The Swiss FADP and bot protection: who is the controller, who is the processor
With Antisy, your site remains the controller of its visitors’ data, and Antisy acts as processor within the meaning of the Swiss Federal Act on Data Protection (FADP, art. 9), under contract. This page says who does what, which data are processed and how long they are kept.
As of .
Which act is this? The Swiss Federal Act on Data Protection
« Revised FADP » is the common name of the Federal Act of 25 September 2020 on Data Protection, abbreviated FADP in the Classified Compilation of Federal Legislation (SR 235.1). It came into force on 1 September 2023 (art. 74). It has the purpose of protecting the personality and fundamental rights of natural persons whose personal data is processed (art. 1). The act is quoted here in the English translation published on Fedlex: English is not an official language of the Swiss Confederation, and that translation has no legal force.
This page describes the sharing of roles that the act provides for, as Antisy puts it into practice. It is not legal advice: it does not say that your site or Antisy abides by the act, and it replaces neither your own privacy policy nor the data processing agreement. For your case, ask the person who advises you on the law.
Who is the controller, who is the processor?
The act defines the controller as a private person who or federal body which, alone or jointly with others, determines the purpose and the means of processing personal data (art. 5, letter j). The processor is a private person or federal body that processes personal data on behalf of the controller (art. 5, letter k).
For the visitors of your forms, Antisy takes the following view. Your site decides to protect its forms and how to do it: it is the controller. Antisy processes the data of these visitors on its behalf, for one purpose only, telling human visitors from automated programs, for the security of the site: it is the processor. These data are never used for advertising.
See: Glossary: processor
What does the act ask of a processor?
The rules that govern processing by processors, in the words of the act or as close to them as possible:
- The processing of personal data may be assigned by contract or by the legislation to a processor if two conditions are met: the data is processed only in the manner in which the controller itself is permitted to do it, and no statutory or contractual duty of confidentiality prohibits assignment (art. 9, para. 1).
- The controller must satisfy itself that the processor is able to ensure data security (art. 9, para. 2).
- The processor may only assign processing to a third party with prior approval from the controller (art. 9, para. 3).
- The controller and the processor must ensure, by taking suitable technical and organisational measures, a level of data security appropriate to the risk (art. 8, para. 1).
- The processor shall notify the controller of any breach of data security as quickly as possible (art. 24, para. 3).
What does Antisy’s contract provide?
Antisy’s data processing agreement is offered on every tier, including the Free tier. Antisy’s privacy policy and data processing agreement are published. The model agreement provides in particular:
- Antisy processes the data only on documented instructions from your site: the agreement, its settings on the dashboard (in French) and its written requests.
- The authorised sub-processor is Infomaniak, in Geneva, Switzerland (hosting and backups); any addition or replacement of a sub-processor is announced in writing 30 days in advance.
- Antisy assists your site in answering requests for access, rectification and erasure; if a person writes to Antisy directly, Antisy passes the request on to your site.
- Antisy notifies your site of any breach of data security that concerns it within 48 hours of its discovery.
Which data does Antisy process for your site?
In the browser, the script measures the capabilities the browser declares, the languages and the time zone of the browser, the graphics rendering and the fingerprint of the device, signs of automation, the behaviour of the JavaScript engine and the course of the interaction. Antisy’s server reads the order of the HTTP headers, the IP address, the User-Agent and the request context. Never the image drawn, the name of the graphics card nor the content of the keystrokes and the fields.
For a login or a sign-up, Antisy also keeps the account identifier your site passes on, encrypted and hashed.
These data include personal data. Your site does not receive the browser’s measurements: it receives a token, then a verdict. They are used for the security of your site, never for advertising.
See: Documentation: data collected and privacy · Home page: what the script measures, and for how long
How long are the data kept?
The measurements sent by the browser are kept for a few minutes, the time it takes to verify the submission; part of them, 30 days if keeping is switched on for the site, which it is not by default. The IP address, the User-Agent and the request context are erased at 30 days, the sign-in identifier at 90 days, and the whole record is deleted at 180 days at most.
These durations are the ones Antisy applies.
The table follows each piece of data from the attempt to its deletion:
| Delay | What happens |
|---|---|
| A few minutes | Measurements sent by the browser for a token: kept encrypted for a few minutes, the time it takes to verify the submission, then deleted. If keeping is switched on for the site (it is off by default), some of them are kept for 30 days, encrypted: the graphics rendering measured, the class and two digests of the graphics processor, the behaviour of the JavaScript engine and the signs of automation; neither the capabilities the browser declares, nor its languages and time zone, nor the overall fingerprint of the device, nor the course of the interaction. |
| 30 days | IP address, User-Agent, request context (accepted language, names of the headers present, referrer host, path, method; characteristics of the connection: TLS and HTTP versions, negotiated protocol, presence of Client Hints, digest of the order of the headers; and, when the site passes them on, the time taken to fill in the form and the rank of the attempt in the session) and event identifier chosen by the site, encrypted while they are kept; digest of the order of the HTTP headers, encrypted at rest (their names, never their values); results of the verification of the token: all erased from the record. No prefix or digest of the IP address is kept beyond that. The event identifier also has, apart, a blind index (a keyed digest) used only to recognise the retry of the same attempt: it is erased after 25 hours. |
| 90 days | Sign-in identifier (encrypted and hashed), outcome of the attempt, outcome reports sent by the site: erased. |
| 180 days at most | What remains (verdict, score, reasons, browser family, event type, timestamps): the record is deleted. |
These durations are the ones Antisy applies. After 90 days, a record no longer carries the sign-in identifier or the address: it can no longer be found from either of them. See also the data processing agreement.
Where are the data hosted?
Hosting is at Infomaniak, in Geneva, Switzerland. It has been in service since 27 October 2026.
What must your site do?
- Inform your visitors. The act requires the controller to inform the data subject when collecting personal data and to provide as a minimum the controller’s identity and contact details, the purpose of processing and, if applicable, the recipients or the categories of recipients (art. 19, para. 1 and 2).
- Describe the processing in your own privacy policy and name Antisy in it. The data processing agreement offers a model text to adapt.
- Answer the requests of your visitors (access, rectification, erasure): they go first to your site, the controller.
Where does Antisy stand?
Access is by waiting list. The API and the dashboard (in French) have been in service since 27 October 2026, hosted at Infomaniak in Geneva; no customer is in production yet.
See: The pilot · Join the waiting list
Frequently asked questions
Is Antisy the controller or the processor?
For the visitors of your forms, your site is the controller and Antisy is the processor (FADP art. 5, letters j and k). Article 9 of the act sets the conditions of processing by processors: a contract or the legislation provides for it, and the processor processes only what the controller could process itself.
Is a contract with Antisy needed?
The act requires that a contract or the legislation provide for the processing by a processor (FADP art. 9, para. 1). Antisy offers a model data processing agreement, on every tier. Access to the product is by waiting list today.
Must I tell my visitors that I use Antisy?
Yes: it is a duty of the controller, so of your site (FADP art. 19). Your privacy policy describes the processing and names Antisy. The data processing agreement offers a model text to adapt.
Where are my visitors’ data?
Hosting is at Infomaniak, in Geneva, Switzerland. It has been in service since 27 October 2026.
Sources
The articles quoted are those of the Federal Act on Data Protection, in the English translation published on Fedlex. That translation is provided for information only and has no legal force: the act is its French, German and Italian text.