Skip to content
Antisy
Waiting list

Bot protection for your forms, with no puzzle to solve.

One tag in the page, one call from your server, and a verdict: allow or deny. You decide what happens next.

Join the waiting listSee the integration

Antisy Sàrl, a Swiss company entered in the Geneva commercial register. Access by waiting list; API and dashboard in service since 27 October 2026, hosted in Geneva.

An attack, repelled

In this drawing: 19 attempts, 5 let through, 14 refused. An illustration, not a measurement.

  1. The calm

    A few visitors send their form. Each submission leaves with its token, for a single use; your server asks Antisy, and the verdict comes back: allow.

  2. The attack

    Two rows of automated programs send in bursts. The submissions arrive in a tight queue at the door of your site.

  3. One question per submission

    For each one, your server makes a single call to Antisy, with the token it received.

  4. The verdicts fall

    One by one. deny for the submission without a token (browser collection on), for the token already used, for the pace of an automated program; allow for the visitors, in the middle of the attack.

  5. This attack, repelled

    The refused submissions stay at the door, the way in stays open. The verdict goes back to your server, never to the browser. You decide what happens next.

Integration

One tag, one form, one call.

No JavaScript to write for an ordinary form: Antisy’s script fills in the token field on submission.

  1. 01

    One tag

    In the <head> of the page that carries the form. data-site is your public key: no secret in the page.

    HTMLyour page
    <script src="https://api.antisy.com/v1/i/l.js"
        data-site="VOTRE_CLE_DE_SITE" defer></script>
  2. 02

    One form

    Yours, as it is, sent by POST to your site. On submission, the script adds a hidden field, antisy-token, with a short token for a single use.

    HTMLnothing to add
    <form method="post" action="/contact">
  <input name="email" type="email">
  <button>Envoyer</button>
</form>
  3. 03

    One call

    From your server, with your secret key. The answer says whether the visitor passes, without giving the reason.

    Nodeyour server
    const res = await fetch(
  "https://api.antisy.com/v1/siteverify",
  {
    method: "POST",
    redirect: "manual",                 // no redirect followed
    signal: AbortSignal.timeout(3000),  // 3 s at most
    body: new URLSearchParams({
      secret: process.env.ANTISY_SECRET,
      response: req.body["antisy-token"] ?? "",
    }),
  },
).catch(() => null);

let verdict;
if (res === null || res.status >= 500 || res.status === 429) {
  verdict = "allow"; // Antisy does not answer, or 429: the submission passes, log it
} else if (res.status !== 200) {
  verdict = "deny";  // an error in your call, to fix
} else {
  const result = await res.json().catch(() => null);
  verdict = result?.success === true ? "allow" : "deny";
}
// verdict: "allow" | "deny"

    PHP, Python, Go, curl, timeout and outage: the documentation

The rules that do not change
  • Two outcomes, allow or deny, without giving the reason. An invalid, forged, replayed or expired token never passes; nor does a missing token while the site’s collection is on. The visitor sees nothing.
  • How strictly to refuse is set site by site, on the dashboard (in French):
    Strict
    Refuses earlier, at the risk of inconveniencing a few real visitors.
    Balanced
    The default setting: a compromise between the other two.
    Permissive
    Refuses only clear-cut cases, at the risk of letting more bots through.
  • If Antisy does not answer within 3 seconds, let the submission through and log it: an outage on our side must not block your visitors.
  • The page must be served over HTTPS: without a secure context, the browser produces no token.
  • A submission with no submit event (by fetch or form.submit()), or sent to another window, asks antisy.token() for the token: see the documentation of the script.
  • Login and sign-up go through another call, assess, which ties the token to the account. Its Node server kit will be published on npm; it is not yet.
  • The API answers on api.antisy.com, in service since 27 October 2026; access is by waiting list.

Data

Measured, kept, erased: written in advance.

Browser measurementsa few minutes; part of them, 30 days if keeping is switched on for the site (off by default)
A few minutes
IP address, User-Agent, request contextand the digest of the order of the HTTP headers
30 days
Sign-in identifier, outcome of the attemptencrypted and hashed
90 days
The rest of the recordverdict and its detail, browser family, timestamps; then the record is deleted
180 days at most

Proportional scale, from the attempt. Durations decided by Antisy.

