What does a CAPTCHA process, and what does the FADP ask of your site?

What does a bot check receive?

As soon as a visitor’s browser loads a service’s script or sends it a request, that service receives what any server receives: the IP address, the User-Agent and the headers of the request. Many services add measurements made in the browser, and some set a cookie. For Antisy, the Data section of the home page gives every measurement and every duration.

The script measures what the browser declares and how the page is used; Antisy’s server reads the IP address, the User-Agent, the order of the HTTP headers and the request context. Never the image drawn, the name of the graphics card nor the content of the keystrokes and the fields. Your site does not receive these measurements: it receives a token, then a verdict. These data include personal data.

See: Home page: what the script measures, and for how long · Documentation: data collected and privacy

Does a puzzle change anything?

For data protection, what counts is what the service reads and keeps. Whether it shows the visitor a puzzle or not does not change what it receives from them. Antisy shows none, and yet processes personal data.

Who is the controller, who is the processor?

The act calls controller the person who, alone or jointly with others, determines the purpose and the means of processing personal data (art. 5, letter j), and processor the one who processes personal data on behalf of the controller (art. 5, letter k). By placing a service on its form, your site decides on this processing. Whether the provider is your processor depends on its agreement and on what it does with the data: look for the answer in its data processing agreement.

For Antisy, your site is the controller and Antisy is the processor. It processes the data for a single purpose, telling human visitors from automated programs, and never uses it for advertising.

See: The FADP and Antisy: who is the controller, who is the processor · Model data processing agreement

The six questions to ask a provider

Look for the answers in writing, in its documentation, its privacy policy and its data processing agreement. A missing answer, or one that changes from one page to the next, is already information.

1. What does it read, and what for? A list of the data, family by family, the purpose of each, and what it does not read.
2. What does it keep, and for how long? One duration per piece of data rather than one overall duration, and what remains in the backups.
3. Where are they processed? The name of the provider that hosts them, the city, and whether any data leaves Switzerland. The act governs the disclosure of personal data abroad: the person who advises you says what that changes for you.
4. Who has access? Who, at the service, can read your visitors’ data, and how that access is recorded.
5. Who are its sub-processors? The list by name, what each one receives, and how a change is announced to you.
6. What happens to the data at the end of the agreement? Its return, its erasure and a written confirmation.

See: Antisy’s answers, question by question

What must your site tell its visitors?

The act requires the controller to inform the data subject when collecting personal data: as a minimum the controller’s identity and contact details, the purpose of processing and, if applicable, the recipients or the categories of recipients (art. 19, para. 1 and 2). A provider that receives your visitors’ data may be one of them.

Describe the bot check in your own privacy policy and name the provider. Antisy’s data processing agreement offers a model text to adapt; Antisy’s privacy policy describes what Antisy does on its side.

See: Antisy’s privacy policy · Model data processing agreement

Where can I read what each service documents?

The comparisons give, for reCAPTCHA, Turnstile, hCaptcha and Friendly Captcha, what their documentation says about the company, the cookies and the integration, with the address read and the date it was read. If the documentation says nothing on a point, the page says nothing. Where Antisy is and where its data are: the page on Swiss bot protection.

See: Comparisons: Antisy and the other services, with dated sources · Swiss bot protection: what “Swiss” means at Antisy

What this page does not say

• It does not say that a service, or your site, abides by the FADP: only a person who gives legal advice can say so.
• It does not rank services on data protection: each comparison gives what the service documents, on the day it was read.
• It says nothing about the rest of your site: what it keeps, where it is, how it handles its visitors.

Antisy is neither a firewall, nor a protection against flooding attacks, nor a payment anti-fraud tool. No bot check is perfect, and Antisy announces no detection rate.

See: Frequently asked questions: does Antisy stop every bot?

Where does Antisy stand?

Access is by waiting list. The API and the dashboard have been in service since 27 October 2026, hosted at Infomaniak in Geneva; no customer is in production yet. The pilot started on 9 November 2026 on our own forms.

Protecting a login or a sign-up goes through a Node SDK (Express, Fastify, Next.js) whose name is reserved on npm; its version 1.0 is not yet published.

See: The pilot · Join the waiting list

Frequently asked questions