Answers for your security review.

Does my traffic data leave my infrastructure?

Observe mode is local-first: verification happens in your edge; only aggregates — tier counts, purpose counts, per-agent tallies — leave the box, and you can turn even those off and still consume the feed.

What exactly is in the aggregates?

Counts by agent, tier, purpose, and path prefix. No URLs with query strings, no IPs, no user identifiers, no request bodies. The full field list ships with the SDK docs, versioned with the code — and it’s part of the contract.

Do you train on my traffic?

Aggregate behavior signals (with the opt-out above) improve the shared trust profiles — that’s how they get smarter for everyone. Your content and your users’ data are never touched; only bot-behavior tallies. That’s contractual, not just policy.

What does this add to my latency?

The verify core runs against a key-value cache your edge already holds; the budget is sub-millisecond on cache hit. A cache miss never blocks the request — the request passes and resolution happens out of band.

What happens when D3 is down?

Nothing. The feed is edge-cached and signed; if we vanish, your edge keeps enforcing the last-known-good feed and passes anything it can’t classify. Fail-open is the default and can’t be configured to fail-closed. That’s deliberate: we’d rather miss a bot than drop your traffic.

What happens when the feed goes stale rather than dead?

The SDK reports feed age, and past a threshold your policy can fall back to observe-only. You’ll see staleness before it matters.

Can a bad feed push change my edge’s behavior?

Feeds are signed and versioned; your edge verifies the signature before applying, and you can pin a version and roll back. Enforcement changes ship as log-only first, promoted per rule by you.

What credentials do you hold?

None. The SDK and Worker run in your account, installed by you. We publish code and a feed; we never hold keys to your infrastructure.

Can enforcement break my SEO or block a paying customer?

Enforcement is additive-only: classes you already trust (IP-verified search crawlers, your existing allowlists) are never touched, and every new rule starts in log-only mode until you promote it.

Why should anyone trust your classifications?

Every tier verdict carries its reason (signature, IP range, rDNS), we read every registry rather than running our own, and we publish negative results, including which major vendors don’t sign yet. You can check our work.

Can you quietly rewrite a bot’s record?

Not without leaving tracks. Feeds are signed and versioned; you can pin a version and diff any two.

Who is behind this?

D3 — the team behind d3.com. Everything on this page is what exists today.