Account and IP bans don't scale — the cheater is back in minutes on a new account, same PC. Recid weighs a server-side hardware fingerprint, catches VMs, and gives you one API call to keep banned devices out.
New account, same hardware, five minutes later. Account bans have no cost of re-entry — so they don't stick.
A VPN costs nothing and changes in one click. IP bans punish shared connections and miss the actual abuser.
A small team can't run an anti-cheat department to fix this. You need a signal tied to the device — one that's easy to drop in.
Your game, launcher, or app collects hardware identifiers through the SDK — hashed on the way out.
One request: POST /v1/check. The signals are weighed on our server, never trusted from the client.
ALLOW, BAN, or REVIEW. Banned once, the device stays out of every new account.
Clean device. Let it through. No friction for the players who did nothing wrong.
Matches your banlist. Blocked — and a ban keeps precedence even when the device is running inside a VM.
Enough signal to flag, not enough to block outright. The call stays yours, with the evidence attached.
Honest about what it is: a weighted, server-side signal — not a magic box. That's exactly why it holds.
The verdict is computed on your server — the client never votes on its own trust. Claiming "I'm native" or "I have a TPM" earns nothing; only cryptographic proof gets precedence, and a guess always cedes to real evidence. Patching the game changes nothing.
No single signal decides. Someone who swapped a hard drive isn't banned by accident — a threshold of real hardware evidence is.
Spinning up a virtual machine to reset hardware trips detection — a disposable device shouldn't count as a fresh, legitimate one.
Run it observe-only first. Automatic verdicts (VM/origin/bot DENY) land in your logs instead of enforcing — an explicit BAN from your banlist still blocks, same as in enforce.
Our decision paths are attacked by an independent, different-model reviewer that tries to break them — and what it finds, we close. A guess and a proof are never treated the same, and we tell you which is which.
The moat isn't the algorithm — it's that you're live this afternoon instead of building a fingerprint stack from scratch.
Drop in the SDK for your stack. Or put the gateway in front of your app as a reverse proxy and write no code at all.
Only hashes reach the server — never the raw identifier. Retention is configurable per tenant, and nothing unnecessary is stored. You decide what your client collects; we weigh what you send.
The composite needs several signals to reach a ban, so a player who changed one part won't trip it. REVIEW gives you a middle ground, and monitor mode lets you watch every verdict before you enforce anything.
You can. Then you maintain the fingerprint weighting, the infrastructure, seven SDKs, and a banlist panel — instead of shipping your game. Recid is that whole stack, ready to call.
No — by design. This is not a runtime anti-cheat living inside your app: there's no resident process, no hooks, no kernel driver, no continuous scanning. The collector runs once at login — reads a handful of identifiers, hashes them locally, sends a few KB — and the heavy lifting (weighing, banlist, analysis) happens on our server, not on your player's machine. You set the API timeout, and fail-open is the default: if we're ever unreachable, your players still get in. The platform grows server-side; the client footprint stays one call.
I’m taking on the first 10 servers to run this together — the whole deal, no fine print:
That’s it. No card, no contract, no catch. “First 10” is real — it’s all I can integrate properly on my own.
Early access — the first studios help shape the plans. Rough shape below; talk to us and we'll fit it to your volume.
Create an app, generate a key, run your first check in five minutes. Monitor mode holds automatic verdicts to your logs, so you can see it work before you enforce.