Zenith AI is a hosted service from InfoDive Labs that screens every submission from your web forms. You point a form at its endpoint, and each submission passes eight anti-abuse layers, then a set of classifiers that assign a spam score from 0 to 100, a hot, warm or cold lead tier, sentiment, urgency, a category and topical tags, and draft a reply. Results appear in a dashboard and reach your backend as signed webhooks, so your team reads leads instead of junk.
Key takeaways
- Integration is one unauthenticated JSON POST from your form. No SDK.
- Abuse is filtered by eight deterministic layers that are on by default, before any model runs.
- Each surviving submission gets seven outputs: spam score, lead tier, sentiment, urgency, category, tags and a reply draft.
- The models decline when unsure: no reply draft for likely spam, no route when no category is confident.
- Verdicts reach your systems through HMAC-signed webhooks with retries.
Why we built it
Put a form on the public internet and it fills with bot posts, SEO pitches, disposable-address signups and duplicate junk. The genuine inquiries are in there too, but someone has to dig them out every morning, and a hot lead that waits behind a pile of spam goes cold. CAPTCHAs and honeypots stop some bots and annoy some humans. Neither tells you which of the real messages matters most.
We built Zenith AI to handle the whole path from submission to reply: block the abuse, score what is left, and hand the team a sorted queue with drafts ready.
How Zenith works
The design principle is cheap first, expensive last. Rate limits, blocklists and bot checks cost almost nothing and need no model, so they run first and reject a large share of junk before any classifier sees it. That keeps the model work for submissions where judgment actually adds signal, and it keeps rejections explainable: a request blocked by a rate limit can be explained exactly. Zenith lists an average AI verdict latency of 50 ms.
The eight anti-abuse layers
All eight are on by default with no configuration.
| Layer | What it does |
|---|---|
| Bot detection | Filters automated traffic at the edge with a challenge tier, including headless browsers and known bot user agents |
| Threat score | Rejects requests from sources with a poor threat score |
| IP rate limiting | 5 submissions per minute and 50 per hour per IP |
| Email rate limiting | 10 submissions per hour and 30 per day per email address |
| Disposable email blocking | Blocks addresses from more than 130 disposable email providers |
| Email and domain blocklists | Your own list of addresses and domains to refuse |
| IP blocklists | Your own list of IPs to refuse, or curated lists of known abuse networks |
| Duplicate content detection | Catches near-identical messages within a one-hour window |
What every submission gets
Submissions that pass the layers go to seven classifiers that run in parallel on a shared embedding, so total latency is bounded by the slowest classifier rather than the sum. Each one is independent, so one can be inspected, retrained or replaced without touching the others.
| Output | Values | Used for |
|---|---|---|
| Spam score | 0 to 100, combining content, sender reputation and behavior signals | Approve, flag or reject |
| Lead tier | Hot, warm, cold, from intent signals such as pricing questions, decision-maker language and urgency | Who gets called first |
| Sentiment | Positive, neutral, negative | Spotting an unhappy customer before replying |
| Urgency | High, medium, low | Ordering the queue |
| Category | Sales, support, partnership, careers, abuse | Routing to the right team |
| Auto-tags | Topical labels such as pricing, enterprise or support | Filtering and reporting |
| Smart reply | A one-paragraph draft in your tone, sent with one click | Faster first responses |
Each submission then lands in a status: pending, approved, flagged or rejected. Zenith publishes a 99% spam-detection accuracy figure. The honest test of any spam filter is your own traffic: run it on your real forms for a week and compare its flags with your own judgment.
When it declines to guess
A model that always has an answer is a liability. Zenith's classifiers have explicit refusal rules:
- The reply model does not draft anything when the spam score is above 40. The dashboard shows that no reply was drafted because spam is suspected, and you can force a draft if you disagree.
- The tag generator adds no tag when its confidence is below 0.6.
- The category router leaves a submission unrouted when no category scores above 0.5, so a person decides.
Replies are drafts, not auto-responses. A person reviews and sends them. The same principle, letting the system decline rather than guess, runs through our guide to AI customer support that resolves issues.
Integrating Zenith
Send a submission
The submission endpoint needs no SDK and no authentication:
curl -X POST https://zenith.infodivelabs.com/crm/submissions/v1 \
-H "Content-Type: application/json" \
-d '{
"tenantId": "YOUR_TENANT_ID",
"email": "alex@example.com",
"name": "Alex Chen",
"formType": "contact",
"message": "Pricing for 250 seats?"
}'It returns 201 Created with the new submission's ID and queues the analysis. The tenantId can be omitted when the form posts from a verified custom domain. The management API (listing, exporting, deleting) is a versioned REST API under /v1 with JWT and refresh tokens, and its OpenAPI spec imports into Postman or Insomnia.
Receive the verdict by webhook
When a submission reaches a status, Zenith posts a signed webhook to the URL you configure. Events include submission.created, submission.approved, submission.flagged, submission.rejected and submission.deleted. Each request carries X-Webhook-Event, X-Webhook-Timestamp and X-Webhook-Signature, where the signature is sha256= followed by the hex HMAC-SHA256 of the request body, keyed with your signing secret.
