Skip to content
Book a demo

Why human presence?

Who is actually doing this?

For twenty years, “logged in” meant “a person is here”. That stopped being true. This page explains why, and what a presence check is.

Knowing who is not knowing whether

A bank branch checks your ID at the counter. That tells the teller who you are. Now imagine you leave, and someone else continues the conversation through a speaker on the counter, in your voice, using your account. The ID check was right. It just happened at the wrong moment.

Identity checks, passwords and MFA answer “who owns this account?” once, at the door. Everything after the door is trusted by default.

HEIP answers a different question, later: is a person at the controls right now, for this action?

Three old answers. Three ways to be wrong.

  • Check once at the door. (login, KYC)

    Correct at the moment. Says nothing about what happens next.

  • Ask a puzzle. (CAPTCHA)

    Annoys every real person, and software keeps getting better at solving them.

  • Watch the traffic. (network bot tools)

    Good at spotting obvious automation. Can't tell whether this specific action, in a real session, has a person behind it.

Each is useful. None answers the question at the moment it matters. HEIP works alongside all three.

The check has to happen when it matters

  1. Sign in

    password, MFA
    check who you are

  2. Session

    time passes
    control can change

  3. Action

    withdraw, pay,
    approve

  4. Decision

    your server
    asks HEIP

The risky moment is not the login. It is the withdrawal, the payout change, the agent's purchase. That is where the check belongs.

A moment is easy to fake. A whole visit isn't.

Anyone can wear a uniform for one photo. Working a whole shift in it, without anyone noticing, is a different problem.

HEIP builds its view over the whole visit, then answers at the moment of action. That is harder to imitate than any single test.

What HEIP does

  1. Your website adds HEIP.

    Visitors see nothing new.

  2. Your server asks.

    When someone does something important, your server asks HEIP: is a person in control right now?

  3. HEIP answers.

    Allow, step up or deny, with reasons. You decide what happens.

What it doesn't use

  • No identity
  • No biometrics
  • Nothing typed
  • No tracking across websites

What this means for you

  • Fewer surprises at the moment money moves.
  • Less friction for real people.
  • Decisions you can explain.
Book a demoSee the use cases

NIST SP 800-63B-4 recognises session monitoring as a way to reduce risk after sign-in, and asks that its privacy implications be considered. NIST SP 800-63B-4, Session Management (July 2025)