Security

In short

• The script never records what anyone types, sets no cookies, and keeps nothing on the device after the tab closes.
• It sends its reports only to our own server, and loads nothing else.
• Reports are stored in the United States, in a separate database for each site. Each report's full contents are deleted after 10 days, and what the reports show of each pageview after 30.
• Every connection uses TLS 1.2 or 1.3. Backups are encrypted before they leave the server.
• Your logins see only your own sites. Our own staff sign in with two-factor authentication.
• Telltale Bot is made by Quantable LLC, a small company. We have no SOC 2 or ISO 27001 certification. We answer security questionnaires and our Data Processing Addendum lists our security measures.

What the script does on your pages

The tag adds one script, telltale.js, from js.ttbcdn.net. It loads asynchronously, so it never holds up your page. It looks at how the browser is set up and how the page is used (the timing of mouse, touch, scroll and keyboard activity, never what is typed), sends that to our server at in.ttbcdn.net, and gets back the verdict: human, AI agent or bot. It sends at most a few reports a pageview: when the page loads, after the first interaction, and when the page is hidden or closed.

What it does not do:

• No keystroke content. It records that a key was pressed, and when, never which key. Password and form fields included.
• No cookies, and nothing kept after the tab closes. A random ID in the tab's session storage lets the pages of one visit be judged together. The browser deletes it when the tab closes.
• No form values, page text or screenshots. It reads the page's address and the referrer, not what is on the page.
• No probing for extensions. It doesn't check which extensions or apps a visitor has installed.
• No requests to anyone else. Its only requests go to our own server. It loads no other script.
• No profiles across sites, and no advertising. A site sees reports about its own visitors only.

Where the page's address carries something secret (a reset token, a password, a session ID), the server redacts it before anything is stored, and it does the same with request headers that carry credentials.

It must never break your page

The script watches some of the browser's own functions to see what drives the page. Where it does, the function behaves exactly as before, to your code and to every other library on the page. An error in our code is caught and never reaches your page. A second copy of the tag on the same page does nothing. It stays out of web workers and pages it can't run in safely, and stops reporting if your Content Security Policy blocks it.

Before each release, the script is run against 67 setups of common front-end libraries (jQuery 1 to 4, jQuery UI, Bootstrap, Prototype, MooTools, Dojo, sliders, carousels, select boxes, lightboxes, Sentry and more), and a release that changes how any of them behaves doesn't ship.

Performance

Zero noticeable cost to your visitors is a hard requirement for us. The script is about 18 KB compressed and loads asynchronously. Its heavier work waits until the browser is idle, and the parts that watch the page stop at a fixed budget for each page, however much the page does. We measure the script's main-thread time on every pageview, from real visitors' browsers, and watch it with every release.

Script integrity and SRI

Security reviews often ask for Subresource Integrity (an integrity hash on the script tag). The tag loads /v2/telltale.js, which we update in place: new AI agents and new bots need new detection, often within days, and an auto-updating script means you never have to change your tag for that. An SRI hash would stop the script the first time we update it, so the tag can't carry one.

What we do instead:

• The script comes from one host, js.ttbcdn.net, over HTTPS only. A Content Security Policy can allow that host and our server and nothing else of ours.
• The served script is minified, not obfuscated. You or your security team can read what it does.
• Every change that reaches your pages is on our changelog, dated the day it reached production.
• The script cannot change your page's behavior even if it fails (above), and your page keeps working if our service is down: visits just get no verdict until we're back.

If your policy requires SRI on every third-party script, write to us.

Where the data lives, and for how long

Our server is in Chicago, United States, hosted by Vultr. Each site's reports are kept in a database of their own. IP address lookups (network operator, approximate location) run on our own server: no visitor IP is sent to another company for them.

• Each report's full contents: deleted after 10 days.
• What the reports show of each pageview (its time and page, the visitor's IP address, network, browser and member ID, and the verdict), and our server logs: deleted after 30 days.
• Daily counts for trends (visitors and pageviews by verdict, agent, crawler and country): 13 months. They hold nothing about a single visitor.
• Encrypted backups: 14 days, in New York, United States.

Clearing a site's data, deleting a site or closing an account deletes its reports at once. A site can erase everything stored for one visitor or member from Site settings. Our privacy page has the rest, and our subprocessors page lists every company that processes data for us, with an RSS feed of changes.

Who can see it

• Your team sees only your own sites. A login can be limited to one site (an agency's client, for example). Automated tests check that no login can see another customer's sites.
• Our staff sign in to the reports and to every provider's console with two-factor authentication. Administrative access to our servers is by SSH key only, from allowed networks, with root sign-in disabled.
• Our staging server, where changes are tested before they reach the service, holds a recent copy of the data and is reachable only from our own network.
• Our terms let us use report data to improve detection. You can opt out by email.

Your logins

Passwords are stored as bcrypt hashes, sign-ins are throttled, and changing a password ends every session of that login. Two-factor sign-in (an authenticator app) is available to every login, with recovery codes. Invite and password-reset links only open a form: a link alone never signs in a login that has two-factor on. Card details go straight to Stripe and never reach us.

Encryption

Every connection to our servers, for the script, the reports and the viewer, uses TLS 1.2 or 1.3, with HSTS. Backups are encrypted on the server before they leave it, with a key the server itself cannot read back. The key to restore them is kept offline.

How we run it

• Every change runs on the staging server before it reaches the service. Each deploy checks our code and dependencies for known vulnerabilities, tests the script in Chrome, Firefox and Safari engines, and runs the library tests above. Any failure stops it.
• Operating system security updates install daily.
• The service is monitored around the clock, with alerts to us, and our status page shows any outage.
• Backups run nightly, and hourly for account data, to a separate location.

If something goes wrong

We have a written breach procedure. If a breach affects your data, we tell you without undue delay, and aim to within 48 hours, so you can meet your own deadlines (72 hours under the GDPR). We say what we know and add to it as we learn more. Our Data Processing Addendum sets this out, with the EU Standard Contractual Clauses and the UK Addendum for transfers to the United States.

Reporting a vulnerability

Write to support@telltale.bot. Every one of our collection hosts publishes the same address in /.well-known/security.txt. Please give us a reasonable time to fix a problem before you make it public. We don't run a paid bug bounty.

Security questionnaires

We answer reasonable security questionnaires, and we have common answers ready. Write to support@telltale.bot. We answer within 72 hours.

Last updated November 4, 2026.