Blocking bots without tracking people
Abuse protection usually arrives bundled with surveillance. Why SEES uses Turnstile and what it does not collect.
Open endpoints get abused.
Vault creation and the contact form are unauthenticated by design — there are no accounts to rate-limit against. That openness is the point, and it is also exactly what automated abuse looks for.
Most bot defences are surveillance with a job title.
The standard answer is a challenge that profiles the visitor: cookies, device fingerprinting, behavioural scoring across sites. It works, and it quietly undoes the reason someone chose a privacy tool in the first place.
Cloudflare Turnstile, verified server-side.
Turnstile issues a token that our server checks against Cloudflare's verification endpoint before the request is accepted. It is designed to run without tracking cookies or cross-site behavioural profiles, which is why it was the acceptable option here.
It never touches your notes.
Worth stating plainly: the check happens before anything is created, and it sits entirely outside the encryption path. No note content, no passphrase, and no derived key is involved in it — a bot check cannot see what even we cannot see.