One person.
A hundred free trials.
Not on your watch.
Halo links accounts across email aliases, phone numbers, devices and networks, then answers one question on your signup route: is this a new customer, or the same person again?
Built for teams losing millions to duplicate free signups
What Halo does
Every signup goes in. One verdict comes out.
You already collect an email, maybe a phone, an IP and a device cookie. Halo takes those raw fields, canonicalizes them, compares them against every identity you've ever seen, and returns a decision your signup route can act on immediately.
Brand-new person. Grant the trial, no friction.
Suspicious overlap. Send to manual review or step-up verification.
Same person as an existing account. Deny the promo.
{
"verdict": "flagged",
"risk_score": 92,
"cluster_id": "cluster_a3f2",
"cluster_size": 3,
"signals": ["email_normalized","device","ip"]
}
How it works
Ship it before lunch.
Drop in one call
A single POST from your signup route. No SDK, no schema changes, no queue.
Halo builds the graph
Each signup is canonicalized and matched against every prior identity in your workspace.
Act in ~40ms
clear · review · flagged, with the exact signals that fired so your team can defend the call.
The ROI
Every duplicate trial is margin you already paid for.
Free promos are a customer-acquisition budget. When one person claims it ten times, you're not acquiring a customer — you're buying a stranger lunch. Move the sliders to your numbers.
Illustrative: assumes an 87% catch rate. Run a week of shadow mode and we replace every number here with your measured data before you block anything.
recovered per year at your numbers.
The signals
Six ways we catch the same person twice.
Email normalization
j.smith+free@gmail.com and jsmith@googlemail.com collapse to one identity. Dots, plus-aliases, domain equivalents.
Phone matching
Country code, formatting and leading zeros canonicalized. Burner and VoIP ranges flagged.
Device fingerprint
Stable browser/device hash that survives cookies, incognito and IP rotation.
Behavioral linkage
Signup cadence, name-key similarity, IP + ASN, geolocation drift. Weighted, not brittle.
Explainable risk score
Every flag ships with the exact signals that fired. No black boxes — defensible to your team.
40ms p95
Runs on the hot path of signup. Never blocks a real user; never lets a duplicate through.
Install
One call. No SDK.
Halo is a single HTTP endpoint. It works from Next.js, Rails, Django, Cloudflare Workers — anything that speaks JSON. You get a decision, a cluster ID, and the exact signals that fired.
- No queues. No dashboards to babysit.
- Idempotent — safe to call from every signup, login or checkout.
- Every response is explainable and audit-logged.
const res = await fetch("https://halo.dev/api/public/v1/check", {
method: "POST",
headers: {
"content-type": "application/json",
"x-api-key": process.env.HALO_KEY,
},
body: JSON.stringify({
email: user.email,
phone: user.phone,
ip: req.ip,
device_fingerprint: req.cookies.hlo_dfp,
}),
});
const { verdict, risk_score, cluster_id, signals } = await res.json();
if (verdict === "flagged") return denyTrial();Vs. legacy fraud tools
Built for the trial funnel, not the bank vault.
Legacy fraud stacks are excellent at stopping stolen credit cards. They are overkill — and priced accordingly — for stopping the same person from claiming three free lattes.
Questions, answered.
Will this block real customers?
No. Halo returns a score and the signals behind it — you decide the thresholds. Most teams only hard-block at flagged (60+) and route review to a lightweight verification step.
What data do I have to send?
Email alone works. Adding phone, IP and a device fingerprint roughly doubles the catch rate.
Where does the data live?
In your own isolated workspace, scoped by API key. Identities are never shared or pooled across customers.
How long does integration take?
One POST request on your signup route. Teams are typically live in under five minutes.
Stop paying strangers to be your best customer.
Spin up a workspace, drop in one API call, watch the duplicates appear.