What Cipher checks

Cipher combines many small signals into one score. No single signal decides the outcome on its own: a response is flagged when several pieces of evidence point the same way, or when one piece is very strong.

This article describes the families of signals at the level you need to understand a flag. We don't publish exact rules or limits, because that would make Cipher easier to get around.

Which checks run depends on your survey's Cipher tier and your plan. See Cipher settings and plans.

Bots and automation

Cipher looks for signs that a browser is being driven by software: automation tools, browsers running without a screen, browsers that identify themselves in ways real ones don't, and devices whose reported details don't match how they behave.

Timing and speed

People need time to read. Cipher notices responses that finish far faster than the questions can be read, answers that each took almost exactly the same time, and long gaps in places that don't need thinking about.

Typing and paste behaviour

For written answers, Cipher looks at how the text got there: typed and revised, pasted in, typed out steadily as if copied from somewhere else, or appearing with no typing behind it at all. It also notices keystroke rhythm that is too regular to be human and pointer movement that jumps from point to point.

Attention and tab switching

Cipher notices when a respondent leaves the survey tab repeatedly or for long stretches, and in particular when someone leaves in the middle of a written answer and comes back with a finished one. Stepping away once in a while is normal. Browsers do not reveal which site or app someone switched to, so Cipher never sees that.

Straightlining and patterns

On grids and rating scales, Cipher notices when the same option is picked down a whole column, which leaves the answers with almost no information. It also notices answers that are too short or too empty to be useful, and written answers that only repeat the question.

Contradictions and consistency

Cipher checks whether two answers in the same response can both be true. When Surbee generates a survey for you, it includes a few quality questions by default, such as an attention check and the same fact asked twice far apart, which give Cipher something concrete to compare.

Text quality and AI-written text

On Pro and above, Surbee's AI reads written answers and judges whether each one responds to the question, how much effort it shows, and whether it reads as AI-written or copied from elsewhere. Cipher also looks for traces that chatbot output tends to leave in text, such as hidden characters and characteristic phrasing.

Duplicate devices and networks

Cipher notices when several responses arrive from the same network in a short time, and these responses are flagged for you to review. On higher tiers it also looks for the same device submitting more than once, the same answers appearing on different responses, and groups of responses that arrive in lockstep. Higher tiers also check whether a connection comes through a VPN, proxy, Tor or a datacenter.

Mobile and touch signals

Phones and tablets don't produce mouse movements or the same typing patterns as a keyboard, so Cipher reads a different set of signals on touch devices: how taps and swipes move, use of the on-screen keyboard, and whether the device is held in a hand or resting on a surface. When a device doesn't share its motion sensors, Cipher judges the response on touch and content alone.

Invisible bot check

Surveys served from Surbee's own addresses run an invisible bot check in the background. Respondents don't see a puzzle or a checkbox. A response that fails the check is kept and flagged as Likely a bot, so you can decide what to do with it.