MindcatConsulting, home
Get the assessment
A Dubai brokerage sales manager on the phone with a printed lead list full of crossed-out lines.

Vercel · Security

Your agents spend the morning calling leads that never existed. Check every form send before it reaches Salesforce.

Bots fill enquiry forms with real-looking names and dead numbers. Each one becomes a Salesforce lead, an agent’s call and a WhatsApp message to nobody. BotID adds a check the visitor never sees. Your server asks whether the send came from a bot, and only sends that pass become leads.

Get the written assessmentSee it work in your industry

Salesforce consulting partner since 2010 · MVP Hall of Fame · 200+ agents in production · UAE, India and US desks

The problem

What fake leads cost you today.

What BotID is

BotID, in plain words.

Facts from Vercel’s own pages, checked on 16 October 2026. The sources are at the end of this page.

What it is
An invisible CAPTCHA. It protects against bots without showing visible challenges or asking the visitor to do anything.
How it decides
The browser solves a hidden challenge. Your server calls checkBotId() and gets a pass or fail, not a score.
Two levels
Basic is free on all plans. Deep Analysis, powered by Kasada, reads thousands of client-side signals, on Pro and Enterprise.
What Deep Analysis costs
On Pro, $1 per 1,000 Deep Analysis checks as of 16 October 2026. Page views that do not call checkBotId() are not charged.
Where it runs
Only on the routes and components you configure, for frontends served on Vercel.
Privacy
Vercel says it checks the session without storing user behaviour or personal data.

How it works

From a form send to a lead you can trust.

Five steps. The visitor sees none of them. The check runs on your server before anything goes to Salesforce.

Five steps: a visitor sends the form, the browser solves a hidden check, the server asks bot or human, bots get a 403, humans reach Salesforce.

Infographic

The same steps are written out below.

Step by step

What happens at each step.

  1. Send

    The visitor sends the form

    The enquiry, sign-up or chat message posts to a route on your Vercel site.

  2. Check

    The browser solves a hidden check

    BotID runs in the background. No puzzle, no extra click.

  3. Ask

    The server asks: bot or human?

    The route calls checkBotId(). Deep Analysis runs too, if you switched it on.

  4. Stop

    Bots get a 403

    Nothing reaches Salesforce, WhatsApp or the model.

  5. Lead

    Humans reach Salesforce

    The route creates the lead and the follow-up starts.

How it fits together

Where BotID sits on your lead form.

Visitors fill the form on your Vercel site. The form posts to a route on that site, which checks BotID, then creates the lead in Salesforce. The WhatsApp follow-up and the sales queue only ever see sends that passed. A form that posts straight from the browser to Salesforce skips the check, so we route it through the server.

Visitors fill a form on a Vercel site, BotID checks it on the server, then a lead is created in Salesforce with a WhatsApp follow-up.

Infographic

Where it sits next to the systems you run today.

Use cases · worked examples

One worked example in each industry.

How BotID fits into the work of the industries we serve, one step at a time.

  1. Fake enquiries on a launch form are stopped by BotID before Salesforce, so agents only call real buyers.

    Example 1 · Real estate, Dubai · Infographic

    Sales manager at a Dubai off-plan brokerage

    Today: Every launch, the enquiry form fills Salesforce with names like real buyers and numbers that ring nowhere. My agents waste the first hour of the day.

    After: The launch form posts to a route on the brokerage’s Vercel site. BotID checks each send, and only sends that pass become Salesforce leads with a WhatsApp follow-up.

    Worked example, step by step

    1. 20:00Marketing. Launch ads go live. The enquiry form starts filling.
    2. 20:05Website. Each send posts to the form route, which calls checkBotId().
    3. 20:05BotID. Fails a scripted send. The route returns 403 and no lead is made.
    4. 20:07Salesforce. A real buyer’s send passes and becomes a lead, assigned to an agent.
    5. 20:08WhatsApp. The buyer gets the brochure and a viewing slot to pick from.
    6. 09:00Agents. Start the day on a queue of people.

    The launch queue holds buyers, and the agents’ first calls reach someone.

    Real estate brokers
  2. Spam quote requests are stopped by BotID, real requests reach Salesforce, and the team replies on WhatsApp.

