FAQ

How much latency does this add?

One blocking call, in the request path, with a hard budget: 150 ms by default on both SDKs, and 500 ms on guided Cloudflare installs. Both are configurable. The budget is the worst case. When it's exceeded, the request passes instead of waiting. A second, non-blocking call reports the outcome after your response is already on its way, and the heavy verification work happens there, off the hot path.

What happens if D3 Edge is unreachable?

Your site keeps serving. The SDKs fail open by default: the decision call errors or times out, and the request passes. The worst case is a gap in your classifications, never an outage on your site. If you would rather block than serve unclassified traffic, the SDKs can be configured to fail closed; see your SDK's configuration reference.

Will you ever block traffic without me asking?

No. Your account starts analytics-only. Enforcement rules exist only after you've decided what to enforce, and they're configured with our team. No rule, no blocking. There is no default policy.

What data do you collect?

Request metadata: path, user agent, signature headers, the verification outcome, and a salted, truncated hash of the source IP in place of the raw address. To show latency and error rates, the SDK also reports your origin response's status code, content type, and size. Response bodies never reach us. On Cloudflare the worker runs in your own account, so pass-traffic flows from your zone to your origin without touching our infrastructure.

Why is this bot derived and not proven?

Because we can't prove more than we can prove. proven requires a valid signature or operator-confirmed IP ranges. derived means the user agent matches a known crawler fingerprint but the IP can't be confirmed either way. The proof ladder is deliberate about this: a tier is a claim about evidence, and inflating it would make every tier worthless.

Can't a bot just fake its user agent?

Yes, and the ladder is built for that. A faked UA with nothing else behind it classifies as derived at best. A faked UA contradicted by the real operator's published IP ranges classifies as spoofed, which is more useful than a silent block: now you know someone is impersonating Googlebot at your site.

I need to revoke a key. How fast does it take effect?

Revoke it in API keys; it stops being accepted everywhere within about two minutes. The window is cache propagation. The revoked key stays visible in the dashboard so you can confirm nothing is still presenting it.

What about retention, compliance certifications, and a status page?

None of the three is published yet. That's an early-access reality, not a secret: ask us and we'll show you where each one stands for your review.

Are you going to charge bots for access / do x402 payments?

No. The product is identity and policy: know what's visiting, decide what it may do, enforce that at your edge. Payments aren't part of that, and won't be.

My platform isn't Vercel or Cloudflare.

Tell us what you're running. The platform-specific part of an SDK is small.