# OpenWAF Verify — public page on the data it processes, and a draft DPA annex

> A page on openwaf.dev lists what the Verify challenge page, widget and siteverify process, what they never collect, for how long and where, with a paragraph for your privacy policy. Both it and a DPA annex for Verify are drafts pending legal review.

[Data processed by OpenWAF Verify](https://openwaf.dev/legal/verify-data/) describes, per surface, what the [challenge page](https://developers.openwaf.dev/waf/browser-challenge/), the [widget](https://developers.openwaf.dev/waf/verify-widget/) and [siteverify](https://developers.openwaf.dev/waf/siteverify/) process: the IP address and its /24 or /64, the risk signals by name, the browser checks as yes/no bits, the proof-of-work timing, the TLS ClientHello traits and JA4 fingerprint (evaluated in memory, not kept by Verify), Private Access Tokens (not enabled today), and the `__waf_pass` cookie with its attributes. It also lists what Verify never collects, how long each item is kept (about 10 minutes in node memory; counts without IP addresses for 30 days), where it is processed, the roles under the DPA, a draft legal basis and a paragraph you can adapt for your privacy policy.

A [draft DPA annex for Verify](https://openwaf.dev/legal/verify-dpa-annex/) puts the same facts in contract form. Both texts are drafts pending legal review; until the annex is incorporated, the published [DPA](https://openwaf.dev/legal/dpa/) applies.

The browser challenge page now states that the `__waf_pass` cookie holds the visitor's network prefix itself, signed, and the challenge only a hash of it. [Siteverify](https://developers.openwaf.dev/waf/siteverify/#data) has a new «Data processed» section.