IPScanner

For compliance teams

Location verification for age gates: prove where users are, and prove you checked.

When a rule depends on where a user is, Provenance checks the connection for VPN, proxy and Tor, applies that place's policy and seals each check into a tamper-evident record you can export for an auditor.

Start freeHow it works

Signed evidence exportNo card

Audit log

Speed

Decided before your visitor blinks.

Every check answers in 50 to 100 ms, so your pages and signups never wait on it.

IPScanner checkmedian, at your edge
~85 ms
A blinkhuman eye
300 ms
A fast page loadGoogle's “good” mark
2.5 s

How it works

Check, record, export

  • 01

    Check at your gate

    One server call when a user reaches an age or territory gate. Try it first from the dashboard, no code.

  • 02

    Every check is recorded

    Each result is chained to the one before it, so an edited record shows.

  • 03

    Export the evidence

    A signed CSV for any date range when a regulator or court asks. Free covers the last 30 days.

Why now

The liability shifted to you

Utah SB 73, the UK Online Safety Act, Australia's Social Media Minimum Age Act and a wave of EU and US age-assurance rules make the operator liable for letting masked or out-of-jurisdiction users through your gate. A naive IP geolocation check fails the moment a user turns on a VPN, and you have nothing to show you tried.

  • Forced buyers and fixed deadlines, because non-compliance carries real fines and platform risk.
  • A VPN or residential proxy defeats plain geolocation, so you need anonymizer detection.
  • Regulators ask for evidence of proportionate measures, not a yes or no flag.
  • Audit logs that can be silently edited prove nothing, so the record must be tamper-evident.

Use cases

Where Provenance is required

  • Age-restricted platforms

    Adult content, gambling and alcohol sites under Utah SB 73, UK age-assurance duties and Australia's eSafety codes, plus social platforms facing Australia's under-16 rules.

  • Regulated geo-licensing

    iGaming and streaming rights that must keep out-of-territory and masked users out.

  • Audit and legal teams

    Produce defensible evidence of proportionate measures on demand for a regulator or court.

  • KYC and onboarding

    Flag VPN and proxy masking at signup before it contaminates downstream identity checks.

Integrations

Keep masked traffic out at the door

The installs below block VPN, proxy and Tor traffic on the same engine before it reaches your gate. Provenance itself is one server call.

All integrations

Proof that holds up

An answer you can show an auditor

Each location check is sealed into a hash-chained log, so months later you can show what you knew and when.

Start freeRead the docs
Entry 48,213 sealedLinked to the entry before it
Chain intactNo edited or missing entries

Policy actions

A clear action for every request

The jurisdiction policy turns the network-origin verdict into an enforceable decision.

  • Allow

    Clean residential origin in an allowed jurisdiction, so the user passes through.

  • Step Up

    Masked or ambiguous origin that should be escalated to stronger verification before access.

  • Block

    Anonymized origin under a strict regime such as Utah, the UK or Australia, so the request is denied and the reason logged.

Under the hood

One call at the gate, a defensible record behind it

Provenance runs on the shared detection engine, then seals the outcome into evidence.

  • Network-origin detection

    Classifies each IP as VPN, residential proxy, datacenter, Tor, hosting or clean residential, the masking a plain geo lookup misses.

  • Per-jurisdiction policy

    Utah, UK, EU and Australia rules differ, so Provenance maps the verdict to allow, step up or block under the law that applies to the request.

  • Hash-chained audit log

    Every check is sealed as sha256 of the previous hash and the payload. Edit any historical row and the whole chain breaks on verification.

  • Evidence export

    Export a signed CSV for any date range showing you applied proportionate measures, complete with a chain-verification header for regulators.

  • Daily anchoring

    A daily root hash seals the chain head, so the log is provably append-only as of each day.

  • Drop-in at the gate

    One server-side call at your age or geo gate, plus an optional JS snippet to supply request context. No personal data required.

For your developers

One request for your developers

Call it server-side at your gate. The attestation id points to the sealed audit entry.

POST/v1/provenance/check
curl -X POST 'https://ipscanner.io/v1/provenance/check' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"ip":"203.0.113.24","claimed_jurisdiction":"us-ut","request_context":{"gate":"age-verification"}}'
response

Your 25,000 free credits cover 2,500 sealed checks. Every call writes an attestation you can export as evidence.

View API docsOpenAPI spec

SDKs for Node.js, Python, Go, PHP, Ruby and Rust

FAQ

Questions, answered

Provenance gives you two of the things these laws demand: a proportionate technical measure that detects VPN, proxy and Tor masking and enforces per-jurisdiction policy, and a tamper-evident record proving you applied it. Australia's Social Media Minimum Age Act expects reasonable steps plus evidence you took them, which is the same pattern. It is a compliance control rather than legal advice, so pair it with your age-assurance vendor and counsel, and use the evidence export to demonstrate the measures you took.

Prove where your users were

Start free, run a check from the dashboard and export the record.

Start freeSee pricing

No credit card to start

    Location Verification API for Age Gates | IPScanner