    Example 2 · PRO services, Abu Dhabi · Infographic

    Office manager at an Abu Dhabi PRO and typing services firm

    Today: Every morning there are dozens of quote requests for visas and trade licences. Half are spam, and we reply on WhatsApp to all of them before we know.

    After: BotID checks the quote form on the server. Only real requests reach Salesforce and the WhatsApp reply queue.

    Worked example, step by step

    1. 02:00Bot. Sends a burst of quote requests.
    2. 02:00BotID. Fails them on the server. Nothing reaches Salesforce.
    3. 07:40Customer. Asks for a quote on a family visa renewal.
    4. 07:40Salesforce. Creates the request and adds it to the morning queue.
    5. 08:30Office manager. Replies on WhatsApp with the documents list and the fee.

    The team starts the day on real work, and nobody messages a fake number.

    PRO and typing services
  3. Bots spamming a website chat raise the model bill until BotID on the chat route lets only people through.

    Example 3 · Digital agencies, New York · Infographic

    Technical director at a New York digital agency

    Today: We built an AI chat for a client’s website. Bots started talking to it at night, and the client’s model bill jumped.

    After: BotID protects the chat route. The server checks each message before it calls the model, so bots get a 403 and people get answers.

    Worked example, step by step

    1. Mon 09:00Client. Forwards a model bill twice the usual size.
    2. Mon 11:00Technical director. Finds overnight chat sessions with no human pattern.
    3. Mon 15:00Mindcat. Adds BotID to the chat route. Failed checks return 403 before the model is called.
    4. TueMindcat. Turns on Deep Analysis on the chat route only, where a missed bot costs the most.
    5. Next weekClient. Sees a bill that tracks real conversations.

    The model bill pays for people, and the client keeps the chat on the site.

    Digital agencies
Examples of the work, not client stories. Times in each example show the order of events, not a measured result.

Is it for you

When BotID fits, and when it doesn’t.

Good fit

Not for you yet

Fake leads land in Salesforce from your web forms
Your forms post straight from the browser to Salesforce and must stay that way
You want no CAPTCHA in front of buyers
The site is hosted somewhere other than Vercel
Your site, or the form, is served from Vercel
You expect no bot to ever get through
A chat or AI route costs money every time it answers
Fake leads come from people, not scripts

What Mindcat does

We build it, then we run it.

The assessment is free: a short read of the org and a written note. If you go ahead, the first build week is a fixed AED/SAR 14,900 (about USD 4,050), credited in full when you sign the build within 60 days. After go-live, we keep it patched, watched and changing every month.

Read next

What it works with.

FAQ

What teams ask about BotID.

Will buyers see a CAPTCHA?
No. Vercel describes BotID as an invisible CAPTCHA: the browser solves a hidden challenge and the visitor does nothing extra.
Our form posts straight to Salesforce Web-to-Lead. Does BotID still work?
Not on that path. BotID checks a request on your server, so a form that posts from the browser straight to Salesforce never meets the check. We point the form at a route on your Vercel site, which checks BotID and then creates the lead.
What does it cost?
Basic is free on all plans. Deep Analysis is on Pro and Enterprise. On Pro it is $1 per 1,000 Deep Analysis checks as of 16 October 2026, and page views that do not call the check are not charged. Enterprise pricing is custom.
Will it stop every fake lead?
No tool does. BotID returns a pass or fail on each send, and Deep Analysis reads more signals. Fake leads typed in by people still need a sales rule in Salesforce.
Does BotID store our visitors’ data?
Vercel says it checks the session without storing user behaviour or personal data. The lead itself still goes to Salesforce as before.

Sources

Where these facts come from.

Checked against Vercel’s own pages on 16 October 2026. Vercel changes fast, so we check again before any plan we write for you.

Vercel is a product of Vercel Inc. Mindcat builds and runs work on it for clients; we are not affiliated with or endorsed by Vercel.

Start here

Tell us what you want built, and where it runs today.

One or two lines is enough. You hear back within 24 hours from the person who signs the work.

Salesforce consulting partner since 2010 · MVP Hall of Fame · 200+ agents in production · UAE, India and US desks

Cookies

Analytics cookies are optional. Necessary ones always run.Analytics cookies help us see which pages are useful. Necessary cookies always run.