Question 1

What is bot management?

Accepted Answer

Bot management is the process of detecting, classifying, and controlling automated traffic (bots) that hits your websites, APIs, and mobile apps. Good bot management allows legitimate automated services (like Googlebot) while blocking or challenging malicious bots — scrapers, credential stuffers, scalper bots, DDoS tools, and fake account creators.

Question 2

What's the difference between bot management and a WAF?

Accepted Answer

A Web Application Firewall (WAF) protects against application-layer attacks like SQL injection, XSS, and OWASP Top 10 vulnerabilities. Bot management focuses specifically on traffic source classification — is this request from a human, a good bot, or a bad bot? The two complement each other; most platforms need both.

Question 3

What's a CAPTCHA alternative and why does it matter?

Accepted Answer

CAPTCHA is the classic 'click on all the buses' friction test. It fails on two fronts: it creates friction for real users (up to 9.9% abandon rate) and it's increasingly solvable by bot farms for under $1 per 1000 solves. DataSec uses invisible JavaScript challenges that resolve in the background — same detection power, zero user friction.

Question 4

Is DataSec GDPR compliant?

Accepted Answer

Yes. We process traffic signals strictly for security purposes under legitimate interest. We do not build marketing profiles, sell traffic data, or share signals with ad networks. A Data Processing Agreement (DPA) is available for EU/UK customers — contact us to request one.

Question 5

What detection methods does DataSec use?

Accepted Answer

Four layers: (1) Device & browser fingerprinting — screen, WebGL, fonts, canvas rendering. (2) TLS/JA3 fingerprinting — cipher suites and extension order in the HTTPS handshake. (3) Behavioral analysis — mouse movement, click timing, scroll patterns, typing cadence. (4) IP & network reputation — datacenter ASN detection, residential proxy identification, known bad IP ranges.

Question 6

Will DataSec block Googlebot or other legitimate crawlers?

Accepted Answer

No. DataSec maintains an allowlist of legitimate crawler signatures (Googlebot, Bingbot, approved AI crawlers like GPTBot and ClaudeBot, uptime monitors) that are always allowed regardless of other signals. You can add custom allowlist rules for your own internal tools.

Question 7

How long does integration take?

Accepted Answer

Most customers are in monitor-only mode within 24–48 hours. We support CDN/edge integration, reverse proxy modules (Nginx, Apache), and a REST API. Active blocking mode typically goes live after a 1–2 week monitor calibration period where you review detection accuracy on your real traffic.

Question 8

Does it work for mobile apps?

Accepted Answer

Yes. Our mobile SDK (iOS and Android) adds the same fingerprinting and behavioral layers to native app traffic. API protection also covers machine-to-machine traffic from mobile backends.

Question 9

Do you offer a free trial?

Accepted Answer

We offer a 14-day monitor-only proof-of-concept on all plans. During this period, DataSec logs what it would block — without actually blocking anything — so you can verify detection accuracy on your real traffic before committing.

Question 10

What's included in the Enterprise plan?

Accepted Answer

Enterprise includes custom detection rules, dedicated onboarding, 99.99% SLA guarantees, 24/7 support, unlimited domains, on-premise deployment options, and custom legal/DPA arrangements. Pricing is custom — sign up for free to discuss.

Question 11

Is there a per-domain limit on Starter plans?

Accepted Answer

Starter plans include 1 domain. Growth plans support up to 10 domains. Enterprise is unlimited. If you need to add a domain mid-cycle, contact support and we'll adjust your plan.

Frequently Asked Questions

General

Technical

Pricing & Plans