What is measured

In the browser, by the script

  • The capabilities the browser declares: memory, number of cores, screen, touch points and pointer type, connection type, cookies, PDF viewer and WebGL2 available or not.
  • The languages and the time zone of the browser: the languages without the region, and the offset of the time zone.
  • The graphics rendering and the fingerprint of the device: a small image drawn then measured, the class of the graphics processor (Apple, Intel, NVIDIA…) and digests of its characteristics, salted per site (canvas, WebGL, fonts, audio…), never the image nor the name of the graphics card.
  • Signs of automation: a browser driven by a program, an inconsistent environment. Categories, never the value read.
  • The behaviour of the JavaScript engine: calculations, layout, clocks, execution times, order of tasks.
  • The course of the interaction: first events, keystrokes, presses, distance and regularity of the pointer, scrolling, duration, page visible and in the foreground or not. Counters and aggregates, never the path nor the content of the keystrokes and the fields.

On reception, by Antisy’s server

  • The order of the HTTP headers: a digest of their names, never their values.
  • The IP address: that of the request, encrypted in the database while it is kept.
  • The User-Agent: that of the request, encrypted in the database while it is kept.
  • The request context: accepted language, names of the headers present, referrer host, path, method, characteristics of the connection (TLS and HTTP versions, negotiated protocol, Client Hints) and, if your server passes them on, the time taken to fill in the form and the rank of the attempt; encrypted in the database while it is kept.
The detail: each piece of data, encrypted or in clear
Retention of visitor data, from the attempt
DelayWhat happens
A few minutesMeasurements sent by the browser for a token: kept encrypted for a few minutes, the time it takes to verify the submission, then deleted. If keeping is switched on for the site (it is off by default), some of them are kept for 30 days, encrypted: the graphics rendering measured, the class and two digests of the graphics processor, the behaviour of the JavaScript engine and the signs of automation; neither the capabilities the browser declares, nor its languages and time zone, nor the overall fingerprint of the device, nor the course of the interaction.
30 daysIP address, User-Agent, request context (accepted language, names of the headers present, referrer host, path, method; characteristics of the connection: TLS and HTTP versions, negotiated protocol, presence of Client Hints, digest of the order of the headers; and, when the site passes them on, the time taken to fill in the form and the rank of the attempt in the session) and event identifier chosen by the site, encrypted while they are kept; digest of the order of the HTTP headers, encrypted at rest (their names, never their values); results of the verification of the token: all erased from the record. No prefix or digest of the IP address is kept beyond that. The event identifier also has, apart, a blind index (a keyed digest) used only to recognise the retry of the same attempt: it is erased after 25 hours.
90 daysSign-in identifier (encrypted and hashed), outcome of the attempt, outcome reports sent by the site: erased.
180 days at mostWhat remains (verdict, score, reasons, browser family, event type, timestamps): the record is deleted.

These durations are the ones Antisy applies. The IP address, the User-Agent, the request context and the browser measurements are encrypted in the database while they are kept; the digest of the order of the HTTP headers is also encrypted at rest, 30 days at most. The TLS fingerprint (JA4) is not read today.

Who, and where

Your site remains the controller
Antisy acts as processor (FADP art. 9), under contract.
For the security of your site
Never for advertising.
Hosting
Infomaniak, in Geneva, Switzerland. In service since 27 October 2026.

The detail is in the privacy policy and the data processing agreement.

Pricing

Four tiers: one free, three on quote.

Only the Free tier has a displayed price. Access is through the waiting list.

  • Free

    CHF 0

    no credit card

    • 2,500 checks per month
    • 1 site
    • Beyond: not billed, site never blocked

  • Pro

    On quote

    Hosting in Switzerland

    • 250,000 checks per month
    • 10 sites
    • Beyond the quota: set in the quote
    • Priority support

    Contact us for a Pro quote

Join the waiting list

Standard, Pro and Enterprise are on quote: give the tier, your volume and your sites in your message. Only the Free tier has a displayed price.

Nothing is paid online.

Hosting is at Infomaniak, in Geneva, Switzerland, in service since 27 October 2026; see the privacy policy.

Compare every criterion

Free

Price
CHF 0no credit card
Checks included per month
2,500
Sites
1
Beyond the quota
Not billed, site never blocked
Priority support
No
Contract
General terms and conditions
Checks per second (hypothesis)
25
Tokens per minute (hypothesis)
120

Standard

Price
On quoteHosting in Switzerland
Checks included per month
50,000
Sites
3
Beyond the quota
Set in the quote
Priority support
No
Contract
General terms and conditions
Checks per second (hypothesis)
100
Tokens per minute (hypothesis)
600

Pro

Price
On quoteHosting in Switzerland
Checks included per month
250,000
Sites
10
Beyond the quota
Set in the quote
Priority support
Yes
Contract
General terms and conditions
Checks per second (hypothesis)
300
Tokens per minute (hypothesis)
1,800

