Technical Support

Yes, the v1 REST API is included with every account at no extra cost. It covers creating managed takedown cases, listing detections from monitoring, reading and updating compliance notices, and registering webhooks. Authentication uses bearer keys you create and revoke from your account settings; keys are shown once and stored only as SHA-256 hashes. The interactive documentation with copy-paste curl examples lives on our developers page.

Each API key is limited to 60 requests per minute, enforced before database lookups so heavy traffic on one key can never degrade service for others. Exceeding the limit returns HTTP 429 rather than an auth error, so your client code can back off and retry cleanly. Case creation is additionally capped at 10 per day per account, the same limit as the web form, because every case involves real human work downstream.

Yes. Register HTTPS endpoints from your settings and pick the events you care about: detection.created, complaint.created, complaint.status_changed, notice.created, and notice.counter_filed. Every delivery is signed with an HMAC-SHA256 header (X-WebDMCA-Signature) over the timestamp and body so you can verify it genuinely came from us. Failed deliveries retry three times with backoff, and an endpoint that fails ten times in a row is auto-disabled, you get a dashboard warning rather than silently losing events.

A stack of straightforward, verifiable methods rather than a black box. Scheduled scans run your asset's keywords through web search (Google and Bing) and the official YouTube Data API, and admin-configured crawls of known pirate sites. Text candidates are scored by phrase-overlap against your registered work. Image assets get a perceptual hash (pHash) fingerprint, and candidate images are hash-compared so a re-upload is confirmed as a visual match even after resizing or recompression. Domain and trademark assets are watched daily through Certificate Transparency logs for lookalike registrations. A gray-zone filter (optional LLM triage) discards obvious false positives before they reach you, and every actionable detection is captured with a SHA-256 hashed evidence snapshot.

Every detection carries a score you can interpret: phrase-match candidates score in the middle band and are worth reviewing, while a verified visual match, an image whose perceptual hash matches your registered fingerprint, scores 95+ because it is a content-level confirmation, not a keyword guess. We deliberately do not publish an accuracy percentage; what we do instead is show the evidence (snippet, title, URL, and the capture itself) so you make the final call on each detection, and one click files a takedown from the detection itself.

Three layers. First, your own domains and subdomains are automatically excluded so your sites never flag themselves. Second, the gray-zone filter drops weak candidates before they reach your queue. Third, the layer that matters most, every detection waits in a review queue where you confirm or dismiss it individually; nothing is auto-filed unless you explicitly enable auto-takedown for 95+ detections. Dismissals are one click and permanent for that URL, so repeat noise stays dismissed.

For case evidence uploads: PNG, JPEG, WebP, GIF, PDF, TXT, and ZIP, up to 15 MB per file and 10 files per case. For registered image assets, anything the sharp imaging library reads, PNG, JPEG, WebP, GIF, and more, gets fingerprinted for visual matching (with a sane pixel-size cap of 8000×8000). Text assets just need the text itself or keyword phrases; you can paste content and we extract the monitoring phrases automatically.

We find copies of your work wherever they surface, including on scraper sites and AI dataset collections, because the matching is against your content (phrases, fingerprints), not against the kind of site hosting it. What we cannot do is detect that a piece of content was AI-generated; that is a different problem from proving it copies your registered work. When your originals are the source, the match and the evidence trail work the same as any other case.

Any destination with a published abuse or legal contact, which is nearly all of them: the infringing site itself, its hosting provider, its registrar (for domain-level action), and the search engines for de-listing. Those are the four channels in every managed case. For discovery, YouTube gets first-class treatment through the official YouTube Data API. We do not hold special API partnerships with Facebook, Instagram, TikTok, or similar networks; when your content shows up there, the case goes through their public rights/reporting channels like anyone else, we just prepare, track, and escalate it properly.

As one of the four channels in a managed case, we submit legal removal requests to the major search engines through their official DMCA/legal-removal flows for the specific infringing URLs. De-listing is decided by each engine independently, it removes the URL from results, it does not delete the page itself, which is why the case also works the site, host, and registrar channels in parallel rather than waiting on the engine.

NFT marketplaces are websites with hosts, abuse contacts, and registrars, notices work there like anywhere else, and stolen-art cases on marketplaces are a routine category for us. Truly decentralized storage (where content lives on no removable server) cannot be taken down by anyone, us included; we will say so plainly rather than take a fee for an impossible ask. What usually still works in those situations is de-listing and chasing the front-end gateways that make the content easily reachable.

Everything runs over TLS, sessions support two-factor authentication with single-use backup codes, and API keys are stored only as SHA-256 hashes, we could not read your key after creation even if we wanted to. Evidence files are served only to the case owner and staff, downloads are forced as attachments, and every outbound fetch of a target URL passes through an SSRF guard. We have not completed formal certifications like SOC 2; if you need the honest current state of our security practices for review, ask and you will get specifics, not a brochure.

Account settings include a formal data request flow for export and deletion, handled within statutory windows; deletion anonymizes your personal identity fields while preserving the legal and financial record of filings. Marketing email is opt-out from any message, notification emails are individually toggleable, and visitors in strict consent jurisdictions get an equal-prominence Accept/Reject cookie banner with Google Analytics gated behind consent. Data is processed in the United States.

The database is backed up via the admin backup tool (compressed, restorable through a confirm-guarded flow that can maintain a maintenance window), Redis runs with append-only persistence so queued scans and emails survive restarts, and scan schedules resume automatically after any outage. Backups are an operational capability we use and test rather than a marketing line item; if your risk assessment needs specifics on cadence for your account tier, ask and we will tell you exactly what it is today.

A modern browser, the dashboard is a responsive web application and works on desktop and mobile; there is nothing to install. The public API needs any HTTPS client. There are no mobile apps or browser extensions today; if you expected one, that is an honest gap, and the web dashboard is deliberately full-featured on mobile screens in the meantime.

Email support answered by the people who actually work the cases, with the developers page as self-serve documentation for the API and webhooks. Every case you file has a timestamped progress log visible in your dashboard, so 'what is happening' questions usually answer themselves without a support round-trip. Business and higher plans get priority handling on urgent work.