Configurable data residency
How a visitor becomes a decision.
A guided tour of the engine behind the score — how the browser is read, turned into a calibrated risk read, and handed back to your code. Follow it end to end: the signals we measure, the threats we catch, and the outcomes behind every call.
Every device tells a story. We catch the fictions.
Stop fraud and bots without challenging the customers you worked hard to win. Get a clear risk read on every visitor — and decide what to do with it.
Agentic security and browser intelligence, now built for the agentic web — operate your console with a built-in AI assistant, let your agents read Noxtica over a read-only MCP server, and govern which agents you trust.
From signal to decision.
Four stages. The browser is read, the result is handed safely to your backend, your server gets a clear risk read, and your code makes the call.
A lightweight script reads the visitor's browser the moment they land — quietly, without slowing your page down.
What it sees is handed safely to your backend — it can't be faked, copied, or replayed on the way.
Your server checks it and gets back a clear risk read, with the reasons behind it — in about half a second.
Your code makes the call: block, challenge, watch, or wave through. Your policy, your context, your decision.
One read. One verdict. The reasons attached.
87
Low risk — allow
Illustrative sample — not live traffic.
Why we don't tell you 'this is a bot.'
Most tools tell you what you want to hear: bot or human. Clean, simple, and often wrong — with no way to see how they got there. You either trust the answer or you don't.
Real customers and real attackers can look surprisingly alike. The useful question isn't 'is this a bot' — it's 'how unusual is this visitor, and how hard would the suspicious parts be to fake?' That's what we answer.
// We don't just say 'this is a bot.'
// We give you a clear risk read — and the reasons.
// You decide.
When a flag lands on a real customer, your team can explain it — to legal, to product, to the customer. Every decision comes with its reasons, so there's nothing to take on faith and nothing you can't tune.
You don't get a black-box yes/no. You get a clear risk read, a confidence level, and the reasons behind both — the receipt. The final call is yours, because only your team knows what's at stake.
Most tools hand you a yes/no and hide how they got there. We give you a clear risk read, with the reasons — and let your team make the call.
Five clear levels, not a blunt yes/no — and never a silent block.
What we measure.
We read four things about every visitor — the browser, the network, the device, and how the person behaves. Together they tell a real customer apart from a clever fake.
Is the browser real?
Browser intelligence
Catch automated traffic, masked browsers, and synthetic visitors the moment they arrive — before they reach your signup, login, or checkout. Real customers pass through. Fake ones don't.
Is the network safe?
Network signals
Spot suspicious origins and high-risk infrastructure without punishing legitimate traffic. Remote workers, VPN users, and corporate networks stay welcome. Wholesale fraud sources get flagged.
Is the device real?
Hardware verification
Verify the real device behind the session — not just the software running on it. Genuine users on genuine devices breeze through. Bots running on shared, throwaway infrastructure surface immediately.
Is the user real?
Behavioral fingerprints
Tell a real person from a script by the rhythm of how they interact with the page. Humans hesitate, correct themselves, and explore. Automation moves with a tell-tale precision it can't hide.
And one we govern: Know Your Agent
These four layers measure visitors. AI agents and bots are different — you don't just measure them, you decide whether to trust them. Know Your Agent lets you allow or deny agents per tenant by JWK thumbprint or Signature-Agent host, integrated with Web Bot Auth verification.
What we catch.
The threats that cost you — automation, fraud, and abuse — caught without false-positively challenging real customers.
Catching fraud isn't a single check. Real-world abuse blends automated traffic, suspicious origins, and behavior that doesn't add up. We turn all of it into the kind of decision your team actually makes — block, challenge, allow, observe.
Bots & automated traffic
Headless browsers, browser-automation frameworks, and scripted abuse — including the 'stealth' variants designed to evade detection. The fast lane and the slow lane both get caught.
Recognize automated traffic before it reaches login, signup, or checkout.
