EN · PT-BR ↗
HWID-Guard

Ban the device,
not the account.

Device reputation as a service. One API call at your login keeps hardware you already banned on the outside — new account, new IP, new email, doesn't matter.

Product deck · 2026

01
The problem

You ban. They're back in five minutes.

The cheater loses an account and makes another one — same chair, same PC. Banning costs you the investigation, the moderation time, the judgment call. Coming back costs them nothing. Any control where the defender pays more than the attacker loses that fight over time.

✕ Account bans

A disposable email and thirty seconds at your signup form. You banned a row in a table, not a person.

✕ IP bans

A VPN is free and changes in one click. It still punishes shared connections — and misses the actual abuser.

02
The solution

What's actually scarce is the machine.

Accounts are infinite, IPs are rentable. The physical hardware in front of the abuser isn't: buying another one costs real money. It's the first barrier whose cost of re-entry isn't zero — and that's what makes a ban stick.

ALLOW

Clean device. Let it through — no friction for the players who did nothing wrong.

BAN

Matches your banlist. Blocked — and the ban holds even inside a virtual machine.

REVIEW

Enough signal to flag, not enough to block outright. The call stays yours.

03
How it works

Four steps between a login and a verdict.

The SDK never blocks on its own — it collects and reports. Your server is the door, holding the verdict. That's deliberate: a patched client can't skip a check that lives where the attacker can't reach.

01 · CLIENT

Collect & hash

The SDK reads hardware signals and hashes them locally.

02 · YOUR SERVER

Ask

One request: POST /v1/check, with your key.

03 · HWID-GUARD

Weigh & decide

The composite is scored on our server, never trusted from the client.

04 · YOUR LOGIN

Block here

Got a BAN? You refuse before the login completes.

04
Integration

The easy part is on purpose.

The moat isn't the algorithm — it's that you're live this afternoon instead of building a fingerprint stack from scratch.

// the key stays on YOUR server, never in a distributed client
var guard = new HwidGuardClient("https://sigelis.cruxsacra.com.br", apiKey);
var r = await guard.Check(HwidCollector.Collect());

if (!r.IsAllowed) BlockLogin(r.Reason);
.NETUnityC++TypeScriptPythonElectronFiveMGateway (zero-code)

Seven SDKs — or none at all: the gateway sits in front of your app as a reverse proxy and you write no code.

05
Risk of trying it

Zero. Start by only watching.

In monitor mode everything runs and nothing is blocked. You see in your own logs who would have been caught, on your real player base, before you block a single login. You learn your false-positive rate from your data — not from our promise.

Week 1 — observe

Verdicts land in your logs. Nobody is blocked. You compare them against the abusers you already know.

Week 2 — decide

Happy with what you saw? Flip the switch and start enforcing. On your schedule, on your evidence.

06
Segments

Who buys it, and what it fixes for them.

"Ban the device" means something different in each business. Weighting the right signal for the case is the product — same API, the signal that actually fits.

Indie games & launchersThe banned cheater doesn't return on a new account.weighted hardware composite
OTServer & private MMOsBotters stay out, the server economy survives.native in-client collector
FiveM & RP communitiesA ban holds across the whole network, not one server.native hardware token
SaaS & anti-abuseNo more free tier burned by throwaway accounts.origin classification
Licensed softwareOne license, one machine — no quiet sharing.strict composite, higher rigor
Competitive & rankedSmurfs stop wrecking your matchmaking.device-to-accounts correlation
Marketplaces & communitiesA banned scammer can't return with a new profile.device banlist
Bookings & reservationsScalpers and bots stop hoarding your slots.bot signal + account clustering
07
Why it holds up

Hard to fool. Easy to trust.

Self-declaration never wins

The client never votes on its own trust. Claiming "I'm native" or "I have a TPM" earns nothing — only cryptographic proof gets precedence, and a guess always cedes to real evidence.

Weighted composite

No single signal decides. Someone who swapped a hard drive isn't banned by accident — what triggers a ban is a threshold of real hardware evidence.

VM & emulator aware

Spinning up a virtual machine to reset hardware trips detection — a disposable device shouldn't count as a fresh, legitimate one.

Adversarially reviewed

Our decision paths are attacked by an independent, different-model reviewer that tries to break them — and what it finds, we close.

08
The question every dev asks

Will it slow my app down?

No — by design. This is not a runtime anti-cheat living inside your app: no resident process, no hooks, no kernel driver, no continuous scanning.

One call, at login

The collector reads a handful of identifiers, hashes them locally and sends a few KB. That's it, once.

The weight is on our side

Scoring, banlist and analysis run on our server — not on your player's machine.

Your timeout, fail-open

You set the limit. If our API is ever unreachable, your players still get in.

09
Candor

What it is — and what it isn't.

Anyone promising you infallibility is selling something. We'd rather state exactly where the signal is strong and where it's weak: that's what makes it trustworthy in the cases that matter.

It is

  • Weighted evidence, scored server-side
  • The layer that makes a ban stick across accounts
  • Complementary to runtime anti-cheats
  • Private: only hashes leave the machine

It isn't

  • A guarantee of identity — it's confidence, not certainty
  • A kernel driver, and not spyware
  • Proof against a dedicated kernel-level spoofer
  • As strong in a browser as in a native client
10
Privacy & GDPR/LGPD

Only hashes leave the machine.

A system that reads hardware identifiers should make a thoughtful engineer nervous. So: the raw serial never travels and is never stored readable — what exists is a composite of opaque hashes.

No dossier

We compare "does this hash match a banned hash". We don't keep a catalogue of your players.

Configurable retention

You decide how long data lives, per your use case and your law — and no longer.

Appeal portal

A blocked user gets a path to contest it; the operator decides with the evidence in hand.

11
Pricing

Start free. Pay when it's protecting you.

Free
$0
  • 1 app · 10,000 checks / mo
  • All SDKs + the gateway
  • Panel, bans, audit log
Most teams
Pro
$49 / mo
  • 250,000 checks / mo · unlimited apps
  • Webhooks + SIEM export
  • IP allowlists, key controls
Enterprise
Let's talk
  • SSO/SAML, roles & invites
  • SLA + dedicated deployment
  • On-prem option

Early-access pricing — the first studios help shape the plans. If your volume doesn't fit, we'll fit it to you.

12
The offer

Founding design partners.

First 10 · real seats
You get
  • Free at Pro-level volume
  • We wire up the first integration with you
  • Monitor mode — you risk nothing
  • A voice in the roadmap
In exchange
  • A testimonial, once it works
  • A few feedback calls

No card, no contract, no catch. "First 10" is real — it's all one person can integrate properly.

13
Next step

Stop ban-evasion this week.

Create an app, generate a key, run your first check in five minutes. Monitor mode means you risk nothing to see it work.

Talk about a pilot

HWID-Guard — device reputation as a service. Detection is weighted evidence, honestly — not a guarantee.

14