IPs are hashed
Client addresses are stored salted and hashed, and raw IPs never reach the logs.
Security & privacy
Collect less. Keep it shorter.
A captcha sees every visitor, so it should know as little about them as it can and forget it on a schedule.
Retention is yours
Set log retention per site or workspace between 7 and 90 days. A worker purges what is past the window.
Single-use tokens
A token verifies once. A replay is reported as a duplicate instead of being scored again.
Domain-bound
Tokens are issued for a site's domains, and a sitekey that does not match is refused.
Short-lived
Tokens expire after 120 seconds, so a stolen one is worth very little.
Self-hostable
The whole stack runs from containers on your own infrastructure, with your own secrets and database.
Questions
Found something?
Report security issues to [email protected]. The full privacy policy and terms are public.
Ready to stop the bots?
Start on the free tier. Create a site, copy the sitekey, ship.