Observe-first, on-premise. Sees weak fraud signals earlier — before onboarding, payment, or payout workflows create irreversible exposure — inside the operator's own environment.
Most controls decide after a request already entered application logic, triggered external checks, or reached a workflow that's expensive or irreversible to unwind — a poor fit for instant / account-to-account rails, where money, once sent, is gone.
Cloud-hosted fraud vendors add a second problem: they need sensitive data to leave the operator's environment. For regulated banks, that's increasingly a non-starter on its own.
Ingests what you already trust — edge headers/logs, app & payment events, threat-intel feeds, batch import. No raw packets required.
Velocity counters, a deterministic explainable rule pack, and a correlation engine linking related events — every signal produces a human-readable reason. Independent weak signals occurring together (e.g. an automation/bot label alongside threat-intel or account-lifecycle signals) produce one additional, explainable compound reason.
Starts at observe and report. Anything stronger needs an operator's explicit approval before it can activate — off by default.