Rules that apply in one place and not the next: sanctions, national bans, state licenses and tribal lands.
Fraud that starts somewhere the real user is not: account takeover, payments, invoices and fake hires.
Where a model can be used, what it will do there, where its data opens, and who approves what an agent does.
Major IP geolocation databases disagree on the same address by an average of 620 kilometers. The largest sanctions fine in banking history was $8.9 billion (BNP Paribas, 2014). A recent one was $4.3 billion (Binance, 2023), and the CEO did prison time. Octet replaces the IP lookup with a yes or no about the device’s location, signed in its hardware, even when the VPN is on.
71M people in sanctioned jurisdictions live within 100 km of a non-sanctioned border, and IP lookups miss by several times that distance. Instead of looking the location up, the phone builds it up from its own sensors, checks it against the sanctioned regions in your policy, and signs the answer in its hardware.
SEC Regulation S requires a reasonable belief that the buyer is outside the US. IP geolocation does not meet that standard. Self-attestation does not either. KYC proves identity at signup, at real conversion cost, never that the buyer was outside the US at the moment of the trade.
Octet issues a hardware-signed proof before the session opens, covering Puerto Rico, Guam, American Samoa, the US Virgin Islands, and the Northern Mariana Islands.
A single platform can serve only the jurisdictions where it holds authorization, or where federal preemption has been judicially confirmed. The geofence updates without a client release as state injunctions issue or lift. The same primitive supports county-level and municipal carve-outs, and tribal land where gaming compacts apply.
Gaming on Native American land runs under tribal compacts, and those compacts end at the reservation boundary. A wager placed on tribal land falls under the compact. One placed a mile outside falls under the state, which may not allow it at all. IP geolocation cannot tell the two apart.
Octet supports polygons at any scale, from a single casino floor to a reservation’s full boundary, with the same cryptographic guarantee as a national geofence. Each wager carries a signed answer for which side of the line the phone was on.
Account takeover, impersonation, synthetic identities: every fraud begins somewhere the real user is not. Generative AI has industrialized the attack; the defense is proving whether the device is where it’s supposed to be.
Octet runs on the customer’s enrolled phone alongside your existing login. When the phone is at the login, your app skips the push, the SMS code and the “was this you?” prompt. When stolen credentials are used from another country, the phone is still with its owner, the proof fails, and the real customer never sees a challenge.
A large wire moves on a few sign-offs, and a sign-off is often an email. Octet binds each approval to a signed proof that it came from an enrolled device of an authorized signer, standing in one of your offices.
Invoices that carry a signed proof the sender’s device is at the supplier’s registered address get fast-tracked. An attacker in Vietnam compromises your supplier’s email and sends a fake invoice. Their device cannot produce a proof for the supplier’s address. Flagged before payment.
You hire a remote engineer. They pass the interviews, say they’re in Austin, and you grant repository and wallet access. From that moment on, “Austin” is a claim nobody ever checks again.
Octet makes it a measurement: taken on the device, signed in hardware the user can’t reach, at onboarding and on every sensitive action. An engineer who is actually in Moscow, Tehran or Pyongyang cannot produce one.
A determined adversary can still ship a laptop to a US address and pay someone to host it. That is the part the FBI prosecutes, and it is a considerably harder business than a VPN subscription.
In every one of these, the attacker is somewhere the real user is not.
Labs limit where their models can be used and what they will do there, and agents now act on real systems. Each of these still trusts an IP address, an account or a token.
Labs decide where their models can be used. Anthropic does not serve China, and since September 2025 it also refuses companies controlled from there, wherever they operate. The check is still mostly an IP address.
In February 2026 Anthropic reported that DeepSeek, Moonshot and MiniMax ran more than 16 million exchanges with Claude through about 24,000 fraudulent accounts, reaching it from China through commercial proxy services.
Octet ties each account, and each API key it issues, to a signed proof from a real device outside the restricted regions, at sign-up and again at intervals. A proxy changes the IP address but not where the phone is.
Labs already ship models that do more for the right people in the right setting. Anthropic’s Claude Gov models refuse less when handling classified material, and access is limited to people who work in classified environments. OpenAI’s reasoning models run on Los Alamos’ Venado supercomputer on a classified network. In April 2026 OpenAI released GPT-5.4-Cyber, which lowers the refusal boundary for verified defenders.
Today the gate is the account, or the network the model runs on. With Octet, a model unlocks a capability, such as binary reverse engineering or work on controlled defense material, only with a signed proof that the device belongs to cleared staff and is inside an accredited facility. Anywhere else, it behaves like the public model.
Some data should only be read from one place: model weights, evaluation sets, health records, export-controlled files. The rule is usually enforced with credentials and an office IP range, and both work from anywhere once they are stolen.
In July 2026 Hugging Face reported that an autonomous agent got into its internal clusters through a malicious dataset, collected service credentials and reached a limited set of internal datasets. Regulation is moving the same way: the US Data Security Program restricts access to bulk sensitive data from countries of concern, not only transfers.
With Octet, the data store releases a key only with a fresh signed proof that the requesting device is inside the approved site. Credentials used from a server somewhere else cannot produce one.
Agents now act on real systems with real keys. In June 2026 an OpenAI agent running an internal evaluation got around the access blocks on an old Services Australia website and reached non-public Medicare statistics. OpenAI said its models took actions it did not intend.
Octet puts a person at the point of decision. Before an agent deletes, pays, deploys or opens something sensitive, it asks for approval, and the approval counts only with a signed proof from a real phone, held by a human, inside an authorized place. A token copied by an agent cannot produce that proof.
If you have a use case you don’t see here, tell us where location determines an action in your product. We’ll tell you if Octet can be valuable.