Protecting passes
- Challenges and passes are cryptographically signed
- Each pass works once
- Passes expire after five minutes
- Your secret stays on your server
- A pass is tied to the site it was issued for
Security and data handling
How passes are protected, what we process and keep, where it runs, and what happens when things go wrong.
Data we process
- IP address and browser details, to score risk
- Device and page-behaviour signals, and the drag on the puzzle
- Your site key, the page the check ran on and request timing
- Never the contents of your form, cookies or anything typed on your page
What we keep
- Network and device identifiers only as salted hashes that change every day
- Detailed records for 90 days, then deleted
- Daily totals without identifiers, kept for trends
- Final retention periods will be confirmed in our privacy notice
How we run it
- Servers in Germany and Finland, two locations, each able to carry the whole load
- Automatic failover between locations and within the data store
- Error reports from our servers carry no visitor data
- Monitoring around the clock; no public status page yet
Built to lose a machine
Two regions in the EU
The service runs in Germany and Finland, behind two load balancers. If one location fails, traffic moves to the other by itself.
Replicated state
One-time passes live in a replicated store with automatic failover across three locations.
Measured capacity
About 800 full sign-ups a second per server, measured on one 4-core server at 76% CPU. Capacity is added by adding servers.
Error reporting without visitor data
Faults on our servers are reported to an error tracker. Those reports carry no IP addresses, tokens, headers or page content.
What a check can and cannot do
The invisible layer is a proof-of-work. A real browser does it natively in a fraction of a second, and so does a bot that runs a real browser; what changes is the bill for running thousands of them. Browser checks catch tools that do not bother to look like a browser, and a careful tool that copies one will pass them. That is why no single check decides, why the work rises during an attack, and why the server's own view of the request, rate and repetition, counts as much as anything the browser says. New checks are measured on real traffic before they are allowed to count, so that a check which catches real visitors never ships.
Frequently asked questions
Will my customers see a puzzle?
Normal visitors do not. Only traffic that looks suspicious is asked to do more.
Does it slow down my page?
The loader is about 12 KB gzipped, and the work runs on background threads.
What happens if OTCaptcha goes down?
Your form keeps working. Your server treats an unreachable service as a pass and logs it.
Can a bot just block your domain?
No. If our service is up but the browser sends no real pass, your server check refuses it.
Do you stop every bot?
No service can. Our aim is to make automated abuse too slow and expensive to be worth running.
Where is my data processed?
On servers in Germany and Finland. Requests reach them through a content delivery network, which sees the connection like any other website host.
Are you certified or compliant with privacy laws?
We hold no certifications today. Our compliance statement will be published before the service opens to customers.