Standalone prediction text is normally classified in memory and discarded. An enabled paid shadow trial retains selected text for 30 days and sends it to TypeSafe for background evaluation. Enabled live escalation sends paid Content Gate and /v1/predict submissions our model is unsure about to TypeSafe on the request path, and TypeSafe's confident answer becomes the decision or score returned. When Content Gate evaluation collection is enabled, the submission text is stored privately for 30 days to measure classification quality, with credentials removed before storage and nothing else removed. A second collection is disclosed and is not running: where a customer separately authorizes it, submissions their own honeypot reports to us as spam would be kept for 12 months and used to train the model. No customer has authorized it and it holds no records — every site running Content Gate is operated by VectraSEO LLC, the company that operates Siftfy, so there is currently nobody able to authorize it. The evaluation records contain personal information and remain access-restricted. This page documents how we handle data, where we process it, and the controls we run.
Data handling at a glance
- Prediction content, the paid trial and live escalation. Outside the enabled TypeSafe shadow trial and live escalation,
/v1/predict text is processed in memory and discarded. The trial retains selected paid text, with credentials removed, for 30 days in restricted evaluation storage and sends it to TypeSafe. Live escalation sends paid text our model is unsure about to TypeSafe, whose confident answer is the decision or score returned; where evaluation collection is enabled that text is retained the same way. Free traffic is never sent. See the trial disclosure and the live escalation disclosure for selection, retention and provider processing. - Restricted Content Gate evaluation. A separate private encrypted S3 bucket holds the submission text, keyed customer/site pseudonyms, the originating form action, the detected language, model metadata and human labels. A submission whose entire text is a single email address is not stored, and neither is a submission to Siftfy's public demo page or Siftfy's own sign-in form. Every record expires exactly 30 days after collection: readers exclude it from that moment and the storage lifecycle deletes the object, with physical deletion following asynchronously. We remove credentials before storage, keep no second copy, and exclude request credentials, IP metadata, and challenge material from the corpus. The same bucket also records when collection itself failed: a server shutting down having failed to store submissions it accepted writes how many it did not store and its own name, so a gap in the corpus is detectable rather than assumed. Those reports hold a count and a server name only, no submission text or identifiers, and are deleted after 31 days.
- Spam label corpus, kept apart from it. Honeypot-labelled submissions live under their own storage prefixes with their own lifecycle rules, so the 12-month window and the 30-day window cannot delete each other's records early. The derived record that outlives the text carries an exhaustively enumerated field set with no field capable of holding submission content, the name of the honeypot field but never its value, and your own submission reference as a one-way keyed pseudonym rather than as you sent it. No text from this corpus is sent to any third-party model provider.
- Nothing sensitive in diagnostics. Logs and error responses carry metadata only — never the submitted text.
- We do not train on your content without your written authorization. We do not use live request content from your account to train or fine-tune models, and we do not train on the 30-day evaluation collection from your sites. Siftfy's own sites are the exception: from 2026-09-27, submissions from sites that VectraSEO LLC runs itself (today every site running Content Gate, including Emcognito and Folio) that our reviewer has labeled legitimate or spam may be used to train Siftfy's spam, AI-authorship and automation models, and are kept for 12 months for that purpose (the training copy is made by a daily job, only while the submission's 30-day evaluation record still exists, and a storage lifecycle rule deletes it 12 months after collection); submissions our reviewer labeled between 2026-09-22 and 2026-09-27 are also used, although they were collected while we said we did not train on the evaluation collection. From 2026-10-08, TypeSafe verdicts on Content Gate submissions from those sites may be used to train Siftfy's spam model: only the spam or legitimate verdict is stored with the submission text, kept for 12 months from collection, and verdicts given before 2026-10-08 are included while the 30-day evaluation record still exists. From 2026-10-13,
/v1/predict text from accounts that VectraSEO LLC runs itself, already kept for the paid shadow trial or live escalation, may also be used to train Siftfy's spam model with TypeSafe's verdict or our reviewer's label, kept for 12 months from collection. This is forward-only: nothing collected before 2026-10-13 is copied. TypeSafe spam verdicts on that text are copied only up to three for each legitimate one, and another customer's /v1/predict text is never used. Spam and not-spam corrections reported by Siftfy's own sites (Folio and EchoThread) to /v1/feedback may also be used to train Siftfy's spam model, with the reported text kept for 12 months from the latest report. See Training on labeled submissions. One collection is disclosed on which we could, and it is not collecting: the spam label corpus — submissions your own honeypot caught and you reported to us as spam — which requires your separate written authorization. No customer has given one, so it holds no records. If it ever ran, that text would be kept 12 months and would be personal information, not anonymized data. Nothing received before September 21, 2026 is eligible, and the cut-off is a constant in the code rather than a setting. We do separately train on a corpus of public and self-owned content, which contains none of your submissions. Optional feedback corrections from your account are stored only as a salted one-way fingerprint, never as readable content. - Siftfy infrastructure. Our own compute and storage operate in the United States. TypeSafe processing follows its provider terms; we do not claim the same geographic restriction for that service.