Sessions that hide what they are
Sessions where the browser is lying about its own fingerprint. Spoofed canvas output, manipulated runtime APIs, anti-fingerprint extensions running aggressive countermeasures.
Surface deliberate evasion attempts without blocking honest privacy choices.
Suspicious origins
Traffic originating from datacenters, anonymizing proxies, deprecated protocols, and known-bad ranges. We flag the patterns without blocking real users who happen to be on a corporate VPN.
Identify the wholesale-fraud signal — without misfiring on remote workers.
Privacy users, treated fairly
Tor, Brave Strict, Firefox-RFP, LibreWolf — recognized and treated with calibrated leniency. Privacy-conscious users stay welcome; bots hiding behind privacy browsers do not.
Welcome legitimate privacy users while still catching the actors hiding among them.
Fake & throwaway devices
We look past the browser to the device itself, so emulators and throwaway virtual machines can't pose as real hardware. The bots that beat browser-only checks get caught here.
Verify the device is what it claims to be — not just the browser running on it.
Activity that doesn't behave human
How a person moves, types, and scrolls looks nothing like a script. Real people hesitate and explore; automation gives itself away with tell-tale precision.
Catch the sessions that look human on paper but don't behave like a person.
A visitor's request is read across the threats we catch, which combine into a single clear risk read.
- Browser request
- Clear risk read
- Your decision
Each one gives you a clear risk read and a confidence level — not a blunt yes/no. Your team owns the final call. We just make sure what you're acting on is honest.
See what we catch.
Six attack patterns, each derived from a threat category above — replayed to show the calibrated risk read and the call it drives.
- Headless automation flood
94/ 100 risk
BLOCKEDread in 410msA wave of headless, scripted sessions hitting login in lockstep.
- Spoofed-fingerprint session
78/ 100 risk
STEP-UPread in 470msA browser lying about its own canvas output and runtime APIs.
- Datacenter proxy origin
86/ 100 risk
BLOCKEDread in 350msA request routed through an anonymizing datacenter range.
- Privacy-browser visitor
24/ 100 risk
ALLOWread in 340msA real person on a hardened privacy browser — waved through.
- Throwaway virtual machine
90/ 100 risk
BLOCKEDread in 520msAn emulated device posing as real consumer hardware.
- Non-human interaction pattern
71/ 100 risk
STEP-UPread in 430msA form filled with tell-tale precision no person types with.
Illustrative patterns derived from the categories above — not customer data. Scores sit on the same 0–100 scale your policy acts on.
Held the line on fraud. Kept customers moving.
Numbers from an early design partner's rollout — shared anonymously
- 47%chargebacks a design partner cut in their first 90 days
- 99.6%of real customers waved through untouched in that rollout
- ~500msadded to a checkout — a full risk read in the blink of an eye
$ noxtica use-case --marketplaceMarketplace
Marketplaces use Noxtica to catch coordinated fake-account rings before they bury honest sellers in fake reviews. Different logins, different addresses — but the same automated setup gives them away.
Fake-account rings caught before they bury your honest sellers.
$ noxtica use-case --financialFinancial services
Card-not-present merchants use Noxtica to add a quick extra check only when a payment looks like it's coming from somewhere new. Real customers feel nothing; fraud rings hit a wall on every attempt.
An extra check only when it's warranted. Real customers feel nothing.
$ noxtica use-case --identityIdentity-sensitive platforms
Passwordless and magic-link platforms use Noxtica to make sure the link is opened by the same person who asked for it. Phishing kits that relay the link to someone else get stopped at the door.
Magic links open only for the person who asked. Phishing stops here.
Four audiences. One signal.
Agentic security and browser intelligence are rarely just about one team. The same signal shapes outcomes for businesses, platforms, and the people who use them.
For companies
Fraud teams, security engineers, platform PMs. The teams that pay when fraud lands and the teams that pay when real customers churn.
