PIPL Compliance

ALTCHA is fully compliant with PIPL.

ALTCHA is a self-hosted, privacy-first solution designed to simplify compliance with China’s Personal Information Protection Law (PIPL). Unlike third-party services, it operates entirely within your infrastructure, eliminating external data processing, tracking, or cross-border data transfers—ensuring user data remains under your control and within China’s legal jurisdiction.

PIPL Compliance

1. No Cookies or Tracking

ALTCHA does not use:

• Cookies nor Fingerprinting – No consent banners required under PIPL.
• Personalized Analytics – Verification logs are anonymized, with no ties to individual users.

For more technical details on how Sentinel respects and protects user privacy, please see the Privacy Protection documentation.

2. Fully Self-Hosted

• All data processing occurs on your servers within China—ensuring compliance with PIPL’s data localization requirements.
• No cross-border data transfers—eliminating PIPL’s strict export restrictions.

3. No Personal Information Storage

• Verifies interactions without collecting identifiable user information as defined by PIPL.
• IP addresses and metadata are anonymized or discarded, preventing classification as sensitive personal data.

4. No Subprocessors or Data Sharing

• No third-party dependencies—removing PIPL’s obligations for external vendor assessments and approvals.

PIPL Compliance Checklist

While ALTCHA is compliant by design, ensure your implementation follows PIPL best practices:

• No Explicit Consent Needed – Zero cookies or tracking means no additional user consent requirements.
• Data Minimization – Collects only what’s necessary (if anything), aligning with PIPL’s principle of minimum necessity.
• Automated Compliance – No stored personal data = no user access, correction, or deletion requests.
• Strict Data Localization – Self-hosting within China ensures compliance with PIPL’s jurisdictional requirements.

Why It Matters

PIPL compliance is streamlined with ALTCHA:

• Self-hosted in China = Full data sovereignty.
• No tracking = No PIPL consent or disclosure obligations.
• No cross-border transfers = Simplified regulatory adherence.

By design, ALTCHA reduces compliance burdens while safeguarding user privacy under PIPL.

---

ALTCHA is designed to support PIPL-compliant implementations, but final responsibility for regulatory compliance lies with you, the data controller. Ensure your deployment does not introduce additional data processing or storage beyond what ALTCHA provides.