IP Geo API

IP Geolocation for SaaS Monetization — Geo-Pricing, Tax-Routing, and Trial-Abuse Defence

Why SaaS monetization is its own axis: a modern B2B/B2C SaaS stack collects revenue across 30-60 tax jurisdictions, prices the same SKU at 4×-6× spread by purchasing-power parity (PPP), and absorbs a single-digit-percent gross-margin haircut every quarter from credit-card-testing rings, multi-trial abuse, and refund-fraud bots — all of which route through residential-proxy and datacenter IPs. The IP layer is where geo-pricing tiering, VAT/sales-tax nexus routing, and abuse-vector filtering all originate. A wrong country resolve in checkout is a tax-filing error in 90 days and a lost €60-€600/seat/year price discrimination in the meantime.

The country an IP resolves to, the ASN it belongs to, and whether it’s a known datacenter, VPN, residential-proxy, or Tor exit are inputs to four separate SaaS-monetization control surfaces:

  1. Geo-pricing (PPP-adjusted price discrimination) — the same Pro tier billed €99/mo in DE/NL/FR may be €49 in PL/PT, €29 in BR/IN/ID, $79 in US, and £79 in UK. The pricing call resolves on the checkout-page first paint from country_code + currency. A residential-proxy hop from DE → BR is a €70/seat/month margin leak.
  2. Tax-jurisdiction routing (VAT/GST/sales-tax) — EU OSS / IOSS for B2C ≤ €150 imports, reverse-charge for B2B with valid VIES VAT-ID, UK VAT post-Brexit, AU/SG/IN GST on digital services, and US state-level sales-tax nexus (45 states + DC have economic-nexus thresholds since Wayfair 2018). The IP-country + billing-country reconciliation is the audit trail.
  3. Trial-abuse + card-testing defence — the canonical SaaS-stack pattern: a residential-proxy network rents one card across thousands of $0 free trials, then chains to a second card-testing wave at $0.01-$1 once the first trial converts. ASN + is_proxy + is_relay + risk-score catches > 80 % of these at signup.
  4. Compliance feature-gates (export controls + embargo) — US BIS Entity-List + EU dual-use Annex IV + OFAC SDN + EU restrictive measures (RU/BY/IR/KP/SY etc.) all require operators to demonstrate IP-country + ASN + threat-flag screening on every new account and every feature-flag activation. “We didn’t check” is not a defence in an OFAC matter.

A single REST call to IP Geo API returns all four signal classes — country/region/currency, ASN, threat-flags (VPN/proxy/Tor/hosting/relay), risk score — on every plan, no add-on SKU, ≤40 ms median in EU.

What SaaS-monetization buyers care about (in order)

  1. Checkout-latency budget ≤ 40 ms. Stripe, Adyen, and Braintree all expose < 100 ms total page-paint budgets for the checkout-route; the IP-resolve must finish in ≤ 40 ms or the geo-pricing tier renders late and conversion drops measurably (Baymard 2025 — 7-12 % checkout-abandon delta on > 200 ms first paint). IP Geo API runs on EU edges (Hetzner Frankfurt) for ≤ 30-40 ms median across DE/NL/FR/IE/ES/IT/UK, ≤ 60 ms US-EU round-trip.
  2. EU residency + GDPR + DAC7 posture. DAC7 (EU Directive 2021/514) requires digital-platform operators to report seller-country + transaction-country to the relevant tax authority annually. The IP-country signal feeds both the live geo-pricing call AND the year-end DAC7 export. Customer IPs cannot be transferred to a US vendor without GDPR §28 DPA + SCCs + TIA. IP Geo API is EU-only data-flow, signed DPA in 24h, no SCCs required, DAC7-export-ready.
  3. Threat fields on every plan, not a paid add-on. Most US incumbents (MaxMind, ipinfo.io, ipstack) split datacenter/VPN/proxy classification into a paid Security Module or Privacy add-on. IP Geo API ships is_vpn, is_proxy, is_tor, is_hosting, is_relay, and a numeric risk_score on the free tier — critical for catching the > 80 % of trial-abuse + card-testing traffic that originates from datacenter or residential-proxy ASNs.
  4. ASN-level granularity for residential-proxy detection. The dominant SaaS-monetization fraud vector in 2025-2026 is residential-proxy networks (Bright Data, Oxylabs, Smartproxy, IPRoyal) renting consumer IPs from compromised home routers. Country-only checks pass these through; ASN + is_proxy flag catches them. We expose asn, asn_org, and is_proxy as first-class fields so your billing + signup-funnel filters can reject at ASN granularity without maintaining a list yourself.
  5. Predictable EUR billing + transparent rate-limits. SaaS finance teams need a per-month EUR line-item that does not move with USD-FX. IP Geo API is monthly EUR, no annual prepay, no FX line item, rate-limits stated in req/day and req/sec with no surprise overage on the bill.

