How Antisy protects data.
What is encrypted, how long the data are kept, where they are and who has access to them, and how to report a security vulnerability to us. Each line repeats what our documents already say; what is not written yet is said as such.
Antisy Sàrl, a Swiss company entered in the Geneva commercial register; hosting in Geneva at Infomaniak, in service since 27 October 2026. As of .
Encryption
What is encrypted, and how.
The data of the visitors of your sites
- At rest
- The IP address, the User-Agent, the request context and the browser measurements are encrypted in the database while they are kept, with the keys open to destruction. The event identifier your site chooses to pass on is too, 30 days at most. A digest of the names of the HTTP headers, never their values, is also encrypted at rest, 30 days at most. Not encrypted: a blind index (a keyed digest) of the IP address and of the sign-in identifier, kept as long as they are, and another of the event identifier, used only to recognise the retry of the same attempt and erased after 25 hours; the rest of the record, including the verdict and the browser family.
- Sign-in identifier
- For a login or a sign-up, the account identifier your site passes on is encrypted and hashed.
- From the browser to Antisy
- The browser measurements travel in an encrypted envelope.
- Database
- Roles with limited privileges. The database is on the server of the API, which reaches it without leaving the machine; a connection over the network is accepted only over verified TLS.
This site and your account
- Pages of the site
- The site sends security headers on all its pages, including HSTS, which asks browsers to connect to it over HTTPS only.
- Password
- Kept as a digest (scrypt), never in clear.
- Password attempts
- Counted per account, on top of the limits per address. Beyond 20 attempts in one hour on the same account, wherever they come from, the browsers in which this account has, for 180 days, neither completed a login, code included, nor switched on two-step verification are allowed, together, only one attempt every 30 seconds. While the series lasts, a login from one of these browsers may be refused, even with the right password; « forgotten password » does not exempt from it. The browser in which you did so is not slowed down by this counter, but a browser is recognised only for the last account that signed in on it in this way. These two numbers, 20 attempts and 30 seconds, are hypotheses, to be reviewed after the pilot.
- Two-step verification
- Mandatory for every account: the dashboard does not open until it is switched on. The secret of your authenticator app is encrypted and your backup codes are kept as digests. After wrong codes, the account is locked for longer and longer and its holder is told by e-mail. If you lose your phone and your backup codes, the request is made from the address of the account: we send a confirmation link to that address, then wait 72 hours without objection after the click before removing the verification; at the next login, you add your new app before anything else.
- Session
- A login cookie out of reach of JavaScript, valid for 7 days. After a login completed with the code, or the activation of two-step verification, a device cookie, out of reach of JavaScript, valid for 180 days, used only to recognise this browser in the count of attempts.
- Keys and secrets
- The API key and the signing secret are shown only once, when they are created. Of the API key, Antisy keeps only a digest; the signing secret is kept encrypted, because the API needs it to verify the signatures. A lost API key is revoked and created again in the Keys tab of the site; a signing secret, lost or to be replaced, is replaced by writing to support, which issues a new one. To date, the allow and block lists of a site are also set and removed on written request to support: the dashboard does not manage them.
- Backups of the site
- The database of the site is backed up every day; each copy is encrypted and kept for 7 days at most.
Retention
Durations written in advance.
What Antisy keeps of the visitors of your sites, from the attempt, and until when.
| Delay | Data |
|---|---|
| A few minutes | Browser measurementsa few minutes; part of them, 30 days if keeping is switched on for the site (off by default) |
| 30 days | IP address, User-Agent, request contextand the digest of the order of the HTTP headers |
| 90 days | Sign-in identifier, outcome of the attemptencrypted and hashed |
| 180 days at most | The rest of the recordverdict and its detail, browser family, timestamps; then the record is deleted |
Durations decided by Antisy. After 90 days, a record no longer carries the sign-in identifier or the address. Item by item, in the privacy policy.
Other data
- Waiting list and contact
- 90 days from the request, then the request is erased from the database of the site. It may remain for up to 7 more days in a backup copy.
- Backups of the API
- Encrypted, planned: one export a day, kept for 14 days (Antisy’s decision), and one copy a week outside the provider, kept for 14 days at most. A piece of data erased may remain there for up to 14 days. So that a restore does not bring an erased person back, a register kept outside the database keeps their blind index for 30 days, 44 days at most with its copies.
Hosting and access
Where the data are, who has access.
Hosting
- With whom
- Hosting is at Infomaniak, in Geneva, Switzerland; it has been in service since 27 October 2026.
- Audience measurement
- PostHog, data kept in the European Union (Germany): pages viewed, page exits and clicks, without the parameters of the addresses, without cookie or storage in the browser, without session recording or profile; « Do Not Track » and « Global Privacy Control » respected, and the measurement can be refused in the privacy policy.
- E-mail relay
- The SMTP relay of Infomaniak (Switzerland), chosen; not in service yet. It sees the addresses and the contents of the site’s e-mails, on behalf of Antisy.
Access
- Your site
- Does not receive the browser measurements of its visitors: it receives a token, then a verdict.
- Responsibility
- For the visitors of your sites, your site is the controller and Antisy acts as processor (FADP art. 9), under contract. The data are used for the security of your site, never for advertising.
- Dashboard
- One account per person, with an e-mail address, a password and two-step verification, mandatory. The dashboard is in French.
- Antisy staff
- To date, only Antisy’s managing director has access to visitor data. Operating actions are recorded in an administration log (section 5 of the data processing agreement).
What we do not announce
We announce only what is written and in service.
- No third-party security attestation is announced.
To read: the privacy policy and the data processing agreement.
Vulnerability disclosure
Found a security vulnerability? Write to us.
Write to support@antisy.com, Antisy’s only support address. It is also published in the file security.txt.
Say what you observed, where (the address, the step) and how to reproduce it.
- No encryption key is published for now: do not send in the message any secret or any personal data of third parties.
- No reply time is set to date.