# Product - Octet

Source: https://octetproof.com/product/

> Make location a factor in a login or an approval. The phone proves where it is, signed in hardware, and your server checks the proof offline.

For the whole site in one file, read https://octetproof.com/llms.txt

# Use location as a factor.

Make location a factor in a login or an approval, the way two-factor authentication uses a code. Octet proves where a device is, signed by the hardware inside it. Your app asks a yes or no question about a place, the phone answers, and your server checks the answer offline with an open-source verifier.

## Cryptographically prove where a device is.

1

### The phone builds its own location.

The SDK builds up a location on the device from what the phone itself can sense: satellite signals, the cell network around it, its own motion and signals most systems ignore. It never takes an IP address or a mocked GPS reading at its word, so a VPN changes nothing. Then it answers the one question your policy asks. Is this device inside the place? Yes, no or indeterminate.

Satellites Cell network Motion IP address Mock GPS

2

### The chip signs the answer.

The answer is signed by a key in the phone's secure hardware, the Secure Enclave on iPhone and its equivalent on Android. The key never leaves the chip, so the proof can't be made anywhere else. Each proof can be used only once, so it cannot be replayed.

3

### You verify it offline.

Your server checks the proof with octet-verify, our open-source verifier. There is no call to Octet. Even a fully compromised backend can't forge a proof the verifier will accept.

## What your users see:

## nothing.

## It just *happens*.

### Their VPN stays on. Your country rules still apply.

What your users see SDK

## Prove where your users are.

## How Octet compares with GeoComply and IP geofencing.

| | | GeoComply (and other legacy vendors) | IP geofencing |
|---|---|---|---|
| Where the proof is built | On the phone, at the moment of the check, from satellites, the cell network, motion sensors and other on-device signals | GPS, Wi-Fi, cellular and IP data collected on the device and analyzed by GeoComply's servers | The IP address, looked up in a commercial database |
| VPNs and proxies | **Users can leave the VPN on.** The verdict does not depend on the IP address | **Detected and blocked.** Users have to turn the VPN off to continue | **Defeated** |
| What you get back | A yes or no, signed by the phone's secure hardware | A location and a trust score from GeoComply | A best guess at a city or country if not compromised |
| Checking it afterwards | **Anyone, at any later date,** with open-source octet-verify. It shows whether the proof was changed after it was signed | GeoComply does not publish a way for a third party to check a decision independently | No way to check after the fact |
| What leaves the device | The answer. No coordinates | Location and device data | The IP address |
| Accuracy | Answers for the polygon you define, from a country down to a building | Down to a few feet, by GeoComply's own account | Major databases disagree on the same address by 620 km on average |
| Pricing | **Usage-based.** Published at [octetproof.com/pricing](https://octetproof.com/pricing/) | Sales contract. Pricing is not published | A database subscription or per-lookup API fees |
| Friction for users | **None** for country checks in the browser: no permission, no prompt. In an app, country and state checks with no permission are available by request. The public SDK asks for location permission once | Location services on, VPN off, and a plugin download on desktop | None, and it stops nothing |
| Dependence on a live service | **None.** Proofs verify offline, with no call to Octet | Every check runs through GeoComply's servers | Every lookup needs the database vendor's API or a downloaded copy |

GeoComply and IP geofencing are described from publicly available information. Trademarks belong to their owners.

## Octet works with what you have.

Use it on your website, embed it in your app, or connect it to your existing sign-in.

Where do your users meet you?

What resolution do you want?

What do you need back?

We recommend

[Read the docs ->](https://octetproof.com/docs/)

## Start with the docs.

Three steps from here to a first verdict in your app.

1. 1

### Read the docs

Install the SDK with Swift Package Manager or Maven and get a first verdict with the iOS or Android quickstart.

[Mobile SDK docs ->](https://octetproof.com/docs/)
2. 2

### Register your app

Create an Octet account and add your app. No key ships in your app: the SDK licenses itself by attesting your app the first time it starts.

[Create an account ->](https://sdk.octetproof.com/signup)
3. 3

### Read the license

Use of the SDK is governed by the Octet SDK License Agreement. Pricing is published and usage-based.

[SDK License Agreement ->](https://octetproof.com/terms/mobile/)

On a website, use [Octet Browser](https://octetproof.com/docs/browser/): sign up at [browser.octetproof.com](https://browser.octetproof.com/signup), under the [Octet Browser SDK License Agreement](https://octetproof.com/terms/browser/). At sign-in, use [LFA](https://octetproof.com/docs/lfa/).

[iOS SDK ^](https://github.com/octetproof/octet-sdk-ios) [Android SDK ^](https://github.com/octetproof/octet-sdk-android) [octet-verify ^](https://github.com/octetproof/octet-verify)

## More detail (from llms.txt)

# Spec
Octet is proof of location. The existing stack verifies what you know or
what you have, not presence. A location claim from the OS, GPS chip, browser
API, or mock-location app is trivial to forge, and useful only when a third
party can verify it without trusting the claimant. Every YES or NO carries a
proof you can verify offline, hand to an auditor, or store as a signed record;
a YES without a proof is just an opinion, and the SDK never produces one.

Trust model: root of trust is a hardware key in the secure element (Secure
Enclave on iOS, TEE on Android), never leaving the chip. Location is learned
on-device; raw signals and coordinates never leave it. Output is a signed proof
(verdict + attestation chain binding it to a genuine device
and OctetSDK binary), verified offline. Excluded: browser fingerprinting, IP
geolocation in the trust model, raw data off-device, any callback at verify time.

  read: https://octetproof.com/docs/mobile/concepts/proof-of-location/