The four SaaS-monetization control surfaces, in code

1. Geo-pricing (PPP-adjusted) at checkout-page first paint

// /api/checkout/pricing.js — Node 20 / Express
// Called on every checkout-page render BEFORE the SKU + price block paints.
// Fail-soft: on classification error, fall back to USD/global default tier.
const fetch = require('undici').fetch;

const PRICING_TIERS = {
  // PPP-adjusted tier → ISO-2 country list (verified vs IMF PPP 2025)
  tier1: { price: 99, currency: 'EUR', countries: ['DE','NL','FR','BE','LU','AT','FI','SE','DK','IE','IT','ES'] },
  tier2: { price: 79, currency: 'EUR', countries: ['PT','GR','EE','SI','SK','CZ','HU','PL','HR','RO','BG','LT','LV'] },
  tier3: { price: 49, currency: 'EUR', countries: ['TR','ZA','MX','AR','CL','UY','MA','TN','RS','MK','ME','BA','AL'] },
  tier4: { price: 29, currency: 'EUR', countries: ['BR','IN','ID','PH','VN','TH','EG','NG','KE','GH','BD','PK','LK'] },
  usa:   { price: 79, currency: 'USD', countries: ['US','PR','VI','GU','MP','AS'] },
  uk:    { price: 79, currency: 'GBP', countries: ['GB','JE','GG','IM','GI'] }
};

async function resolveCheckoutPricing(req, res) {
  const ip = req.ip;
  const geo = await fetch(`https://api.ipgeo.10b.app/v1/lookup/${ip}`, {
    headers: { Authorization: `Bearer ${process.env.IPGEO_KEY}` },
    signal: AbortSignal.timeout(40)
  }).then(r => r.json()).catch(() => null);

  // Fail-soft: missing geo → USD global default
  if (!geo) return { tier: 'usa', ...PRICING_TIERS.usa, reason: 'ipgeo_unavailable' };

  // Reject PPP-tier hop via residential-proxy / VPN — fall back to billing-country
  // (set later by Stripe card-country) instead of awarding the cheap tier.
  if (geo.is_vpn || geo.is_proxy || geo.is_hosting) {
    return { tier: 'usa', ...PRICING_TIERS.usa, reason: 'circumvention_flag_fall_back_to_billing_country' };
  }

  const cc = geo.country_code;
  for (const [tier, def] of Object.entries(PRICING_TIERS)) {
    if (def.countries.includes(cc)) {
      return { tier, ...def, reason: 'country_match', countryCode: cc, asn: geo.asn };
    }
  }
  return { tier: 'usa', ...PRICING_TIERS.usa, reason: 'no_tier_match_default_usd' };
}

Why VPN/proxy/hosting fail-back to billing-country instead of awarding the cheap tier: Bright Data + Oxylabs residential proxies in BR/IN cost $4-8/GB; the price differential between EUR-tier1 (€99) and EUR-tier4 (€29) is €70/seat/month. A seat held for 12 months = €840 margin loss against $50-80 in proxy cost. Fail-back to billing-country lets Stripe’s card-issuer-country be the authoritative second signal.

2. Tax-jurisdiction routing at invoice-generation

# /billing/tax-routing.py — invoked at every subscription renewal / one-off invoice
EU_27 = {'AT','BE','BG','HR','CY','CZ','DK','EE','FI','FR','DE','GR','HU','IE','IT',
        'LV','LT','LU','MT','NL','PL','PT','RO','SK','SI','ES','SE'}
US_NEXUS = {  # 45 states + DC with economic-nexus thresholds (post-Wayfair 2018)
    'AL','AR','AZ','CA','CO','CT','DC','FL','GA','HI','IA','ID','IL','IN','KS','KY',
    'LA','MA','MD','ME','MI','MN','MO','MS','NC','ND','NE','NJ','NM','NV','NY','OH',
    'OK','PA','RI','SC','SD','TN','TX','UT','VA','VT','WA','WI','WV','WY'
}
# OFAC SDN + EU restrictive-measures embargoed (live as of 2026-Q2)
EMBARGOED = {'IR','KP','SY','CU','RU','BY'}

def route_tax_jurisdiction(geo, billing_country, vat_id_valid, region_code, sale_eur):
    # 1. Embargo hard-stop
    if geo['country_code'] in EMBARGOED or billing_country in EMBARGOED:
        return ('refuse_sale', 'embargo_match', None)

