Understand the data behind an evaluation

Contractual data-processing terms are in the Data Handling Addendum.

AbuseZero evaluates repeat benefit claims using customer-supplied identifiers and retained outcome history. Your application continues to own authentication, payments, and delivery.

What AbuseZero receives

Evaluation requests require email. A backend-supplied IPv4 or IPv6 address is strongly recommended but optional. Depending on your integration, requests can also include a universal recipient ID, scoped payment fingerprints, verified-phone HMACs, optional browser observations, and registered hashed custom identifiers. Do not send raw card numbers, raw phone numbers, postal addresses, or arbitrary metadata.

Identity and authorization

AbuseZero self-hosts Better Auth for dashboard identity, TOTP, social sign-in, OAuth, and MCP authorization. Every signup requires a six-digit email code before an account is created. AbuseZero sends every authentication message through Resend.

REST and MCP accept environment-bound server credentials. OAuth access checks current organization membership and sensitive dashboard permissions on every request. Test credentials, resources, data, and MCP sessions cannot access Live.

Storage and access

Matching identifiers use keyed hashes scoped to the organization and Test or Live environment. Retained original evidence is encrypted by the application. Dashboard readers see masked identifiers unless they have reveal permission. Reveals and sensitive actions are audited.

Application and authentication data use Railway Postgres. Private imports and exports use Cloudflare R2. Resend delivers account email. Upstash Redis protects traffic capacity, disposable signup attempts, and bounded MCP organization context, and QStash dispatches background work.

REST and MCP boundaries

REST and vendor-neutral MCP call the same domain services and enforce the same scopes. Account authentication, API-key lifecycle, billing, organization administration, organization deletion, and internal support operations remain dashboard-only.

Retention

Test is persistent but bounded: encrypted original requests remain for up to 7 days, activity and ordinary operational history for up to 30 days, and redacted security-administration events for up to 90 days. Once-ever Test eligibility becomes available again when its retained activity expires. Active Test configuration does not expire by age.

Live detailed evidence defaults to 90 days, with 30- and 60-day options. Compact Live outcome and matching history remains for the eligibility lifetime, and Live audit records remain for 1 year.

Browser collection

Collection requires explicit customer enablement and a consent hook. If it is blocked or unavailable, evaluations continue without it unless the benefit requires bot evidence. AbuseZero stores derived browser identifiers and verified assessment results. Bot collection loads Google reCAPTCHA, which processes browser signals under its own terms.

Deletion and recovery

Organization owners and explicitly authorized members can preview deletion scopes. Cleanup preserves unrelated recipients and leaves redacted audit records. A restricted deletion journal is kept outside the database so completed deletions can be reapplied after restoration.