- No data sales. We never sell or rent your data or share it with advertisers.
Security controls
- Encryption in transit. All API and dashboard traffic is TLS-only.
- Passwordless authentication. Sign-in is via magic-link email or WebAuthn passkey; we never store passwords.
- Hashed API keys. Keys are stored hashed and shown to you only once at creation. Revoked keys are purged after 90 days.
- Scoped Content Gate credentials. Public site keys cannot verify submissions. Backend secrets are independently generated, shown once, stored only as HMAC-SHA256 hashes, and cannot authorize prediction, feedback, or dashboard access.
- Bound, single-use challenges. Content Gate challenges expire within 120 seconds and bind the site, exact origin, action, content digest, proof parameters, and signing key. Atomic replay records permit at most one owned inference attempt; dependency failures become
indeterminate, never allow. - Least privilege. Internal access follows the principle of least privilege and is reviewed on a recurring basis.
- Abuse controls. Per-key and per-IP rate limiting, with tenant-attributed, deduplicated feedback to resist poisoning.
- Backups. Point-in-time recovery on production datastores, with backups rolling off within about 30 days.
Where we process data
Siftfy-operated compute and storage are in the United States. The paid shadow trial and live escalation also involve TypeSafe processing under its provider terms. Databases (DynamoDB), transactional email (SES), and storage run on Amazon Web Services in the us-east-1 (Northern Virginia) region; application compute runs in a US region.
Content Gate boundary
Content Gate raises the cost of automated form spam, scores each session from 0 to 100 for automation, and assesses the exact text submitted to a customer's backend. It is bot-resistant, not bot-proof: it does not prove humanity, replace DDoS protection, or protect a form unless the customer verifies the response on its backend before performing side effects. The widget's automation checks send only yes/no answers with the challenge request (see the privacy policy); it uses no fingerprinting, advertising identifiers, or cross-site cookies. Challenge material is not retained or logged. Submission text is retained separately when evaluation collection is enabled; short-lived content-free verification results support replay safety and idempotent retries.
Subprocessors
The third parties that process customer data on our behalf:
During the enabled paid shadow trial and live escalation, AWS stores selected evaluation text and TypeSafe receives it for classification. Siftfy does not promise zero provider retention. Outside those two, standalone prediction text is not sent to TypeSafe.
Data Processing Agreement (DPA)
Siftfy acts as a data processor for request metadata and enabled evaluation text it processes on your behalf and as an independent controller for account and billing data; processing takes place in the United States. If your organization requires a separate Data Processing Agreement, email hi@siftfy.io and we will work with you to put appropriate terms in place, including the Standard Contractual Clauses where they are required for transfers from the EEA, the UK, or Switzerland.
Retention
A full retention schedule is in our Privacy Policy. Standalone prediction content is not retained outside the enabled paid shadow trial and live escalation; selected trial text, live-escalated paid text and enabled Content Gate evaluation text is retained for 30 days from collection and then hard-deleted; authorized spam-label submission text is retained for 12 months and the no-content derived record behind it has no fixed period; logs roll off within 90 days; revoked keys within 90 days; magic-link tokens within 15 minutes; billing records are kept as legally required; and account data is deleted on request.
Reporting a vulnerability
Found a security issue? Email hi@siftfy.io. We acknowledge reports promptly and will work with you on a responsible disclosure timeline.
Common security & privacy questions
Is the message content I submit stored in logs, databases, backups, or support systems?
Normally no for /v1/predict, with one exception: when the paid TypeSafe shadow trial is enabled, selected Pro submission text is retained in private evaluation storage for 30 days, with credentials removed, and sent to TypeSafe for background classification. When live escalation is enabled, a paid /v1/predict request whose local score is from 0.5 up to the model's confidence ceiling is also sent to TypeSafe on the request path, and TypeSafe's confident answer replaces spam_probability; where evaluation collection is enabled that text is retained for 30 days for labeling. Free traffic is never sent. Enabled Content Gate evaluation separately retains the full submission text in private storage for 30 days, with credentials removed before storage. Separately again, a spam label corpus is disclosed on which submissions your own honeypot catches and reports to us as spam would be retained for 12 months and used to train our model, with a no-content derived record kept for longer; it requires your separate written authorization, no customer has given one, and it holds no records. Outside the enabled paid shadow trial and live escalation, /v1/predict text is classified in memory and discarded. Text is never placed in diagnostic logs or support tools.
Can my request content appear in debugging, monitoring, or error logs?