    # 2. Reconcile IP-country vs billing-country (EU OSS 2-evidence rule)
    countries = {geo['country_code'], billing_country}

    # 3. EU OSS / IOSS / reverse-charge routing
    if countries & EU_27:
        if vat_id_valid:
            return ('zero_rate_reverse_charge', 'b2b_intra_eu', countries)
        # B2C — apply destination country's VAT rate
        return ('eu_oss', 'b2c_destination_country', billing_country)

    # 4. UK post-Brexit — 20 % VAT < £8 818 / yr or registered
    if billing_country == 'GB':
        return ('uk_vat', '20_percent_post_brexit', 'GB')

    # 5. US state-level sales tax (Wayfair economic-nexus)
    if billing_country in {'US','PR','VI'}:
        if region_code in US_NEXUS:
            return ('us_sales_tax', f'nexus_state_{region_code}', region_code)
        return ('us_no_nexus', f'non_nexus_state_{region_code}', region_code)

    # 6. Other digital-service-tax jurisdictions
    if billing_country == 'AU':  return ('au_gst',  '10_percent_digital_services', 'AU')
    if billing_country == 'SG':  return ('sg_gst',  '9_percent_overseas_vendor',   'SG')
    if billing_country == 'IN':  return ('in_gst',  '18_percent_equalisation_levy','IN')
    if billing_country == 'CA':  return ('ca_gst',  '5_to_15_provincial_split',    region_code)
    if billing_country == 'NZ':  return ('nz_gst',  '15_percent_remote_services',  'NZ')
    return ('out_of_scope', 'no_jurisdiction_match', billing_country)

Why IP-country and billing-country, not either alone: EU OSS reporting (EC Regulation 282/2011 art 24f) requires two non-contradictory pieces of evidence for the customer location — IP-country, billing-address-country, card-issuer-country, SIM-MCC, or bank-account country count as valid evidence. Use just one and you fail the OSS audit; use two that disagree (IP=BR, billing=DE) and you have a circumvention indicator the tax authority will want explained.

3. Trial-abuse + card-testing defence at signup

// /signup/abuse-scoring.js — fires synchronously on POST /signup BEFORE provisioning
const RESIDENTIAL_PROXY_ASNS = new Set([
  212238, 401116,  // Bright Data / Luminati
  396982, 60068,   // Oxylabs / Cyberghost
  62240, 16276,    // Smartproxy / OVH-mixed
  35916, 174,      // IPRoyal / Cogent-mixed
  21859, 32475,    // Tier3 / Choopa-mixed (commonly residential-proxy upstream)
]);

async function scoreSignup({ email, ip, fingerprint, marketingChannel }) {
  const geo = await ipgeoLookup(ip);
  let risk = geo.risk_score;            // 0-100 baseline from IP Geo API
  const reasons = [];

  // Hard rejects
  if (geo.is_tor)                                { return { decision: 'block', risk: 100, reasons: ['tor_exit'] }; }
  if (geo.is_hosting)                            { return { decision: 'block', risk: 100, reasons: ['datacenter_ip'] }; }
  if (RESIDENTIAL_PROXY_ASNS.has(geo.asn))       { return { decision: 'block', risk: 95,  reasons: ['known_residential_proxy_asn'] }; }

  // Soft signals
  if (geo.is_vpn)                                { risk += 25; reasons.push('vpn_flag'); }
  if (geo.is_proxy)                              { risk += 30; reasons.push('proxy_flag'); }
  if (geo.is_relay)                              { risk += 10; reasons.push('relay_flag'); }

  // Velocity / device-fingerprint correlation (handled elsewhere, mentioned here for completeness)
  const trialCountForFingerprint = await trials.countByFingerprint(fingerprint, '30d');
  if (trialCountForFingerprint >= 3)             { risk += 25; reasons.push('trial_velocity_30d'); }

  // Disposable-email correlation
  if (await emails.isDisposable(email))          { risk += 20; reasons.push('disposable_email'); }

  // Marketing-channel adversarial weight (paid affiliates have higher abuse base-rate)
  if (marketingChannel && marketingChannel.startsWith('aff_'))  { risk += 5; reasons.push('affiliate_channel'); }

  if   (risk >= 80) return { decision: 'block',           risk, reasons };
  else if (risk >= 60) return { decision: 'step_up_kyc',  risk, reasons };
  else if (risk >= 40) return { decision: 'flag_for_audit', risk, reasons };
  else                 return { decision: 'allow',        risk, reasons };
}

Why ASN-block at signup, not just at first payment: card-testing rings cycle through 50-500 stolen card numbers per minute. By the time the first failed-auth fires at the PSP, the ring has consumed your free trial provisioning budget (compute, mail, SMS, free-tier API credits). Blocking at the residential-proxy ASN at the signup form (before any paid resource activates) is 100×-1000× cheaper than blocking at the PSP layer downstream.

