Will this block real users who sign up from a shared office or a VPN?

No. A VPN or a shared IP on its own is one signal, not a verdict. Rupt reads the device, the email, the phone and the history together, and a borderline signup gets a code by email or SMS rather than a wall. You choose the response per plan.

We already require a phone number or a card for the free tier.

Both are rented cheaply. SMS-only burner lines pass every phone lookup as valid, active and mobile, and virtual cards are new on every attempt. The device is the one thing that stays the same, which is why Rupt links signups by device.

Does it block automatically?

Only if you tell it to. Most AI teams route a repeat signup to the paid plan or a verification step and reserve blocking for bots. Policies are allow, challenge, deny or suspend, and you change them without a release.

Can it tell an AI agent from a person?

Yes. Rupt classifies each request as human, declared agent or undeclared automation, and names the framework where it can. Your policy decides which agents get through, and real users never see a captcha.

Does it moderate what users post or share?

Yes. Rupt reads user content for spam, scam and phishing intent in 30+ languages and ties each detection to the account, device and network behind it. You can hold the content for review, challenge the account or remove the whole ring at once.

Our signup is an API call, not a web form.

Covered. Rupt identifies the device wherever the SDK runs, and a policy can require a real, active device on the account before credits are granted. Accounts created by direct API calls with no device attached are the easiest ones to catch. A ring that made 120,000 accounts never opened a signup page, and that check stopped it.

Will this cost us signups and growth?

Most of the people it stops are using the product without paying, and some of them convert when asked. StealthWriter doubled its growth rate within two months and reported lower OpenAI credit usage. Sketchy converted 20% of the sharers it challenged in three months. A real user on a new device verifies with a code to their email.

Plans start at $99 a month with 20,000 evaluations included, then $0.005 per evaluation. You pay for the moments you choose to check, signup, login or the action that spends credits, not per user or per inference call.

Fraud and abuse prevention for AI native companies

Credit farming

Catch repeat free trials and reduce inference costs.

Link signups by multiple signals, not just email or IP.
Survives cleared cookies, new emails and incognito.
Send repeat signups to a paywall or verification, not a hard block.

One actor opened about 400 accounts in 30 days. Every one shared a device, and not one human session ever showed up.

Read the breakdown

Detect shared accounts and convert them into paid seats.

Detect shared accounts & how many people share them.
Gently nudge sharers without disrupting legitimate users.
Grow revenue by turning sharers into happy, paying users.

StealthWriter found shared accounts pushing thousands of requests an hour and disrupting service. Its growth rate doubled within two months of enforcing limits with Rupt.

Read the StealthWriter story

Prevent bots from burning your inference budget.

Detect advanced bots and automation with high accuracy.
Stop or challenge important, high velocity actions from suspicious accounts.
Prevent automation from killing your margins or spamming your users.

A ring made 120,000 fake accounts by calling the signup API directly, past domain blocking, IP blocking and email 2FA. Requiring a real device on the account is what stopped it.

Read the breakdown

Stop spam, scams and phishing on your platform.

Scan user generated content for spam, scam and phishing intent, in 30+ languages.
Find advanced scam rings and coordinated fraud circles.
Hold, review or take down the whole ring at once instead of one account at a time.

A property marketplace cut scam reports by around 90% and removed about 70 linked accounts in a single action.

Read the story

Tell agents from people, and choose which agents to allow.

Classify every request as human, declared agent or undeclared automation.
Allow the agents you want and stop the ones scraping outputs or farming credits.
No captcha in front of your real users.

Rupt names the agent, whether it declares itself, and what it came to do, so your policy can let it through or stop it.

Read the guide