Frequently asked questions
Short answers to the questions an integrator and a decision-maker ask about Antisy: the product, the integration, the data, the offer. The detail is in the documentation. The dashboard is in French.
As of .
The product
What is Antisy?
Antisy is bot protection for the forms and logins of a website: it checks that a submission comes from a browser and not from a program, without showing the visitor anything.
One tag in the page, one call from your server, and a verdict: allow or deny. You decide what happens next.
Antisy is the product of Antisy Sàrl, a Swiss company entered in the Geneva commercial register.
See: About Antisy Sàrl
What is the difference between Antisy and a CAPTCHA?
A classic CAPTCHA asks the visitor to prove they are human: tick a box, recognise images, solve a puzzle.
Antisy asks the visitor for nothing and shows nothing: no box to tick, no puzzle. The script counts the interactions while the visitor fills in the form, has the browser do a short computation in the background and measures it on submission; it is your server that receives the verdict. This kind of check is sometimes called an “invisible CAPTCHA”.
See: Glossary: invisible CAPTCHA · Comparisons: Antisy and the other services
How does Antisy work?
The browser loads Antisy’s script, which shows the visitor nothing. When the form is submitted, the script itself puts a short token in a hidden field named antisy-token.
Your server sends this token to POST /v1/siteverify, with your secret. The answer says allow or deny: the visitor passes, or not. You decide what happens next.
What does the visitor see?
Nothing. Antisy shows neither a box to tick nor a puzzle.
Their browser only does a short computation in the background, without showing anything. A very slow device that does not finish it in time is refused as for an invalid token; a new attempt draws a new computation.
A refusal is not shown by Antisy either: it is your server that receives deny, and your server decides what answer to give.
Does Antisy stop every bot?
No. No bot check is perfect, and Antisy announces no detection rate: such rates are measured on real traffic, during a pilot that has not started.
What never passes is written in the documentation: an invalid, forged, replayed or expired token is refused in every mode, and so is a missing token while browser collection is on for the site.
A token whose background computation was not finished in time is refused too, whatever the mode: a very slow device can therefore be refused.
See: Documentation: what never passes · Documentation: the delay of the background computation
Is Antisy spam protection?
Yes, for forms: Antisy checks that a submission comes from a browser and not from an automated program, without a puzzle for the visitor, and your server refuses automated submissions before recording them. It covers the contact form, the sign-up and the login.
It is not an e-mail filter: it does not sort the mail your inbox receives. No bot check is perfect, and Antisy announces no detection rate.
The contact form goes through the siteverify call; the login and the sign-up, through a Node server kit that will be published on npm; it is not yet. Access is by waiting list.
See: Use cases: protecting a contact form · Glossary: anti-spam
Does Antisy block bots?
It lets you refuse bots where they go through a form: contact, sign-up, login. For each submission, your server receives a verdict, allow or deny, and it is your server that refuses; Antisy does not sit in the path of your traffic.
Antisy is neither a firewall, nor a protection against flooding attacks, nor an anti-fraud tool for payments: it only sees the submissions of the forms it protects. It announces no detection rate, and no customer is in production yet.
See: Bot detection: telling a bot from a human · Does Antisy stop every bot? · Glossary: malicious bot
Why does the answer not give the reason for a refusal?
The answer contains no score, no threshold and no reason, in any mode: a verdict, never the detail that produced it.
Each reason given would teach whoever is getting round the check what stopped them. The error codes only say what your integration must fix.
Can the strictness of the check be set?
Yes, site by site, on the dashboard, with three modes: Strict, Balanced (the default) and Permissive; the dashboard, in French, calls them Strict, Équilibré and Permissif. There is neither a slider nor a value to enter.
Strict: refuses earlier, at the risk of inconveniencing a few real visitors. Permissive: refuses only clear-cut cases, at the risk of letting more bots through.
Can Antisy block real visitors?
A false positive is a real visitor wrongly refused. No bot check is perfect, and Antisy announces no detection rate: it is measured on real traffic.
