The pilot: bot protection for a first customer’s login page, one month at no charge, in exchange for your feedback.

A site whose visitors sign in or sign up, and whose technical team is available during the pilot.

• Your site has a login page, a sign-up page, or both: that is where the pilot applies.
• Someone technical can put a tag in the page, add a call on the server side and answer our questions. The server kit for the login and the sign-up is written for Node. Without Node, the pilot is still possible: the verification and the report of the outcome are made by plain HTTP calls, in simple mode (see the verification examples in PHP, Python and Go, and the report of the outcome).
• Your pages are served over HTTPS, and the content security policy (CSP) of the login page accepts our script.
• You can sign a written mandate, which authorises us to process the traffic of this page.

One month at no charge, counted from the switching on of the protection. After that, nothing becomes paid without your agreement.

• One month at no charge. It starts when the protection is switched on, not when the mandate is signed. Before the end of the month, we write to you: you move to the tier of your volume, at the prices of the price list (in CHF, excluding VAT), only if you confirm it; without confirmation, you move to the Free tier. The pilot is not extended: after one month, you choose the paid tier, the Free tier or stopping. The price list is reviewed after the pilot, with its measurements. If you stop at the end of the pilot, the data of your site is deleted 30 days later.
• What you need to integrate. The documentation, including a step-by-step integration guide, and the Node server kit for the login and the sign-up, handed over as a private package before its publication.
• The dashboard, in French. The volumes that pass and do not pass, the recent verdicts, and the verification mode (Strict, Balanced, Permissive; in the dashboard: Strict, Équilibré, Permissif) to set site by site. It never gives the reason why an attempt was refused: each day’s refusals are counted there in two categories, in rounded volumes.
• Support by e-mail, at support@antisy.com. There is no other channel. On your request, it is the support that replaces the signing secret of the kit and sets or removes your allow and block lists: the dashboard does not manage them.

Your feedback, a little of your team’s time, and a written framework.

• Feedback, during the integration and the observation: what worked well, what bothered your visitors, what you missed.
• A testimonial, if you agree.
• The outcome of the logins. Your server tells us what really happened: without it, nothing can be measured. These reports have a ceiling per site and per day, which follows the number of verifications of the day; beyond it, the API refuses them. So send first the failures and the frauds you have established, then the successful logins if there is room left. The Node kit sends them by its signed channel, which has its own ceiling; without it, the simple mode is described in the documentation.
• A written framework. A signed mandate, and a data processing agreement: for your visitors, your site remains the controller and Antisy acts as processor (FADP, art. 9), according to the model agreement. Your privacy policy describes the processing and names Antisy (FADP, art. 19). What we measure and how long we keep it is written in the Data section.

Three steps, in this order.

1. 1Integration

   You put the tag in your login page, and your server calls Antisy for each attempt, then reports the outcome to it. The mandate and the data processing agreement are signed before we process a single visitor. The detail is in the documentation.

2. 2Observation phase

   The rules that read the signals of the browser are computed and counted, but they decide nothing. We look at the numbers with you. The aim: measure before deciding. The planned length is at least one week, to be adjusted according to what the measurements show.

3. 3Protection

   When the numbers allow it, browser collection is switched on and the rules go back to active, one by one. Once collection is active, a missing or invalid token does not pass; the rest depends on the mode you choose.

Access is by waiting list, with no customer in production. What is true today, and what is not yet.

Go through the waiting list: the form is the same, and your message is already started there.

• The form is the one of the waiting list: the same fields (name, work e-mail, company, message), the same retention periods. See the privacy policy. The only difference is a sentence, “Pilot application.”, already written in the message, which you can change.
• We are starting with one first customer: an application is not a promise of being selected, and commits you to nothing. The mandate is signed later, before any measurement.