GDPR
This documentation covers SCaptcha 2.3.0. Configuration-dependent features are identified separately.
Scope
SCaptcha runs inside your WoltLab Suite installation. In normal operation, SoftCreatR does not receive verification data. Optional features and logging in your installation still need to be assessed separately.
Core verification
Each challenge uses its own cryptographically random 32-byte salt. Your WoltLab installation validates the salt, hash, algorithm, answer, and HMAC against the issuing session. The challenge expires after 60 seconds and does not require an external CAPTCHA provider.
Proxy check
This option is off by default. If you enable it, SCaptcha sends the visitor's public IP address to proxycheck.io for proxy, VPN, or Tor evidence. SCaptcha 2.3.0 sends tag=0 by default; administrators can opt in to provider logging. The IP address is transmitted for every lookup either way.
Logging at proxycheck.io
SCaptcha 2.3.0 sends tag=0 to proxycheck.io by default. Operators can opt in to provider-side positive-detection logs. The public IP address is transmitted for the lookup either way, and provider failure is not treated as a clean result.
Security cookies
A pre-submit marker and the optional text/audio proof are valid for 5 minutes. Under-Attack mode uses a signed, user-agent-bound access cookie for 5 to 30 minutes; the default is 10. Sentinel can store a server-side rejection in a separate signed cookie for 10 minutes. Sentinel itself is off by default.
Optional browser checks
Behavior checks are off by default. The code contains pointer, movement, and scrolling checks, plus optional canvas, WebGL, and audio routines. Evaluation happens in the browser; results can affect local scoring and SCaptcha logs. This documentation therefore makes no blanket no-fingerprinting claim.
Analytics and retention
Request analytics are on by default. Logs can contain linkable operational data, including IP address, user agent, request, network and location fields, reasons, and submitted browser telemetry. Retention defaults to 90 days and can be set from 1 to 3,650 days. Turning analytics off stops new collection but does not erase existing rows or exports.
Responsibility and data processing
In a normal self-hosted installation, SoftCreatR does not process visitor data on your behalf. If you enable proxycheck.io or another external service, assess and document that relationship separately. Your hosting and support setup can create additional roles.
Deployment checklist
Enable only the options you need. Update privacy and cookie notices, restrict access to analytics and logs, and test the actual form integration before launch.