The privacy boundary

BotShield tells you that a user is human, never who they are. Results cross to you. Identity does not. This page lists, surface by surface, exactly what you receive, so you can describe the integration accurately to your own privacy and security reviewers.

​

What you never receive

None of the surfaces on this page sends you any of the following:

• The human’s name, email address, or phone number.
• Biometric data of any kind. The biometric check happens on the human’s own device. BotShield does not send you a face, a fingerprint, or a template.
• The human’s device details or location.
• A score, a confidence value, or a “bot” verdict.
• A date of birth, an age number, or an “underage” result.
• An identifier that lets you match a human with another partner’s records.

You receive no personal data from BotShield. The one thing to watch is data you send yourself: whatever you put in metadata comes back to you in gate webhooks, so keep personal data out of it.

​

BotShield Gate

​

Widget events

No widget event carries an age field, on a Human Gate or an Age Gate. (census is the API’s name for BotShield Gate.)

​

Attestation token claims

The token from botshield:success is an ES256 JWT that lives 120 seconds. POST /sdk/verify-token returns these claims: The token has no sub claim. It describes the event, not the person. On a met Age Gate the JWT also carries age_over. A token for a Human Gate never carries age_over.

​

Verification status

GET /verification/status returns:

​

Gate webhooks

event_id is the same value as request_id. environment is development or production. product is census for a request made against a gate. metadata holds only the keys you supplied when you created the request. BotShield’s own request context is not included, and the key is left out when you supplied nothing. reason is one of user_denied, device_lock_required, platform_declined, or internal_error: it describes why the confirmation did not happen, not who the person is. Gate webhooks carry no age result, on either gate type.

​

Your user reference

If you send platform-user-ref (or partner_user_ref on the server API), BotShield stores a hash of it that is specific to your organization. It is not returned to you on any of these surfaces, and you never receive a BotShield identifier for the human on the Gate rail. See BotShield ID.

​

Age Gate

Age Gate (Beta) is positive-only. It can say that a human is over your threshold. It never says anything else about their age. Age data belongs to Age Gates only. A Human Gate never returns an age result: its token has no age_over claim, and age_verdict and age_source stay null on GET /verification/status, whatever the human’s phone is able to report. unavailable means BotShield could not confirm the threshold. It does not mean the human is under it. There is no “under” value, no date of birth, and no age number on any surface. See Age Gate.

​

Agents Ask

Agents Ask needs to address the same human more than once, so it uses an opaque ID. The opaque ID starts with OP_ and is pairwise: it is unique to one human and one agent. Two agents that are linked to the same human hold different opaque IDs, so the IDs cannot be matched to each other or to any Gate result.

​

Proof of Resolution claims

A Proof of Resolution is an ES256 JWT that lives 24 hours. See Proof of Resolution.

​

Agents Ask webhooks

​

Summary