Security & Compliance
Your data is safe with us
SilentShield was built from the ground up for privacy and security. No cookies, no cross-site tracking, usable in line with the GDPR.
Behavioural measurement
How sure we are on every request
SilentShield condenses behavioural signals into a value between 0 and 1 — the verdict follows from it. The higher the value, the more confidently the visitor is a human. Example values:
Transparency
What we see — and what we never do.
Processed (pseudonymous)
- Interaction patterns (mouse, timing) as a score
- A pseudonymous session hash
- Aggregated bot statistics
Never stored
- Names, emails, or form contents
- Tracking cookies or advertising IDs
- Cross-device fingerprints
GDPR Compliance
SilentShield can be used in compliance with the GDPR. We set no cookies, do not track visitors across websites and do not build profiles. We process your visitors' IP address only for the check and do not store it in plain text.
- No cookies; fingerprinting can be switched off with Zero-PII mode
- No cookies, no profiles, IP addresses not stored in plain text
- No cross-site tracking or profiling
- Data processing agreement (DPA) available
- Privacy by design architecture
Hosting in Germany
The check of your visitors runs on our servers in Germany, and the data is stored there. Via the EU endpoint (api-eu.silentshield.io), requests reach them directly, with no CDN in between; via the standard endpoint (api.silentshield.io), they may be routed through Cloudflare. We deliver the website and dashboard via Cloudflare (see Privacy Policy).
- Servers located in Germany
- EU endpoint without passing through third countries
- EU-based infrastructure providers
- Data storage in Germany
Encryption & Transport Security
All communication is encrypted in transit and at rest using industry-standard protocols.
- TLS 1.3 for all API connections
- HSTS with includeSubDomains and preload
- Strict security headers (CSP, X-Frame-Options, X-Content-Type-Options)
- Encrypted database storage
Access Control & Authentication
Multi-layered access control protects your account and API keys.
- Secure API key authentication
- Role-based access control for teams
- Account lifecycle management with automatic suspension
- Email verification required for all accounts
DDoS & Abuse Protection
Built-in protection against denial-of-service attacks and API abuse.
- Per-IP rate limiting on all endpoints
- Per-API-key monthly quotas
- Automatic abuse detection and blocking
- Cloudflare integration for edge protection
Accessibility (WCAG 2.1)
The widget is tested against WCAG 2.1 AA – automatically and by keyboard (as of 09/2026, no external audit).
- No visual challenges or puzzles
- Screen reader compatible
- Keyboard navigation support
- Inclusive by design — no user is excluded
Data Retention & Deletion
We follow strict data retention policies with automatic cleanup and user-controlled deletion.
- Configurable data retention periods per plan
- Automatic deletion of expired behavior data
- Account deletion with full data anonymization
- Unverified accounts auto-deleted after 7 days
Questions about security?
Our team is happy to discuss security requirements for your use case.