No. Our application logs and our validation/error responses are built to carry only metadata — request ID, status, timing, detected language, the spam probability, and account identifiers. They do not include the submitted text. We do not run a third-party error-capture or session-replay tool that would ingest request bodies.
In which country is my data processed?
Siftfy-operated compute and storage run in the United States, with AWS databases, email and storage in us-east-1. TypeSafe receives selected paid submission text when the shadow trial or live escalation is enabled; its processing locations and international transfers follow its published provider terms. We do not claim US-only processing for that provider.
Do you offer a DPA or documentation of your security controls?
If your organization requires a Data Processing Agreement, email hi@siftfy.io and we'll work with you to put appropriate terms in place, including Standard Contractual Clauses where they're required for transfers out of the EEA, UK, or Switzerland. This Trust & Security page documents our security controls, subprocessors, data residency, and retention.
What operational data do you retain, and for how long?
We retain account email and account metadata for the life of the account; request metadata (timestamps, status, duration, language, spam probability, tenant and key identifiers) and usage counts to bill and operate; server and application logs for up to 90 days; CloudFront access logs for our website page requests (no IP address) for 30 days, after which a storage lifecycle rule deletes them; revoked API keys for 90 days; magic-link sign-in tokens for 15 minutes; and billing records as required by tax law (typically 7 years). Separately, enabled Content Gate evaluation collection retains restricted full submission text for 30 days from collection, then hard-deletes it; records collected before September 19, 2026 hold masked text and keep their original window of up to 90 days. Separately again, where you have authorized the spam label corpus, honeypot-labelled submission text is retained for 12 months and the no-content derived record behind it has no fixed period.
Is message content ever used for model training, quality improvement, or analytics?
Standalone prediction content from your account is not used for training. The optional paid shadow trial retains selected Pro text for 30 days and sends it to TypeSafe for comparison, and live escalation sends paid text our model is unsure about to TypeSafe to decide; other standalone text is processed in memory and discarded. What we published on September 21, 2026 is a disclosed but inactive collection: where a customer authorizes it in writing, submissions their own honeypot catches and reports to us as spam would be retained for 12 months and used to train and evaluate the model. No customer has authorized it and the corpus holds no records. Every site running Content Gate is operated by VectraSEO LLC, the company that operates Siftfy, so there is currently no second party able to give that authorization. Nothing collected before September 21, 2026 is eligible for that corpus and nothing collected before then will be added, because it was collected while we said we would not train on it. That text is personal information and is not anonymized, deidentified, or aggregated. When Content Gate evaluation collection is enabled, we separately retain the submission text for 30 days to evaluate quality, with restricted access and human labels. We remove credentials before storage and nothing else, so these records contain personal information and are treated as restricted personal data; another customer's evaluation records are not used for training, and nothing in the evaluation collection is copied into the label corpus. From 2026-09-27, submissions from sites that VectraSEO LLC runs itself (today every site running Content Gate, including Emcognito and Folio) that our reviewer has labeled legitimate or spam may be used to train Siftfy's spam, AI-authorship and automation models, and are kept for 12 months for that purpose (the training copy is made by a daily job, only while the submission's 30-day evaluation record still exists, and a storage lifecycle rule deletes it 12 months after collection); submissions our reviewer labeled between 2026-09-22 and 2026-09-27 are also used, although they were collected while we said we did not train on the evaluation collection. From 2026-10-08, TypeSafe verdicts on Content Gate submissions from those sites may be used to train Siftfy's spam model: only the spam or legitimate verdict is stored with the submission text, kept for 12 months from collection, and verdicts given before 2026-10-08 are included while the 30-day evaluation record still exists. From 2026-10-13, /v1/predict text from accounts that VectraSEO LLC runs itself, already kept for the paid shadow trial or live escalation, may also be used to train Siftfy's spam model with TypeSafe's verdict or our reviewer's label, kept for 12 months from collection. This is forward-only: nothing collected before 2026-10-13 is copied. TypeSafe spam verdicts on that text are copied only up to three for each legitimate one, and another customer's /v1/predict text is never used. Spam and not-spam corrections reported by Siftfy's own sites (Folio and EchoThread) to /v1/feedback may also be used to train Siftfy's spam model, with the reported text kept for 12 months from the latest report. If you opt to submit a ham/spam correction to /v1/feedback from any other account, we use that text only to compute a salted one-way fingerprint; we store the fingerprint and label to improve accuracy, not the readable content. Marketing-website analytics are first-party and opt-in and never see API content.
If I stop using Siftfy, is any of my data retained after account deletion?
On a deletion request we remove your account email, API keys, passkeys, usage records, and the feedback fingerprints attributed to your account; backups containing that data roll off within about 30 days. The only data we keep is billing and tax records we are legally required to retain.
Contact
Questions about security or data handling? Email hi@siftfy.io.