Toronto-based hardware startup Bionym gave a special public demo of its Nymi ECG authentication and identification wristband at the monthly We Are Wearables event yesterday, and talked a bit about their product in more detail, now that it’s well on its way to production. The Nymi measures a user’s heart beat, and uses that to verify their identity and then perform various handshake operations to make it easier to login to software, customize settings and manipulate connected devices. Check out the video above, featuring Bionym CEO Karl Martin and President Andrew D’Souza, and read below to find out more about how this impressive wearable works its magic.

For the Nymi to know who you are, you first go through an enrollment process. That enrollment is about taking your biometric data and tying it to your identity so you can use it for other applications. You touch the top to allow capture of your ECG, since the metal pad on the underside of the wristband provides a second point of contact. It takes about two minutes to gather enough data to complete your profile upon first setup.

That produces a biometric template that ties the Nymi to you so that it and the applications it works with know it’s you. Once registered, at the beginning of the day you touch it with two points of contact again to authenticate it, which takes a couple of seconds to recall your profile. It then uses sensors on the band to know it’s still on your wrist and hasn’t been removed (cut off, stolen or lost), meaning it’s not actually verifying with your ECG in each usage throughout the day, but using that initial handshake and its tamper detection as proof it’s still you each time you use it.

In terms of accuracy (identifying one person concretely without duplication), it’s pretty close to fingerprint authentication but is much better than facial detection, the Nymi team explained. It’s also designed to be more hack-resistant than traditional passwords. One of the reasons that Heartbleed was such a big deal was that people’s identities were easily stolen, explained Bionym Chief Cryptologist Yevgeniy Vahlis, but having a dedicated device avoids that. That’s because the Nymi is a self-contained device that doesn’t run any off-the-shelf software – it runs only Bionym’s own code.

“We’re creating an environment where we control all the variables,” he said. “As a wearable, that’s possible; as just an app [strictly software solution], there’s nothing we can do to protect your identity, your encryption, etc.”

Bionym also isn’t all that interested in licensing its tech to others, despite fielding a lot of approaches asking for this.

We’ve been approached since the start, but we’re trying to create a platform as a business,” Martin said. “So while it would be a great short-term revenue bump, you can very easily be swapped out for a different technology. It’s not out of the question to license, but it would have to be under our terms, and it would have to be backwards compatible with our ecosystem.”

Bionym would actually be open instead to building better authentication tech that might arise into its own devices, rather than operating the other way around, since it sees more longevity in that model.

With a launch planned for fall, the key to growing the business early is to find people whose problem is so painful for them that they’re willing to push your solution, D’Souza said onstage; that means airlines, mobile payments providers, and password management companies for Nymi. That could help this startup avoid the problem of building early influential evangelist communities that other hardware startups have faced, and build to critical mass without awkward early growing pains.