General terms and conditions

The provider is Antisy Sàrl, a company under Swiss law (see the legal notice). The customer is the person who opens an account to protect one or more sites. The service is reserved for professionals (companies, self-employed persons, associations, for their activity); it is not offered to consumers. These terms are accepted when the account is opened, or by signing the pilot mandate or the Enterprise contract.

The visitor’s browser measures and seals signals, the customer’s site places a short token in its form, and a single call from its server to Antisy returns a verdict: allow (the visitor goes through) or deny (they do not), without a reason. The customer decides what follows, and sets per site, in its dashboard, how strictly Antisy refuses (Strict, Balanced or Permissive). Whatever the mode, an invented, forged, replayed or expired token never goes through, a missing token does not go through while the site’s collection is active, and proof that a bot made up its submission also refuses, including beyond the quota (Free tier), where only the score no longer decides. If Antisy does not answer the call of the customer’s server (network, timeout, server error) or limits its rate, the kit lets the submission through; a refused key or a malformed request never lets it through. A complete outage of Antisy thus does not block the customer’s site. The issuing of tokens to the browser is a separate service: if it alone is down, or if a visitor exceeds their rate limit (per address, the same for every tier), the browser obtains no token, and its submission is treated as a missing token: refused while the site’s collection is active.

All prices are in Swiss francs (CHF) and exclude VAT.

• Free: CHF 0, 1 site, 2,500 checks per month.
• Standard: on quote, 3 sites, 50,000 checks per month.
• Pro: on quote, 10 sites, 250,000 checks per month, priority support.
• Enterprise: on quote; negotiated volume; contract, availability commitment, data processing agreement and dedicated contact person.
• Beyond the quota of the Standard and Pro tiers: the price of each band of 1,000 additional checks is set out in the quote; any band begun is due. The volume of the Enterprise tier is negotiated in the contract.
• Audit of the sign-in and the sign-up: on quote, deducted from the first annual Pro or Enterprise subscription.

Each tier has an allotted rate in checks per second and in tokens per minute (assumptions, to be validated again during the pilot). An attempt beyond the rate of its tier is never refused on that ground: it is flagged, counted and scored normally. Only technical limits, common to every tier and set above their rates, refuse a higher rate (response 429).

The Free tier requires no bank card. It is limited to one site and one account per organisation, with a verified business email address (disposable addresses excluded).

Beyond the 2,500 monthly checks, the customer’s site is never blocked: the score no longer decides the response, and the site is no longer protected by the model until it has moved to a paid tier. The gate remains: a token that is missing (collection active), invalid, falsified, replayed, expired or from another site is refused as before, and the customer’s block list holds too. Antisy goes on scoring and keeps the counters and statistics, without keeping the detail event by event; the customer sees in its dashboard that it is under attack. Exceeding the quota is reported to it once per calendar month, by email, at the alert address of its organisation if one is set; to date, no alert reports an attack.

The secrets (API key, signing secret) are shown only once, when they are created. Antisy keeps of the API key only a hash; it keeps the signing secret encrypted, because the API needs it to verify the signatures. The customer keeps them confidential and places them on the server side only. A lost API key is revoked and created again in the site’s Keys tab; a signing secret, lost or to be replaced, is replaced by writing to the support, which issues a new one. To date, the allow and block lists of a site are also set and removed on written request to the support: the dashboard does not manage them. Any use of the secrets made before the customer has revoked the key or notified the support is attributed to the customer; after this notice, Antisy replaces the secret within 1 working day.

The paid tiers Standard and Pro are billed monthly, in arrears, in Swiss francs, from the usage statement of the dashboard, which carries the volumes counted. The price is that of the quote. Exceeding the quota is added to the invoice of the month in which it is measured (section 3). The Free tier is not billed (section 4). The pilot is governed by its own mandate, outside this section.

The Enterprise tier falls outside the framework of this section: it is billed according to its service contract, drawn up on quote, which itself sets the frequency, the payment term and the late-payment interest.

Prices exclude VAT. Antisy is not registered for value added tax: no VAT is added, and the invoices bear the statement “non assujetti à la TVA” (not registered for VAT). If Antisy becomes registered, VAT is added to the prices from that date.

Each invoice is a QR-bill, drawn up by Antisy from the usage statement. It is paid by bank transfer to the IBAN of Antisy’s account, quoting the SCOR reference (ISO 11649) that it bears.

Invoices are payable 30 days net from the invoice date. The due date is written on each invoice.

If an invoice remains unpaid, Antisy sends a reminder ten days after the due date. Thirty days after the due date, Antisy sends a formal notice and suspends the service of the customer.

No late-payment interest is due before the formal notice. From the formal notice, the unpaid sum bears the default interest provided by law (Swiss Code of Obligations, Art. 104).

During the suspension, the customer’s checks answer “allowed” without checking anything: its forms go on working, without protection. The alerts by email stop; the customer’s data are not changed.

Other consequences of a prolonged failure to pay: the suspension is lifted as soon as payment is made; without payment sixty days after the due date, Antisy terminates the contract. The data are then kept for 90 days and then erased, as at any closure (section 11).

Enterprise tier: availability commitment set in the contract. Outside the contract of the Enterprise tier, Antisy makes no quantified availability commitment. Pro tier: priority support, with a reply within 1 working day. Free tier: planned maintenance is announced 48 hours in advance by email, except in a security emergency; support is by email, with no committed response time.

Antisy’s support is reached at support@antisy.com.

Antisy does defence only. The customer uses the product only on sites that it controls or for which it holds a written mandate from the owner. The following are prohibited: testing or attacking third-party sites; circumventing, disassembling or reverse-engineering the service; reselling or transferring access; deliberately overloading the API; any unlawful use. In the event of a breach, Antisy may suspend the service without notice, and terminate it if the breach is serious or repeated, without refund of the current period.

For the visitors to its sites, the customer is the controller and Antisy is a processor (FADP, Art. 9). The framework is described in the privacy policy and the template data processing agreement. The Enterprise tier includes a data processing agreement; the data processing agreement is offered on every tier, including the Free tier.

Antisy’s liability is limited to wilful misconduct and gross negligence. Antisy is bound by an obligation of means, not of result: it does not warrant that every bot is stopped, nor that no legitimate visitor is ever hindered. Any other warranty is excluded to the extent permitted by law.

After an account is closed, the data of the account are kept for 90 days, then erased. The contract is concluded for an indefinite period; the paid tiers are billed monthly. The customer may terminate at any time, with effect at the end of the period paid. Antisy terminates with 30 days’ notice, or without notice in the event of prohibited use (section 8) or non-payment (section 6). Enterprise tier: according to its contract.

The service, the protection script, the engine and the trademark remain Antisy’s. During the contract, the customer has a non-exclusive and non-transferable right of use. The Node integration kit @antisy/sdk is under the MIT licence. “Antisy” is the trade name of Antisy Sàrl; the trademark is not yet registered.

Antisy announces any change to the terms or prices by email 30 days before it takes effect. A customer who refuses it may terminate before that date, without penalty. A price increase does not affect a period already paid. Enterprise tier: the change is made by a signed amendment.

Swiss law. The ordinary courts of the canton of Geneva have exclusive jurisdiction.

These terms are drawn up in French. Where they are translated, only the French version is authoritative.