Beyond WAF and CAPTCHA

Know every device.
Trust every session.

Score every device, network, and behavior in real time. Block emulators, repackaged apps, SIM-swap attacks, and bot swarms — without making real users wait.

See it work → Explore signals
< 200ms
Verdict speed
40+
Signal layers covered
73%
Avg fraud reduction
0
Permissions required
Live device verdict · sample sessions Realtime scoring
Session d4f1·a82c +91 98••• 43210 · just now
Verdict
allow
8
/ 100 risk
▾ low
Signals · top 5
Allow · trusted device, frictionless login
Plug into your stack

A returning user, recognized in milliseconds.

Same device fingerprint as the user's last 47 sessions. Network, IP, and behavioral signals all consistent. Smart Auth waves them through SNA without a code.

POST /v1/verdict 200 OK
{
"verdict": "allow",
"risk_score": 8,
"action": "continue",
"reasons": ["trusted_device", "consistent_ip"],
"device_id": "dev_2hjkLm8aQ",
"latency_ms": 142
}
The signal stack

Hardened against the most sophisticated attackers.

Deterministic device signals fused with supervised ML. Immutable, resistant to evasion and reverse engineering, and privacy-preserving by design. Pre-trained on 400 million+ devices.

Device fingerprint

Hardware, OS build, screen, GPU, audio stack, font set, locale — fused into a stable ID that survives app reinstalls. Flags the exact moment a device was wiped to factory settings.

persistentfactory-reset

Emulator, root & jailbreak

Catches Android emulators, jailbroken iOS, Magisk, Frida, Xposed, and runtime hooking. Signals include kernel artifacts, build-prop tampering, and sensor stubbing.

kernelmagiskfrida

VPN, proxy & geo-spoof

Identifies commercial VPNs, datacenter ASNs, residential proxies, Tor exit nodes, and GPS spoofing on mobile. Cross-checks ASN, RTT, ISP, and known anonymizer ranges.

asntorgps-spoof

Velocity & multi-account

One device, many accounts. We surface devices linked to too many phone numbers, emails, or sign-ups in suspicious time windows.

graphlinkage

SIM swap & SIM age

Telecom-level checks on whether the SIM was recently swapped, ported, or activated - a leading indicator of account takeover attacks.

operatortakeover

IP reputation & geo

200M+ IP signals - abuse history, geolocation, mobile vs fixed-line, ASN ownership, and impossible-travel detection across sessions.

geoipimpossible-travel

Behavioral biometrics

Typing cadence, touch pressure, scroll velocity, and gyroscope motion all flow into a behavioral profile that bots cannot easily reproduce.

cadencegyropassive

App tampering & integrity

Detects repackaged APKs, cloned apps, modified binaries, debugger attachment, intercepted or tampered requests, and Play Integrity / DeviceCheck failures.

cloned-appmitmintegrity
From signals to decisions
SESSION 7af3·2c9b EVALUATING
INCOMING SIGNALS
FINAL SCORE -
RISK
70
25
0
100 0

A recommended action for every visitor.

Allow, step up, or block — every verdict carries the reason codes that drove it. Tune thresholds in a visual rule editor. No ML team needed.

risk < 25 → Allow
risk 25-70 → Step up
risk > 70 → Block
What you can stop

Stop bot swarms. Keep real users moving.

01 / Signup fraud

One person, a hundred accounts.

Catch promo abusers and multi-accounters at the front door. Device graphs link sign-ups by hardware fingerprint even when phone numbers, emails, and IPs all rotate.
device.fpvelocitysim.ageintegrity
02 / Account takeover

Logins from unfamiliar devices.

A login from a fresh device, a recently-swapped SIM, or an impossible-travel IP triggers a step-up - even if the credential or OTP is technically valid.
device.newsim.swapgeo.impossiblebehavior
03 / Promo abuse

Refer-and-earn, abused at scale.

Referral rings show up as device clusters with shared fingerprints, datacenter IPs, and emulator signals. Block them before the credit hits the ledger.
device.clusteremulatorvpngraph
04 / Bots & automation

Scripted access, blocked at the door.

Scripted login attempts and credential-stuffing leave a behavioral signature - typing cadence, touch absence, sensor stubs - that real humans don't.
behaviorintegrityheadlessip.rep
Common questions

Common questions.

Does this require any extra permissions on the device?
No. Device Intelligence runs entirely from passive signals available to any SDK - no location, contacts, SMS, or sensor permissions are requested. The signals come from the OS surfaces and network behavior the app already has access to.
How is this different from a CAPTCHA or bot-detection vendor?
CAPTCHAs add friction every time. Device Intelligence runs silently and only intervenes for the small percentage of sessions that look risky - and even then, the intervention can be a step-up auth instead of a block. We replace blanket friction with selective friction.
Can we tune the rules ourselves, or is it a black box?
Both. The base risk model is pre-trained for Indian markets, but every threshold, signal weight, and action is exposed in a visual rule editor. Risk teams write declarative rules ("if emulator OR risk > 70 then block"); the model handles the heavy lifting underneath.
Do you support both web and mobile?
Yes - native SDKs for iOS and Android, plus a JavaScript SDK for web. The signal set is largest on mobile (where SIM, sensor, and integrity data are available), but the web SDK still emits 25+ signals including canvas/WebGL fingerprints and behavioral biometrics.
How does the device fingerprint survive reinstall?
We don't rely on a single ID. The fingerprint combines durable hardware traits (SoC, sensor calibration noise, GPU draw entropy) with stable OS surfaces. The composite ID matches the same device across reinstalls, IDFA resets, and even some factory resets.
Where does my data go? Is it RBI-compliant?
All processing happens in OTPless's India region - verdicts, signals, and graphs never leave the country. The platform is RBI-aligned, ISO 27001 certified, and SOC 2 Type II audited. We retain only what's needed to power the graph and emit verdicts; raw signals expire on a configurable window.
Can device intelligence run without Smart Auth?
Yes. Use it as a standalone risk API on any flow - login, payment, withdrawal, KYC. Or use Smart Auth alone. They compose: Smart Auth uses device intelligence verdicts to decide whether to attempt SNA silently or fall back to a higher-friction channel.
What's the false-positive rate?
Tunable. With default thresholds tuned for Indian fintech, we typically see <0.4% legitimate users sent to step-up and <0.05% incorrectly blocked. You can move the dials to favor either side based on your risk appetite - and every block carries reason codes you can review.

Invisible to real users. Lethal to attackers.

Talk to our team →