Bot protection that never leaves Germany.

ByeBot is a CAPTCHA service from Germany that protects forms, logins and sign-ups from automated traffic. The check runs in the visitor’s browser and is evaluated on servers in Germany. You embed a small script and verify the result from your own backend. Six widget modes are available, from a visible click field to an invisible check that runs in the background.

Yes. ByeBot sets no cookies, transfers no data to third countries and trains no AI models on visitor data. Hosting is in Germany, under a data processing agreement per Art. 28 GDPR. That applies on every plan, not only on an expensive tier. The legal assessment of your specific use still rests with you; we supply the paperwork.

No. The bot check sets no cookies, and nothing is left on the visitor’s device beyond what the check itself needs. Whether that requires consent is for you as the site operator and your data protection officer to assess. There is no recognition across other websites: what is checked on your site stays with your site. Signing in to the ByeBot dashboard uses one technically necessary session cookie, which has nothing to do with the CAPTCHA.

In Germany. Servers and database are in Germany, covered by a data processing agreement per Art. 28 GDPR. There is no transfer to third countries and no sale to third parties. Bot detection events are deleted after 30 days. Statistics are kept for 365 days on Pro and without a time limit on Enterprise.

A validation is a check that reaches verification, whether it passes or fails. Rejections before that point do not count: if an IP is on the block list, a country is blocked or a rate limit applies, nothing is billed. Pro starts at 10,000 validations per month and can be raised in steps of 2,000 up to 100,000.

In two steps. In the frontend you add a script and a container element to your form, and the widget handles the rest. In the backend you send the token you received to our verification endpoint and read the answer before you accept the submission. Code examples for common frameworks are in the documentation.

Further checks are rejected with HTTP status 429 and your sites switch to demo mode. Demo mode still shows the widget but no longer protects. The previous mode is stored and restored automatically as soon as the monthly counter resets or you raise your volume. So you lose no settings, only the protection for the rest of the period.

Partly. We work towards WCAG 2.1 AA, but we hold no certification and have no VPAT. The widget is keyboard operable with a visible focus ring, and the invisible modes ask most visitors for no interaction at all. Image tasks are the worst option for blind users, so do not make them the only route through your form.