What is built — and what is not

This page is the cross-check on everything else on skriza.com. It lists each component with its actual state and evidence someone could go and verify. Where something is missing, it says so — that is the point of the page. A claim that does not survive one question is worse than no claim.

Skriza Shield — bot protection

The most mature part. It replaces Google reCAPTCHA and embeds on other people's sites.

  • Proof-of-work verification

    running

    A memory-hard computation in the browser instead of an image puzzle. IP addresses only as an HMAC hash, never in the clear.

    Checkable: 13 modules with their own tests, 8 API routes, publicly reachable at captcha.skriza.com

  • Risk engine

    running

    Scores client signals, IP reputation and threat feeds, then decides: pass invisibly, challenge, or block.

    Checkable: Thresholds configurable per customer site (0–4); decisions are recorded

  • Accessible alternative

    running

    Anyone who cannot see or operate the rotate task solves a pure computation instead.

    Checkable: Keyboard-operable; a non-visual path with no audio riddle

  • Third-party embedding

    running

    Widget plus server-side verification, with a Turnstile-compatible interface shape.

    Checkable: 5 SDKs in the repository: Go, PHP, Python, React, Vue

Platform

  • Feed ranking

    running

    The public feed is ordered by published principles: replies count for more than likes, views count zero.

    Checkable: Principles and the ordering of weights at /ranking; anti-abuse thresholds deliberately withheld

  • Reporting and moderation

    partial

    Report with a reason, a queue for review, remove or dismiss, and the reporter hears back. Every measure is logged.

    Checkable: Reporting, the queue and the reply to the reporter run (DSA Art. 16). Anyone affected by a measure is notified — with the reason, whether automated means were involved, and what it rests on (Art. 17). Retention for evidence and logs runs daily. Still missing: an appeal procedure (Art. 20), which Art. 19 DSA does not require at our size

  • GDPR self-service

    running

    Data export as JSON and permanent account deletion, both in settings.

    Checkable: Deletion removes the account with its posts and messages — no deactivation flag

  • Messages, rooms, media

    running

    Real-time direct messages, live audio and video, image and video upload with transcoding.

    Checkable: 11 background jobs, self-operated LiveKit and S3-compatible storage. Only a token that permits it may publish — enforced server-side, not in the interface

  • Moderation inside a running room

    running

    Withdraw the right to publish, remove someone, end a broadcast — while it is running.

    Checkable: Withdrawing the right to publish does not disconnect anyone, it stops what is being sent; chat messages are hidden rather than deleted so an appeal still has something to assess

  • Profile pictures with a content check

    running

    Upload one or adopt your Google picture, both through an automated check for pornographic content.

    Checkable: Metadata including GPS is stripped on re-encoding; objected-to and unchecked pictures both go to a person, and the two cases are reported apart. Google pictures are copied rather than embedded, so no page view is reported to Google

  • Developer platform

    running

    Projects and sub-projects, separate keys for Login, Shield and Pulse, usage metering.

    Checkable: Keys authenticate against a real endpoint and are bound to a product — a Shield key reaches no Pulse endpoint. Calls are counted hourly

What does not hold yet

These are the things that read as finished elsewhere. They are not.

  • Our own measurement instead of Google Analytics

    running

    First-party analytics with no plaintext IP, on our own servers.

    Checkable: Finished in July 2026: Google Analytics and Cloudflare Zaraz are switched off and measurement runs on Skriza Pulse on our own servers. The network tab on this page shows no request to a foreign host

  • Our own recommendation and moderation models

    being built

    Models built in-house instead of off-the-shelf ones from outside Europe.

    Checkable: The rule-based ranking runs. There is no learned model

  • Coordinated-voting detection

    partial

    Accounts boosting each other lose weight — measured on how balanced and how concentrated the exchange is.

    Checkable: Running for pairs and for closed circles of accounts, a substantial discount; the depth we walk is not published. Coordination that never closes into a circle is not detected

  • Verified institutions

    planned

    Universities and public bodies prove who they are; credentials become cryptographically checkable.

    Checkable: Not implemented. Accounts are verified by hand today

  • Age assurance and parental controls

    planned

    The precondition for admitting minors at all.

    Checkable: Not implemented. That is why the platform is closed

  • Our own delivery instead of Cloudflare

    planned

    Attack protection and delivery on European nodes.

    Checkable: A US CDN currently sits in front of the site; stated in the privacy notice

How to read this

Skriza is in closed beta. The numbers on this page are counted from the source, not estimated: 467 automated tests, 58 data models, 5 SDKs.

Shield is usable and already embeds outside Skriza. The platform itself is not there yet: moderation, age assurance and the in-house models are missing, and we do not open without them.

To check any of it: the Shield challenge can be triggered at captcha.skriza.com, the feed formula is at /ranking, and what Shield processes is in its own privacy notice. If anyone finds a contradiction between this page and what the platform does, that is a bug we want to hear about.