Presence Without Surveillance
Every time we explain proximity-based authentication, there's a moment — usually about thirty seconds in — when someone's eyebrows go up. "Wait. So it knows where I am? All day?"
It's the right question to ask. Security teams have spent years being told that more data means better protection, and a lot of "continuous" security products took that literally: screen recording, keystroke logging, location history, productivity scores. Employees noticed. So when a new tool promises to verify identity continuously, it's reasonable to wonder whether "continuous authentication" is just a friendlier name for continuous monitoring.
It shouldn't be. And the difference comes down to what question the system is actually trying to answer.
Authentication asks a small question
Surveillance asks open-ended questions: What are you doing? Where have you been? How productive were you today? Those questions have no natural limit, so the data collection behind them doesn't either.
Authentication asks a much smaller one: is the person using this account the person it belongs to — and are they still here? That's it. It's a yes-or-no question, asked over and over, and it can be answered without knowing anything about what that person is working on, who they're emailing, or which coffee shop they're sitting in.
Proximity is a good example. To know that you're still at your laptop, a system needs to know that your phone and your laptop are near each other. It doesn't need to know that they're both in Denver. "Two trusted devices are within a few feet of each other" is a very different fact than "this employee is at 1600 Main Street," and a well-designed system should only ever need the first one.
The test for any "continuous" security tool
Whether you're evaluating NearAuth.ai or anything else that watches sessions after login, a few questions separate authentication from surveillance:
- Does it collect content, or just signals? Knowing a device is present is a signal. Knowing what's on the screen is content. Identity verification never needs content.
- Is the data tied to a security decision? Every piece of data should exist because it helps decide "allow" or "deny." If nobody can explain which decision a data point feeds, it shouldn't be collected.
- Who can see it, and for what? An audit trail that security uses to investigate a suspicious login is healthy. The same data handed to managers to count how long someone was away from their desk is not.
- How long does it stick around? Authentication records need to last long enough to support investigations and compliance. They don't need to last forever.
- Can employees see it too? If a system is uncomfortable showing people their own authentication history, that's worth noticing.
None of these are exotic. They're the same principles privacy laws like the GDPR already spell out — collect only what you need for a specific purpose, and don't quietly repurpose it later. Good security architecture and good privacy practice point in the same direction here.
Why less data is actually better security
There's a security argument for restraint, too, not just an ethical one. Every sensitive record you store is a record someone can steal. A database of employee location histories and activity logs is exactly the kind of thing attackers love to find — we've written about how often that kind of data leaks. A system that only knows "device A was near device B at 9:14 a.m., access allowed" is a far less interesting target.
Trust matters for adoption as well. Security tools that employees see as spyware get worked around — disabled, left at home, or fought over with HR. A tool people understand, and can see is only checking whether they're present, is a tool they'll actually leave running. And a security control that's actually running beats a more powerful one that everyone resents.
How we think about it at NearAuth.ai
NearAuth.ai was built around that small question. The core signal is proximity between a person's trusted devices — enough to know the right person is still there, and to lock things down when they walk away. Login patterns and device information help spot things that look wrong, like a sign-in from a new device or an impossible jump between locations. Those signals exist to make one decision: whether access should continue.
The audit trail follows the same idea. It's there so that when something goes wrong, you can answer exactly who was authenticated, and when — not so someone can review how an employee spent their afternoon. And because people should be able to see their own record, users can review their own authentication history.
Continuous authentication is going to become the norm, because one check at the front door isn't enough anymore. The companies that get it right will be the ones that keep the question small. Knowing you're here is security. Knowing everything else about you is something else entirely.
chris@nearauth.ai