Heretic and DataDome

What a bot management platform does

DataDome, and the category around it, deploys through a CDN connector or a server-side module so it sees traffic in the request path. It combines device signals, behavioural modelling and a large cross-customer traffic graph, classifies each request in real time, and returns an action: serve, challenge, or block. Machine learning does the classification and the models are retrained continuously.

That is a genuinely different product from ours, and for large consumer sites with a broad abuse surface it is often the right one. It arrives with a managed policy, a threat feed, and a team watching it. We do not have any of those things and are not pretending to.

Where the two differ

The output

A managed platform gives you a decision. Heretic gives you findings. If a decision is what you want, that is a point in the platform's favour and we will say so.

If you have ever needed to answer "why was this customer blocked" and got back a classification rather than a fact, that is the cost of the decision being made upstream. Our output is contradicted, refused or uncontradicted plus every finding under a stable ID, each of which names something observed: stack.os-contradiction, geo.rtt-below-vacuum, reach.no-quic-attempt, integrity.realm-timezone-desync.

Where it sits

In-path deployment means the vendor is on your critical path. That buys blocking before the request reaches your origin, and it costs you an availability dependency and a DNS or CDN change.

Heretic is not in your request path. A script tag loads from our origin and talks to our sensor from inside the browser, and your traffic goes exactly where it went before. There is nothing to delegate and nothing of ours to fall over in front of you. The trade is that we cannot block anything for you, and by design would not.

What the classification rests on

A model trained on cross-customer traffic is comparing this visitor with a population. That is powerful, and it means a verdict depends on what the rest of the internet is doing this week.

Our rules do not compare against a population. They check a claim against a measurement of the same session. A round trip below the vacuum floor for the claimed timezone is impossible regardless of what other traffic looks like. Where we do compare against a population, such as GPU throughput against the usual range for a claimed model, the finding is marked conditional and never decides a verdict on its own.

Not failing open

A client that blocks the script, strips headers, drops the UDP a QUIC probe needs, or never runs the payload gets refused, and refused weighs the same as a contradiction. Not because non-completion proves malice, but because otherwise the cheapest bypass is to stop participating.

Cost and commitment

Bot management platforms are typically an annual contract with a traffic-based floor and a procurement cycle attached. Heretic is a monthly plan metered on probes and challenges, with a free Sandbox tier of 1,000 probes, no contract, and no minimum term. The pricing page has the numbers.

Which one you want

If you need scraping stopped at the edge before it reaches your origin, at scale, with a managed policy and someone else tuning it, buy a bot management platform. That is what they are for.

If you need to know what is true about a specific session, be able to name it afterwards, and keep the policy in your own code, that is what we return. Some teams run both: a platform handling volume at the edge, and a deterministic check at the two or three places where a wrong answer is expensive, such as registration and payout.