforce traffic decisions?

Monitor is passive: Monocle provides visibility into how users connect to your application without impacting users or taking any blocking action. Enforce applies actions such as blocking or allowing traffic based on Monocle's assessments. Most users start with a monitoring phase before configuring and enabling enforcement.

What is the difference between Raw Assessment and Policy API?

With Raw Assessment, you decrypt and evaluate traffic yourself for full control. With the Policy API, Monocle evaluates traffic and returns a decision directly, which is simpler to implement.

Which policy strategy should I use?

Allow All applies no blocking rules. Normal is recommended for most use cases. Aggressive blocks all anonymized traffic and carries a higher risk of false positives. Custom (Pro) gives access to all standard options plus more granular assessment attribute-level configuration.

Can I block specific services or countries?

Yes. With a Team plan, you can block or allow specific services, such as VPN providers, and block or allow specific countries using country codes.

Can we decrypt Monocle assessments ourselves instead of calling an API?

Yes — this is already supported at no extra cost. Every Monocle application has both a Secret Key (for the hosted Decryption API) and a Private Key (for manual backend decryption) available in the Monocle Dashboard. Backend decryption lets your own server decrypt the Monocle Assessment locally using the Private Key, without making a call to Spur's Decryption API.