Enterprise

Price
On quoteHosting in Switzerland
Checks included per month
Negotiated
Sites
Negotiated
Beyond the quota
Negotiated
Priority support
Yes, dedicated contact
Contract
Negotiated contract, availability commitment, processing agreement
Checks per second (hypothesis)
800
Tokens per minute (hypothesis)
4,800

Free, beyond the quota: your site is never blocked. The score no longer decides, so the site is no longer protected by the model; an invalid or falsified token is still refused, and so is a missing token while browser collection is on for the site. The attack remains visible in the dashboard (in French); going over the quota is reported to you once a month by e-mail, at your organisation’s alert address if you have set one.

The rates are hypotheses, to be checked again during the pilot. An attempt beyond the rate of your tier is never refused for that reason: it is marked, counted and assessed normally. Only technical limits, common to every tier and set above their rates, refuse a higher throughput (answer 429).

Audit of your login and your sign-up: on quote, deducted from the first annual Pro or Enterprise subscription.

Frequently asked questions

Short answers to the first questions of an integrator or a decision-maker.

What is Antisy?

Antisy is bot protection for the forms and logins of a website: it checks that a submission comes from a browser and not from a program, without showing the visitor anything.

One tag in the page, one call from your server, and a verdict: allow or deny. You decide what happens next.

Antisy is the product of Antisy Sàrl, a Swiss company entered in the Geneva commercial register.

What is the difference between Antisy and a CAPTCHA?

A classic CAPTCHA asks the visitor to prove they are human: tick a box, recognise images, solve a puzzle.

Antisy asks the visitor for nothing and shows nothing: no box to tick, no puzzle. The script counts the interactions while the visitor fills in the form, has the browser do a short computation in the background and measures it on submission; it is your server that receives the verdict. This kind of check is sometimes called an “invisible CAPTCHA”.

How does Antisy work?

The browser loads Antisy’s script, which shows the visitor nothing. When the form is submitted, the script itself puts a short token in a hidden field named antisy-token.

Your server sends this token to POST /v1/siteverify, with your secret. The answer says allow or deny: the visitor passes, or not. You decide what happens next.

What happens if the script is blocked?

The form is sent all the same, without a token: without an antisy-token field, or with that field empty if the page already carries one. Read it with an empty value by default. This happens with an ad or tracker blocker, an incomplete CSP policy, a page over HTTP, a visitor without JavaScript, or a form the script does not cover and whose page does not call antisy.token(). When the script has held the submission back and the token is slow to come, the form is sent after 6 seconds at most.

What follows depends on the site’s “Browser collection” setting (“Collecte du navigateur” in the dashboard). With collection on, a submission without a token does not pass: verdict deny. With collection off, the missing token is not held against it. A new site starts with collection off.

What data does Antisy process?

In the browser, the script measures the capabilities the browser declares, the languages and the time zone of the browser, the graphics rendering and the fingerprint of the device, signs of automation, the behaviour of the JavaScript engine and the course of the interaction. Antisy’s server reads the order of the HTTP headers, the IP address, the User-Agent and the request context. Never the image drawn, the name of the graphics card nor the content of the keystrokes and the fields.

Antisy also keeps, for a login, a sign-in identifier, encrypted and hashed: the home page details each measurement and each retention period. These data include personal data, which the privacy policy describes.

Where are the data hosted?

Hosting is at Infomaniak, in Geneva, Switzerland. It has been in service since 27 October 2026.

How much does Antisy cost?

Four tiers: Free (CHF 0, 2,500 checks per month, 1 site), Standard (on quote, 50,000 checks per month, 3 sites), Pro (on quote, 250,000 checks per month, 10 sites) and Enterprise (on quote, volume and sites negotiated). Only the Free tier has a displayed price; Standard, Pro and Enterprise are on quote, depending on your volume and your sites.

For a quote, write to support@antisy.com giving the tier, your volume and your sites. Nothing is paid online: access is by waiting list.

Can Antisy be used today?

Not yet. Access is by waiting list. The API has been answering on api.antisy.com and the dashboard on app.antisy.com since 27 October 2026, at Infomaniak, in Geneva; no customer is in production yet.

A pilot is planned; it has not started, and no date is announced. You can leave an address on the waiting list: Antisy will write to you when access opens, and for nothing else.

Waiting list

Access opens as the launch goes on.

Leave an address: we will write to you when access opens, and for nothing else.

By sending this form, you agree to be contacted again by Antisy. See the privacy policy.