What gets scanned on upload, and where it goes

The text of your site is checked automatically for abuse: phishing, imitation of banks or brands, scams, malware, illegal content. We put your site under our own domain, so we want to know what is there.

What goes out is the visible text, the page title, the texts in form fields, the text of .txt, .svg and .xml files and the rules from a _redirects file, together at most around 12,000 characters. Before that come the names of the fields and the addresses the pages load or that forms and scripts send to, at most around 3,000 characters. That way a fake login page stands out even when it has almost no text. No images, and nothing else from scripts or styling. We check every version you publish, every day while the site is with us (also when it is paused), and right away when someone reports it. That text goes to Anthropic, which processes it outside the EU, does not train on it and deletes it within 30 days, longer only if it is flagged as abuse. A normal site of a hairdresser, a practice or a shop passes; so do empty pages, test text and half-built sites.

What happens when the check rejects a site:

• A trial site that nobody has claimed yet is blocked: you get an HTTP 422 with error blocked and a short reason.
• A site you claimed or pay for stays online. The new version is refused with an HTTP 422 and error rejected, the previous version keeps running, and a person decides whether anything more is needed. Only if the new version contains evident phishing or malware does the whole site go offline right away.
• The daily check and a report only take a live site offline on their own if three checks in a row find evident phishing or malware. Anything else goes to a person first.

If your site goes offline, you get an email that says whether our automatic check or a person decided, and which article of our terms it rests on. Think it is a mistake? Reply to the email or open a ticket at /support and we check it by hand. Getting around the check is not possible: if it cannot run, nothing is published.

The same check runs on the start page of an app after its first start.

We remove the stored location (GPS) from photos before they go online; the photo is otherwise unchanged, including which way up it is. If that fails for a photo, the response of your publication says so.