Strictness is set site by site, with three modes: Strict, Balanced (the default) and Permissive. The Permissive mode accepts doubtful cases more readily; the Strict mode refuses earlier. A very slow device that does not finish its background computation in time is refused, whatever the mode.
To measure wrongful refusals, your server can send the outcome false_positive to POST /v1/feedback; it is optional, and this signal changes no verdict live.
See: Documentation: how strictly to refuse · Glossary: false positive
Integration
What do you need to add Antisy to a form?
A tag in the <head> of the page and a call from your server. For a POST form sent to your own site, Antisy’s script fills in the hidden field antisy-token itself on submission: you write no JavaScript.
What the script does not cover needs a setting. A form sent to a subdomain, or by GET, is marked with the attribute data-antisy. A submission by fetch or by form.submit(), or one that opens a new window, calls antisy.token() from the page. A form you do not protect is marked data-antisy="off".
You also need a site declared in the dashboard with the host names of your pages, its site key (public, it goes in the page), a verification secret (it stays on your server) and pages served over HTTPS.
Which server languages does Antisy work with?
Verification is an HTTP call, POST /v1/siteverify, with a form body or JSON: any language that can send an HTTP request will do. The documentation gives complete examples in curl, Node, PHP, Python and Go, with no dependency.
For the login and the sign-up, a Node server kit (Express, Fastify, Next.js) will be published on npm; it is not yet.
What happens if the script is blocked?
The form is sent all the same, without a token: without an antisy-token field, or with that field empty if the page already carries one. Read it with an empty value by default. This happens with an ad or tracker blocker, an incomplete CSP policy, a page over HTTP, a visitor without JavaScript, or a form the script does not cover and whose page does not call antisy.token(). When the script has held the submission back and the token is slow to come, the form is sent after 6 seconds at most.
What follows depends on the site’s “Browser collection” setting (“Collecte du navigateur” in the dashboard). With collection on, a submission without a token does not pass: verdict deny. With collection off, the missing token is not held against it. A new site starts with collection off.
What happens if Antisy does not answer?
Your form keeps working if you follow the rule of the documentation: when Antisy does not answer (network error, timeout of 3 seconds exceeded, 5xx answer), let the submission through and log it. An outage at Antisy must not block your visitors.
The reverse is true too: an error caused by your own request never lets the submission through.
Does Antisy work with a strict CSP policy?
Yes. The policy must allow https://api.antisy.com in script-src and in connect-src, and 'wasm-unsafe-eval' in script-src, for the WebAssembly module. 'unsafe-eval' is not asked for.
Nonce-based policies work, with or without 'strict-dynamic'.
Can you tell Antisy what really happened to an attempt?
Yes, it is optional. Your server sends to POST /v1/feedback, with the same secret as for verification, the event_id returned by siteverify and an outcome: success, failure, account_confirmed_fraud or false_positive.
It is measurement: this signal never produces a verdict and changes nothing live. It is limited to 30 days after the event, to one outcome per event, and to a daily cap.
Can a login or a sign-up be protected?
Not yet. The login and the sign-up go through another call than that of simple forms: assess, which ties the token to the account. Its Node server kit will be published on npm; it is not yet.
The siteverify call of simple forms does not tie the token to an account: it suits a contact form or a newsletter, not a login. On the browser side, nothing more: the script fills in the token field, and data-antisy-action="login" names the action.
See: Use cases: login · Use cases: sign-up · Fake accounts and sign-up fraud
Does Antisy slow down my page?
The script shows nothing and does not block the display of the page: it loads separately and works in the background while the visitor fills in the form.
This work is a short computation in the background. When the script has held a submission back and the token is slow to come, the form is sent after 6 seconds at the latest.
When the browser does not have the X25519 algorithm, the script does this computation itself, a fallback written by Antisy. Antisy gives no figure of weight or latency until it has measured it.
Data
What data does Antisy process?
