The first System One model for AI agent detection

Only how the page is used, never what's typed or shown on it. We don't capture page content, typed text, or passwords.

The snippet records interactions like pointer movement, clicks, scrolling, touches, and keystroke timing. Keys are logged by type (letter, digit, backspace), never the key itself, and form fields record only their ID and length, never the value. It also collects browser and device details (user agent, language, time zone, screen and window size, graphics renderer, and automation flags) along with the page path, title, and referrer. IP addresses are hashed before they're stored, and the raw IP is never saved.

No. The script is about 9 KB compressed, loads asynchronously and has no dependencies, so it never blocks your page from rendering. It sends small batches in the background about every second, and it stops completely once it reaches a verdict. All the analysis happens on our servers, not in your visitor's browser.

gent Detection only gives a verdict once it has seen enough interaction, so very short visits get no verdict at all. Borderline visits come back as “review,” which most sites treat as human. It never blocks anyone on its own, so we recommend labeling traffic by default and only challenging visitors on sensitive flows like signup or checkout.

Not from the verdict alone. Authorization comes from your identity and access systems. Resemble Signal can add context on intent by checking content for fraud patterns.

Detection runs on our servers. The browser only reports what happened, and how we score it isn't public and changes over time. No behavioral check is impossible to fake, so use verdicts as a strong signal alongside your other controls, not as your only line of defense.

It depends on where your visitors are, so check with your legal team. The snippet collects behavioral and device data, which can count as fingerprinting. It also stores a visit counter in local storage and a session ID in session storage. In the EU, storing data in the browser usually needs consent unless it's strictly necessary. IP addresses are stored only as a salted hash.