Fraud needs a faked location: an attacker can steal everything except where the real user is. Compliance needs a true one: sanctions, securities, and licensed markets all turn on where the user stands. Octet replaces guesswork with a hardware-signed predicate against the policy you set.
A sanctions screen runs on an IP address and a country code from a dropdown. A five-dollar VPN defeats it. Major IP geolocation databases disagree on the same address by an average of 620 kilometres. The largest sanctions fine in banking history was $8.9 billion (BNP Paribas, 2014). A recent one was $4.3 billion (Binance, 2023), and the CEO did prison time. OFAC violations are strict liability. Octet replaces the IP heuristic with a hardware-signed predicate over presence.
71M people in sanctioned jurisdictions live within 100 km of a non-sanctioned border, and IP lookups miss by several times that distance. Octet attests directly to the device's presence relative to the named polygon set.
SEC Regulation S requires a reasonable belief that the buyer is outside the US. IP geolocation does not meet that standard. Self-attestation does not either. KYC proves identity at signup, at real conversion cost, never that the buyer was outside the US at the moment of the trade.
Octet issues a hardware-signed proof before the session opens, covering Puerto Rico, Guam, American Samoa, the US Virgin Islands, and the Northern Mariana Islands. Verifiable offline. Retained for audit.
A single platform can serve only the jurisdictions where it holds authorisation, or where federal preemption has been judicially confirmed. The geofence updates without a client release as state injunctions issue or lift. The same primitive supports county-level and municipal carve-outs, and tribal land where gaming compacts apply.
Octet supports polygon definitions at any scale, from a single building to a campus to a stadium bowl. The same cryptographic guarantee as a national geofence. Operators publish their polygons; any compliant app honours them.
Account takeover, impersonation, synthetic identities: every fraud begins somewhere the real user is not. Generative AI has industrialised the attack; the defence is a fact that cannot be copied. The proof is passive, generated on the device with no extra screen or code, so security stops costing conversion.
Octet runs on the customer’s enrolled phone, alongside your existing auth: when the phone is present at the login, your app skips the push, the SMS code, the "was this you?" prompt.
Benjamin signs into his bank and the credentials check out. When those credentials are stolen and used from Myanmar, his phone is still in Chicago, with him: the login and the trusted device are not colocated, the proof fails, and the real Benjamin never sees a challenge.
A large wire moves on a few sign-offs, and a sign-off is often an email. Octet binds each approval to a signed proof that it came from an enrolled device of an authorized signer, standing in one of your offices. The BEC attacker in Romania fires the same request with compromised credentials and cannot produce that proof. For high-value transfers, require two signers, each proven present.
Invoices that carry a signed proof the sender's device is at the supplier's registered address get fast-tracked. An attacker in Vietnam compromises your supplier's email and sends a fake invoice. Their device cannot produce a proof for the supplier's address. Flagged before payment.
Every signup carries a signed proof: this is a real phone, and here is where it is. A fraud ring spins up 1,000 accounts. Emulators and data-centre bots fail the first check: no real hardware to sign with. A farm of real phones clears that, then fails the second: all 1,000 proofs place the devices at one place. No honest cohort signs up 1,000 times from a single spot. Flagged before the bonus pays out.
You hire a remote engineer. They pass the interviews, say they're in Austin, and you grant repository and wallet access. They are actually working from a sanctioned jurisdiction through a US-based laptop farm, a pattern the FBI has flagged across hundreds of firms. Octet binds a continuous, hardware-signed proof of where the device actually is, checked at onboarding and on every sensitive action. The proof fails, and access never opens.