4. Compliance feature-gates (export controls + embargo)

# /compliance/feature-gate.py — invoked on every feature-flag check + every new account
OFAC_EMBARGOED = {'IR','KP','SY','CU'}                      # OFAC comprehensive
EU_RESTRICTIVE = {'RU','BY','IR','KP','SY','MM'}            # EU CFSP measures
US_BIS_ENTITY  = {'CN','HK','MO'}                           # tightened export-control class
DUAL_USE_EU_4  = {'CN','HK','RU','BY','IR','KP','SY','MM'}  # Annex IV dual-use class

def gate_feature(account_id, feature, geo, billing_country):
    countries = {geo['country_code'], billing_country}

    if countries & OFAC_EMBARGOED:
        audit.write(account_id, feature, 'denied_ofac_embargo', countries)
        return ('deny', 'ofac_embargo_match')

    if countries & EU_RESTRICTIVE:
        audit.write(account_id, feature, 'denied_eu_restrictive', countries)
        return ('deny', 'eu_restrictive_measure_match')

    # Feature-specific tightening: encryption / AI / dual-use features need
    # extra screening for BIS Entity-List + EU Annex IV
    if feature in {'e2e_encryption', 'ai_model_export', 'data_residency_outside_eu'}:
        if countries & DUAL_USE_EU_4:
            audit.write(account_id, feature, 'denied_dual_use_annex_iv', countries)
            return ('deny', 'dual_use_annex_iv_match')

    # Datacenter / VPN traffic to high-risk feature → step-up KYC
    if (geo['is_hosting'] or geo['is_vpn']) and feature in {'admin_console','export_user_data'}:
        return ('step_up_kyc', 'high_risk_feature_via_proxy')

    return ('allow', 'pass')

Why IP-country AND billing-country for export controls: a Russian operator signing up via a German VPN with a EE-issued Wise debit card is the canonical sanctions-circumvention vector since 2022-Q1. OFAC and the EU CFSP both expect operators to screen all available country signals, not just billing-country. Failing to screen IP-country is the most-cited deficiency in OFAC enforcement actions against SaaS operators since 2023.

Pricing math for a typical SaaS monetization stack

Stage Volume Tier Cost / month Cost per check
Pilot integration (single-product) < 30 K checkouts + signups / mo Free € 0 € 0
SMB SaaS (single-region, 1-2 K MAU) < 1 M req/mo Starter €29 € 29 € 0,00003-0,001
Multi-region B2B SaaS (10-50 K MAU) < 10 M req/mo Business €99 € 99 € 0,00001-0,0001
Tier-1 vertical SaaS (> 100 K MAU) > 10 M Custom on request < € 0,00001

A SaaS operator running 2 M checkout + signup + feature-gate calls/mo with an average revenue per blocked PPP-tier-hop of €70/seat/month recovers the entire Business tier (€ 99) by blocking ~2 such PPP-tier-hops per month — and that is before counting trial-abuse + card-testing cost-avoidance, which typically dwarfs the SaaS fee by 2-3 orders of magnitude.

Honest limits — what IP geolocation is not for in SaaS monetization

IP geolocation’s job in a SaaS-monetization stack is to cheaply route, gate, and tier so the expensive verifications (3DS2 step-up, document-KYC, dual-control export-control review, sanctions-screening provider calls) only activate for the small fraction of traffic the IP layer has already flagged as ambiguous or hostile.

Related use-cases

The SaaS-monetization surface composes from these IP Geo API use-case patterns:

Compare IP Geo API to the providers SaaS-monetization teams evaluate

If you’re shortlisting vendors for a checkout-stack refactor, a tax-routing rebuild, or a fraud-and-abuse program audit, these head-to-heads cover the providers most often shortlisted in the IP-geolocation market:

Read also — narrative deep-dives

Seven 2026-dated comparison articles with code-level migration sketches and latency / pricing math at 100K / 1M / 10M req/mo:

Migration walkthroughs — drop-in code-level guides

Already on an incumbent? These step-by-step migration guides ship with field-by-field maps, code diffs, shadow-mode validation, and rollback notes:

Industry deep-dives

Other vertical-specific surfaces using the same IP Geo API primitives:

Get started — SaaS-monetization-friendly procurement

Sign up at https://ipgeo.10b.app/pricing and start with a sandbox key today.

Get early access — 50% off for 12 months

First 100 signups lock in 50% off any paid plan for the first year. No credit card required — we’ll email you at launch.