In the browser, the script measures the capabilities the browser declares, the languages and the time zone of the browser, the graphics rendering and the fingerprint of the device, signs of automation, the behaviour of the JavaScript engine and the course of the interaction. Antisy’s server reads the order of the HTTP headers, the IP address, the User-Agent and the request context. Never the image drawn, the name of the graphics card nor the content of the keystrokes and the fields.
Antisy also keeps, for a login, a sign-in identifier, encrypted and hashed: the home page details each measurement and each retention period. These data include personal data, which the privacy policy describes.
How long are the data kept?
The measurements sent by the browser are kept for a few minutes, the time it takes to verify the submission; part of them, 30 days if keeping is switched on for the site, which it is not by default. The IP address, the User-Agent and the request context are erased at 30 days, the sign-in identifier at 90 days, and the whole record is deleted at 180 days at most.
These durations are the ones Antisy applies.
Where are the data hosted?
Hosting is at Infomaniak, in Geneva, Switzerland. It has been in service since 27 October 2026.
Are the data used for advertising?
No. They are used for the security of your site: telling human visitors from automated programs. Never for advertising.
Who is the controller of the data?
For your visitors, your site remains the controller; Antisy acts as processor (FADP art. 9), under contract. This sharing of roles comes from the revised FADP (the Swiss Federal Act on Data Protection), in force since 1 September 2023. Your privacy policy must describe this processing and name Antisy.
Antisy’s privacy policy and data processing agreement are published in French, with an English translation for information only: the French version prevails. The data processing agreement is offered on every tier.
See: The FADP and Antisy: who is the controller, who is the processor
Does Antisy comply with the revised FADP (the Swiss Federal Act on Data Protection) and the GDPR?
For the visitors of your sites, your site remains the controller; Antisy acts as processor (FADP art. 9), under contract; the revised FADP has been in force since 1 September 2023. Hosting is at Infomaniak, in Geneva, in service since 27 October 2026.
Antisy’s privacy policy and data processing agreement are published in French, with an English translation for information only: the French version prevails. Antisy accepts customers established in the European Union: the data are processed at Infomaniak, in Geneva; the European Commission recognises Switzerland as offering an adequate level of protection, and the data processing agreement also meets Article 28 of the GDPR. Antisy has not designated a representative in the European Union (GDPR, Art. 27).
See: Data security · The FADP and Antisy: who is the controller, who is the processor
The offer and the company
How much does Antisy cost?
Four tiers: Free (CHF 0, 2,500 checks per month, 1 site), Standard (on quote, 50,000 checks per month, 3 sites), Pro (on quote, 250,000 checks per month, 10 sites) and Enterprise (on quote, volume and sites negotiated). Only the Free tier has a displayed price; Standard, Pro and Enterprise are on quote, depending on your volume and your sites.
For a quote, write to support@antisy.com giving the tier, your volume and your sites. Nothing is paid online: access is by waiting list.
See: Pricing: the full grid · Comparisons: the public prices of the other services
What happens beyond the quota of checks?
On the Standard and Pro tiers, going over the quota is set out in the quote.
On the Free tier, it is not billed and your site is never blocked. The score no longer decides, so the site is no longer protected by the model; an invalid or falsified token is still refused, and so is a missing token while browser collection is on for the site.
Can Antisy be used today?
Not yet. Access is by waiting list. The API has been answering on api.antisy.com and the dashboard on app.antisy.com since 27 October 2026, at Infomaniak, in Geneva; no customer is in production yet.
A pilot is planned; it has not started, and no date is announced. You can leave an address on the waiting list: Antisy will write to you when access opens, and for nothing else.
See: Join the waiting list · The pilot
Who is behind Antisy?
Antisy Sàrl is a Swiss company entered in the Geneva commercial register. It works in IT security, in defence only.
Antisy does defence only: no traffic is sent to a third-party system without the written mandate of its owner.
See: About Antisy Sàrl
How can I contact Antisy?
Through the waiting list of the site, to be told when access opens, or by e-mail at support@antisy.com, the only support address.