Failed deliveries are retried with exponential backoff, and each webhook has its own retry count setting. The dashboard keeps a delivery log for tracing failed deliveries.
Verify every webhook before trusting it:
import hashlib
import hmac
import json
from datetime import datetime, timedelta, timezone
MAX_AGE = timedelta(minutes=5)
def verify_zenith_webhook(raw_body: bytes, signature_header: str, secret: str) -> dict:
"""Pass the raw request bytes, not re-serialized JSON: the HMAC covers exact bytes."""
expected = "sha256=" + hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
if not hmac.compare_digest(expected, signature_header or ""):
raise PermissionError("invalid webhook signature")
event = json.loads(raw_body)
sent_at = datetime.fromisoformat(event["timestamp"].replace("Z", "+00:00"))
if datetime.now(timezone.utc) - sent_at > MAX_AGE:
raise PermissionError("stale webhook, possible replay")
return eventTwo details matter. Verify against the raw body bytes, because a framework that parses and re-serializes JSON changes the bytes and breaks the signature. And because retries mean a delivery can arrive more than once, store the pair of event and data.submissionId and skip pairs you have already processed. Our API security guide covers signed webhooks and replay protection in more depth.
The rest of the platform
- Analytics: a real-time dashboard, time series by hour, day, week and month, geographic breakdowns by country, city, continent and timezone, device analytics, and email domain tracking.
- Your brand: custom domains with automatic SSL, custom SMTP so notifications come from your own servers, and email templates with variables.
- Teams: role-based access control, so sales and developers see what they need.
- Exports: CSV, Excel with formatting, and PDF reports, from the dashboard or the API with filters by date range, status, type and custom fields.
- Account security: TOTP two-factor authentication, an audit log that records IP and user agent for every action, session management with remote revocation, and HTTPS everywhere.
Data handling
- Tenant isolation: each account's data is kept separate from every other account's.
- Retention: submissions are stored for 90 days by default, configurable per form to 7, 30, 90 or 365 days, or kept indefinitely.
- Regions: hosted across US-East, EU-West and AP-South, with single-region pinning available on enterprise contracts.
- Paperwork: Enterprise contracts include a custom data processing agreement.
Who it is for
- B2B teams whose lead forms are buried in spam and whose best leads need a reply the same hour.
- Support teams that triage inbound requests and want urgency and sentiment visible before they open a message.
- Marketing teams that want clean conversion data without manual filtering.
- Developers who want one POST and one webhook instead of building rate limits, blocklists, deduplication and classifiers themselves.
It is not a CRM, and it is not an email spam filter. It screens submissions that are posted to it and hands the results to your CRM, help desk or backend through webhooks and the API.
What is next
Zenith keeps a public roadmap and is explicit that dates are intent, not contracts. Slack and Discord integrations with lead-tier filtering are in live beta. Planned next are workflow automations with a rule builder and conditional logic, and multi-language support with automatic translation. Custom dashboards and native iOS and Android apps are being explored.
How to try it
Zenith has a free Hobby plan for small sites that includes all eight security layers and AI scoring and tiering. Paid plans add features such as smart-reply drafts and custom domains, and they come with a 14-day trial that needs no card up front. Sign up at zenith.infodivelabs.com, point one real form at the endpoint, and look at a week of your own traffic sorted into approved, flagged and rejected.
Frequently Asked Questions
What is Zenith AI?
Zenith AI is a hosted submission intelligence service built by InfoDive Labs. Your web forms send submissions to Zenith, which blocks abuse, scores each submission for spam, classifies lead tier, sentiment, urgency and category, and drafts a reply. Results show up in a dashboard and arrive at your backend as signed webhooks.
How does Zenith AI detect form spam?
Every submission first passes eight deterministic layers: bot detection, threat scoring, IP and email rate limits, disposable email blocking, email, domain and IP blocklists, and duplicate content detection. What survives is scored by a set of classifiers that combine content, sender reputation and behavior signals into a spam score from 0 to 100. The cheap checks run first so the models only see traffic that needs judgment.
Do I need an SDK or API key to send submissions to Zenith?
No. The submission endpoint accepts a plain JSON POST without authentication, so a form or a single fetch call is enough. Authentication with JWT and refresh tokens applies to the management API, which lists, exports and deletes submissions.
How do I verify Zenith webhooks?
Each webhook carries an X-Webhook-Signature header containing an HMAC-SHA256 of the request body, keyed with your signing secret. Compute the same HMAC over the raw body bytes, compare in constant time, and reject old timestamps. Deliveries can repeat, so make your handler idempotent on the event and submission ID.
Is there a free plan for Zenith AI?
Yes. There is a free Hobby plan for small sites that includes all eight security layers and AI scoring, and paid plans come with a 14-day trial that needs no card up front. Current plans and limits are on the Zenith pricing page.
Need help with your inbound pipeline?
Zenith is one of the products we build and run ourselves, on the same principles we apply to everything we ship: cheap checks first, models where they add signal, and refusals instead of guesses. If you need form intake, lead routing or AI triage wired into your own stack, talk to the engineers who build it.