Privacy-first bot detection.
We score behavior, not people. No PII on the wire, short retention, split keys, and a verdict path that fails open.
No PII, by design
The SDK collects behavioral aggregates — entropy, velocity, counts. Not keystroke content, not mouse coordinates, not form values. There is no personal data to leak.
Fails open
The verdict path is built to degrade safely. Unknown session or service trouble returns allow with score 0 — Botect can never become the reason a real user is blocked.
Split keys
A public site key drives browser ingest; a secret private key reads verdicts server-side. Private keys are stored only as SHA-256 hashes and rotate on demand.
Short retention
Raw events are retained for 30 days, then aged out. You keep the scores and aggregates you need; we don’t hoard the raw signal.
Real client IPs, locked
Client IPs are promoted from your trusted edge (e.g. CF-Connecting-IP), so scoring sees real addresses — with origin locking so the header can’t be spoofed.
Tenant isolation
Every project is account-scoped end to end. Keys, sessions, rules, and verdicts never cross the tenant boundary.
What we collect — and never store.
What Botect collects
- Behavioral aggregates — mouse entropy, scroll velocity, visibility, first-input delay
- Automation tells — webdriver flag, headless fingerprints, navigator anomalies
- Request context — user-agent string, header shape, ASN / IP reputation
- A per-session token and the resulting 1–99 score
What it never collects
- Keystroke content or anything typed into a field
- Raw mouse coordinates or screen recordings
- Form values, passwords, or payment details
- Cookies or cross-site identifiers for ad tracking
From browser to verdict.
Collected in the browser
The SDK computes behavioral aggregates locally and posts them over HTTPS. Nothing identifying ever leaves the page.
Scored off the request path
Events land on ingest and are scored asynchronously — never inline with your user’s request, so the page is never blocked.
Read as a verdict
Your backend reads the cached verdict with its private key over TLS — <50ms p99, and fail-open by design.
Aged out
Raw events are deleted after 30 days. You keep the scores and aggregates you need; we don’t hoard the raw signal.
Built to pass a security review.
Collecting no PII removes the riskiest data from the picture entirely — what’s left is a small set of controls that are easy to reason about.
- PII-free by design — simplifies GDPR & CCPA obligations
- Encrypted in transit (TLS) and at rest
- Strict tenant isolation — account-scoped end to end
- Private keys stored as SHA-256 hashes, rotatable on demand
- Activity logging on sensitive account and key actions
- DPA and sub-processor list available on request
Running a vendor security review? Email us and we’ll get you what you need.
Report a vulnerability
Found something? We want to hear about it. Reach the team directly and we’ll respond fast — responsible disclosure always welcome.
Protection that respects your users.
Sign up and run Botect in observe-first mode — no PII, no blocking, until you’re ready.