- Cut chargebacks by catching fake signups before they cost you
- Spot account takeovers before the attacker gets in
- Audit-ready trails for SOC 2, ISO 27001, and GDPR
For platforms
Marketplaces, social networks, multi-sided platforms. Trust between users is the whole business — and stopping fake accounts at scale is your moat.
- Catch duplicate-account abuse without locking out real users
- Cut moderation load by surfacing only the accounts that look off
- Stop paid-review farms and review-bombing rings at signup
For people
End-users. The under-discussed stakeholder. The people who get false-positively challenged, blocked, or asked to solve CAPTCHAs for being on Brave.
- No CAPTCHAs unless something genuinely looks suspicious
- Real people on privacy browsers stay welcome, not punished
- No personal data collected. No tracking cookies. No cross-site identity.
For AI & agents
The agentic web. Govern which agents you trust with Know Your Agent, run the console with a built-in AI assistant, and let your own agents read Noxtica over a read-only MCP integration.
Three honest ways we're agentic.
"Agentic" gets thrown around. Here's exactly what it means at Noxtica — three capabilities that ship today, with no autonomous changes to your systems.
We operate the console
A built-in AI assistant — powered by Claude, with OpenAI, Gemini, and xAI options — runs server-side under the operator session to read policies, rules, domains, and risk distribution for you, with per-tenant budget caps and full audit logging.
How the assistant works →Your agents read Noxtica
An opt-in, read-only Model Context Protocol (MCP) server lets your own AI agents read policies, rules, alerts, and risk distribution over JSON-RPC, using scoped, rate-limited, audited bearer tokens you mint — read access only, never write.
Read the MCP docs →We police the agentic web
Know Your Agent (KYA) is a defensive registry: govern which AI agents and bots you allow or deny per tenant — by JWK thumbprint or Signature-Agent host — integrated with Web Bot Auth verification.
Explore Know Your Agent →
Where we're headed
We're building toward self-calibration and feedback loops; today operators tune policies and thresholds with full control.
Built to clear security review.
The security posture reviewers ask about — six controls you can check yourself, not take on faith.
GDPR-ready
Open SDK source
No PII collected
A full risk read in ~500ms
A clear read, not magic
A partner, not a pricing page.
Everything you need to ship with confidence — and nothing you don't.
What's included
- Transparent pricing — no demo wall
- Hands-on onboarding from real engineers
- GDPR-compliant, configurable data residency, SOC 2-ready
- Direct human support — no sales sequence
Questions teams ask first.
The things buyers and engineers want to know up front. The full technical FAQ — bundle size, the API, iframes, thresholds — lives in the docs.
Will this wrongly block my real customers?
That's exactly what we build against. A blocked customer rarely comes back, so the defaults lean cautious: we'd rather let a bot slip than wrongly stop a real person. You get a clear risk read and decide how strict to be — and you can dial it tighter or looser as you learn your own traffic.
Does it work for privacy-minded users — Brave, Tor, LibreWolf?
Yes, and they stay welcome. Privacy browsers don't break anything; we simply recognize them and treat them fairly instead of silently punishing the person behind them. If your product is built for sensitive audiences, you can choose to give those users extra leeway.
What if Noxtica has an outage?
Your site keeps working. If a check can't reach us in time, you get a safe default back so your code can fall back gracefully — challenge instead of block, for example — rather than locking anyone out. We commit to 99.95% uptime and publish a public status page.
Do we need engineers to run this?
A little. A small script goes on your site and a single check happens on your server when you want a decision. There's nothing to host, nothing to keep running, and the heavy lifting is on us. Most teams are live in an afternoon — the step-by-step guide is in the docs.
Is it compliant — GDPR, CCPA, EU data?
Yes. We collect no personal data we don't need, store no raw IP by default, and keep data in the EU. We'll sign a data-processing agreement, support hard-delete on request, and publish our subprocessor list. Your privacy and legal teams get straight answers, not hand-waving.
More in the docs — bundle size, the API, iframes, threshold tuning, and the full technical Q&A.→ Read the docs: full technical FAQ