Alloy

Fraud Signal scores fraud risk for each customer across onboarding, account activity and transactions, and Fraud Attack Radar spots coordinated attacks across a portfolio. Both are Alloy's own models. An AI Assistant takes on research and case work, and customers can bring their own models to the platform. Beneath them, a decisioning engine runs customer written rules over third party data. That engine would still decide applications without the models.

Institutions write the risk policies. Applications that meet policy thresholds are approved automatically, and the rest go to manual review, with step up verification as a named product. The AI Assistant researches alerts and KYB cases and recommends a decision. A team can delegate any manual step to it, including acting on the next step itself, and Alloy's fraud FAQ says agents can resolve some cases entirely without saying which. Every action is logged with the data reviewed, the policy applied and who approved the outcome.

Before a policy goes live, a team can backtest it on historical data, run up to five versions in champion challenger tests and shadow test it against live production traffic. Every workflow change is versioned and can be rolled back. The AI Assistant links its watchlist findings to the sources behind them. Validation documentation for Fraud Signal and the agentic components is not published, and no supervisory model risk framework is named.

Named customers carry figures on Alloy's own pages. IncredibleBank automated 90 percent of account openings. Suncoast Credit Union cut fraud losses 35 percent, and Live Oak Bank reports fraud down 27 percent year on year. Earnest raised its automated approval rate 56 percent and cut the time to change a credit policy by 89 percent. Grasshopper Bank reports 58 percent fewer manual reviews. Measurement windows and methods are not given.

Encryption, key management and 30 day encrypted backups are described. Fraud Signal and Alloy's other models are trained on aggregated fraud patterns from its network of more than 900 institutions and fintechs. No boundary on that pooling is stated, and nothing says whether a customer can opt out.

Client customers are addressed separately in a privacy policy updated August 29, 2025, with Alloy as processor and rights under the GDPR and California law. The Gramm Leach Bliley Act, the Fair Credit Reporting Act and permissible purpose are not mentioned, and retention runs on legitimate business need.

An independent SOC 2 Type 2 evaluation is stated, while the ISO 27001 and Tier IV references describe the AWS facility rather than Alloy. Report dates, audit periods and a trust portal are not published.

Alloy claims no banking license. KYC and KYB checks, screening against more than 1,000 sanctions, PEP and adverse media sources, and SAR and CTR filing all sit inside the platform. SARs and CTRs are filed electronically and directly with FinCEN from Alloy's case management system, through a direct FinCEN integration, with case details filling in each report. That filing channel covers the reports, not the models that help prepare them.

Credit decisioning, line management and pre qualification sit inside Equal Credit Opportunity Act territory. The credit page says nothing on adverse action or fair lending, and the help center says no out of the box adverse action notice support is offered. Fair lending testing and demographic performance analysis are unpublished. Audit logs of why each applicant was approved or denied are not model level fairness evidence.

Audit logs record each step, the policy that triggered an outcome and who approved it, so an institution can reconstruct a decision and reverse it. Wrongly declined applicants are routed entirely through the lender. No accuracy commitment covers decisions the platform powers.

Twelve partner companies are tabulated in the privacy policy as collecting data in delivering the service. That is a subset of the network. No subprocessor list is published, and no provider is named for the model behind the AI Assistant.

More than 270 partner solutions are documented on Alloy's own pages, several competing with one another, so a team can swap one for another without reintegrating. Since August 2026 Alloy Marketplace lists them inside the platform beside a library of ready policy snippets. Digital account opening systems such as nCino and MANTL appear among the partners. Delivery runs through one API with a public developer hub, and branch and call center channels share the same controls.

Amazon Web Services hosts the platform in a United States data center, with production and non production in separate virtual private clouds. Where a European customer's data rests, despite a United Kingdom site, and any regional choice are not stated.

A platform fee sits beside per call charges for whichever data providers a customer routes through, and neither is published. Alloy has no pricing page, and every route leads to a demo. The one published allowance is up to 1,000 free API calls on a first trial of an eligible partner resold through Alloy. Total cost of ownership cannot be estimated from public material, even roughly.

Banks, credit unions, fintechs, sponsor banks and crypto firms each have their own pages, and credit unions get particular depth. Onboarding is broken out by consumer, small business, commercial and merchant. Payment rails are enumerated, from peer to peer and RTP or FedNow to wire, card and stablecoin. Alloy says more than 900 financial institutions and fintechs use the platform.