Security
Strict filtering without handing over your traffic
KillTheBots is designed so the sensitive parts stay with you: request evaluation, client addresses and TLS termination never leave your infrastructure.
Decisions stay on your machine
The agent evaluates rules, intelligence and rate limits in-process. Traffic is never proxied through us, so an outage on our side cannot take your site offline.
Signed intelligence releases
Every release is signed and version-pinned. The agent refuses to load a payload whose signature or version chain does not verify.
Truncated telemetry
IPv4 addresses are truncated to /24 and IPv6 to /48 before events leave the agent. We keep decision, reason code, country, ASN, route and score.
Scoped credentials
Enrollment keys are single-purpose and rotatable. API keys are read, write or admin scoped and shown once at creation.
Least-privilege roles
Owner, admin, analyst and billing roles on the customer side; support, security analyst and platform admin internally. The control plane authorizes every call.
Audited changes
License edits, suspensions and intelligence publishes require a written reason and are recorded in an append-only audit log.
Data retention
Telemetry exists to explain decisions. Anything that is not needed for that explanation is not collected.
Read the privacy notice- Security events
- 14–90 days depending on plan
- Aggregated counters
- 13 months
- Audit records
- 24 months
- Raw client IP addresses
- Never stored
Responsible disclosure
Found a vulnerability? Email security@killthebots.net. We acknowledge reports within two business days and will not pursue good-faith research.
KillTheBots reduces automated abuse. No filtering product stops every bot, and enforcement settings always trade some false positives against coverage.