Security and privacy

What your server and page handle

• The secret key (rgsk_...) belongs on your server only. A management key (rgmk_...) is refused where a site secret is expected.
• Verify every token on your server. A token is a claim until you do.
• The SDKs never put a secret in a URL, a log line, an error or a serialized object.

What the service receives

• Web widget: the signals the widget collects, solved proof of work and the request’s network metadata, to produce a score.
• Server SDKs: the response token, your secret key in a header or body, and optionally the end user’s IP address.
• Password check: only the first 5 hex characters of a SHA-1 hash of the password. The password never leaves your server.
• Payments: only the card’s BIN and last four, never a card number.
• Email MFA: the email address you name, to send the code. No SMS is sent.

The legal privacy policy and terms are at revokegpt.com/privacy and revokegpt.com/terms.

This site

This documentation site sets no cookies and makes no third-party requests. Its search runs in your browser.

Report a vulnerability

Email security@revokegpt.com. Please do not file public issues for vulnerabilities.