Stop the takeover, not the customer.
Passwords leak. Pro scores every login with the context a password check can't see – the device, the account's history, the network, the physics – and answers in milliseconds. Attackers hit a wall; the real owner never notices anything happened.
EU-hosted. Verdicts in milliseconds.
Two sessions, one set of credentials, nine minutes apart. Physics votes no.
Already in production
Publishing platforms, fintech and national charities across Europe already run TrustSig on their forms.
PublitPrint-on-demand and digital book distribution for publishers.Publishing · Sweden
LEI SystemOfficial Legal Entity Identifier registration agent.Fintech · Estonia
Disability Sport WalesNational charity for inclusive and disability sport.Charity · Wales
Same password. Same trip. Two different stories.
Every login assembles its evidence in the open: each signal carries a weight, dampeners pull risk back down, and the verdict ships with the full reason list. This is why a stolen password fails while the real owner on holiday sails through.
Thresholds are knobs, not constants.
Drag the block threshold, widen the review band, override any weight, then replay your own history to see exactly what would have changed.
The takeover playbook, named.
Each pattern is a reason code in the response, with a default weight and severity you override per project. These are the headline plays, scored alongside many quieter signals. Not a vibe, not an opaque score.
Not one loud IP. A thousand quiet ones.
A single noisy address is the easy case, and a rate limiter has handled it for thirty years. Real credential stuffing spreads across hundreds of IPs and paces itself over days, so every individual request looks clean. Pro links the attempts behind it, by device fingerprint, network reputation and the shared memory of who has been knocking, and sees the one campaign no per-IP limit can.
Stop the next takeover before it lands.
Book a demoThe wall is invisible to the one person who belongs.
Every signal Pro scores does double duty: it stops the stranger and clears the owner. The takeover hits a wall it can't see around; the real customer signs in and notices nothing, no CAPTCHA, no challenge, no friction. That asymmetry is the whole product.
Review means MFA, not “no”.
Most ambiguous logins are real customers in unusual circumstances. Pro routes them to a step-up you control instead of a denial – false declines die, attackers still can't pass your second factor.
The review band is opt-in and fully tunable – and a Review never overrides a real Block.
See impossible-travel scoring on your own logins.
Book a demoOne event in the login path.
Drop the TrustSig web SDK in once to capture the device signal, then send the login event from your backend. The verdict, risk and reasons come back in the same response, fast enough to sit inline before you mint the session.
const verdict = await pro.events.send({ kind: "login", user_id: user.id, ip: req.ip, user_agent: req.headers["user-agent"], device_token: req.body.trustsig_token,});
if (verdict.decision === "BLOCK") return deny(res);if (verdict.decision === "REVIEW") return requireMfa(res);return createSession(user);{ "decision": "REVIEW", "risk": 64, "reasons": [ { "code": "NEW_DEVICE", "weight": 25 }, { "code": "NEW_COUNTRY", "weight": 20 }, { "code": "TOD_SHIFT", "weight": 19 } ]}One signal layer. Every abuse pattern.
Each detection engine reads the same account, device and network memory – turn on one, the rest are a toggle away.
Account takeover, answered
Every login is scored against its context. Signals like impossible travel between sessions, a never-before-seen device for that account, a new country or network, credential-stuffing fan-out where one device or IP hits many accounts, password-reset-then-new-device sequences and dormant-account reactivation each feed the score, and they are a fraction of what the model weighs. The verdict arrives synchronously, in milliseconds, at the moment of login.
Trust signals pull the score down: a known device, a recent successful MFA, and a long history of clean behaviour all dampen risk. The same signal that blocks a stranger on a new device resolves to a step-up — or a clean allow — for the genuine owner. Genuinely dangerous hard signals still always block; trust never shields a real attack.
You decide: trigger MFA, send a magic link, or queue the session for review. Pro returns the verdict and the reasons; your stack applies the friction. Real customers get one extra tap instead of a support ticket.
No. You send one server-side event when a login happens — user ID plus the request context you already have. The verdict, risk score and reasons come back in the same response. There is no client-side SDK rewrite and no redirect flow.
Yes. Fan-out detection watches one device, IP or subnet touching many accounts in patterns no human produces, and a memory window you set, up to 90 days, catches the slow variant that per-minute rate limits never see.
Stop account takeovers before they land.
Tell us what you are trying to protect and why now. We will reply by email to set up access for your team.
- EU-hosted, GDPR-native
- No CAPTCHAs, no friction for your users
- Verdicts in milliseconds