Make location a factor in a login or an approval, the way two-factor authentication uses a code. Octet proves where a device is, signed by the hardware inside it. Your app asks a yes or no question about a place, the phone answers, and your server checks the answer offline with an open-source verifier.
The SDK builds up a location on the device from what the phone itself can sense: satellite signals, the cell network around it, its own motion and signals most systems ignore. It never takes an IP address or a mocked GPS reading at its word, so a VPN changes nothing. Then it answers the one question your policy asks. Is this device inside the place? Yes, no or indeterminate.
The answer is signed by a key in the phone’s secure hardware, the Secure Enclave on iPhone and its equivalent on Android. The key never leaves the chip, so the proof can’t be made anywhere else. Each proof can be used only once, so it cannot be replayed.
Your server checks the proof with octet-verify, our open-source verifier. There is no call to Octet. Even a fully compromised backend can’t forge a proof the verifier will accept.
| GeoComply (and other legacy vendors) | IP geofencing | ||
|---|---|---|---|
| Where the proof is built | On the phone, at the moment of the check, from satellites, the cell network, motion sensors and other on-device signals | GPS, Wi-Fi, cellular and IP data collected on the device and analyzed by GeoComply’s servers | The IP address, looked up in a commercial database |
| VPNs and proxies | Users can leave the VPN on. The verdict does not depend on the IP address | Detected and blocked. Users have to turn the VPN off to continue | Defeated |
| What you get back | A yes or no, signed by the phone’s secure hardware | A location and a trust score from GeoComply | A best guess at a city or country if not compromised |
| Checking it afterwards | Anyone, at any later date, with open-source octet-verify. It shows whether the proof was changed after it was signed | GeoComply does not publish a way for a third party to check a decision independently | No way to check after the fact |
| What leaves the device | The answer. No coordinates | Location and device data | The IP address |
| Accuracy | Answers for the polygon you define, from a country down to a building | Down to a few feet, by GeoComply’s own account | Major databases disagree on the same address by 620 km on average |
| Pricing | Usage-based. Published at octetproof.com/pricing | Sales contract. Pricing is not published | A database subscription or per-lookup API fees |
| Friction for users | None for country checks in the browser: no permission, no prompt. In an app, country and state checks with no permission are available by request. The public SDK asks for location permission once | Location services on, VPN off, and a plugin download on desktop | None, and it stops nothing |
| Dependence on a live service | None. Proofs verify offline, with no call to Octet | Every check runs through GeoComply’s servers | Every lookup needs the database vendor’s API or a downloaded copy |
GeoComply and IP geofencing are described from publicly available information. Trademarks belong to their owners.
Use it on your website, embed it in your app, or connect it to your existing sign-in.
Three steps from here to a first verdict in your app.
Install the SDK with Swift Package Manager or Maven and get a first verdict with the iOS or Android quickstart.
Mobile SDK docs →Create an Octet account and add your app. No key ships in your app: the SDK licenses itself by attesting your app the first time it starts.
Create an account →Use of the SDK is governed by the Octet SDK License Agreement. Pricing is published and usage-based.
SDK License Agreement →On a website, use Octet Browser: sign up at browser.octetproof.com, under the Octet Browser SDK License Agreement. At sign-in, use LFA.