Alloy

Alloy runs named proprietary models rather than borrowed ones: Fraud Signal is an identity centric machine learning model that scores risk continuously from first touch onward, Fraud Attack Radar detects coordinated attacks at portfolio level, and an agentic assistant triages cases and recommends next steps. The reason this sits a grade below the model native vendors in the category is architectural.

The spine of the product is orchestration across more than 270 third party data providers plus a rules engine the customer authors, and Alloy markets that vendor neutrality as a virtue. Strip out the model suite and a functioning decisioning platform remains.

Human oversight is a first class product surface rather than a disclaimer. Risk policies are authored by the institution, step up verification is managed as its own capability, case management and manual review are named products, and the agentic layer is positioned to analyse case triggers and recommend next steps to a reviewer rather than to close cases on its own.

A named chief compliance officer is quoted describing the assistant as informing his review of watchlist alerts rather than replacing it. The logging and policy binding claims give an auditor something to inspect.

The architecture helps more than the documentation does. Because customers author the rules and can compare and swap underlying providers, a large part of the decision logic is transparent to the institution by construction, and provider level performance comparison is a marketed feature.

What is missing is the vendor side package a model risk function needs under the Federal Reserve and Comptroller guidance on model risk management: no model documentation, no validation summary, no stated position on supporting customer validation of the proprietary scoring and agentic components.

The strongest evidence surface in this cohort. Outcomes are published per named institution rather than as aggregate marketing: 90 percent of account openings automated and an 88 percent reduction in application review time at IncredibleBank, a 35 percent fall in fraud losses at Suncoast Credit Union, 74 percent at Skyla, 27 percent year on year at Live Oak Bank, 58 percent fewer manual reviews at Grasshopper, 80 percent of openings automated at Brex, a 75 percent gain in fraud detection efficiency at Ramp, and decisioning under five minutes at Coast.

Client count is stated at more than 900 with logos including Navy Federal, Ally and M&T. Named executives are quoted by title. Third party recognition includes a Datos Insights Impact Award and the Deloitte Technology Fast 500. The measurements remain customer reported through the vendor, which is the normal ceiling for this category.

Alloy states that every agentic step is logged, explainable and tied to the customer's own policies, and describes its compliance automation as fully auditable, which is a meaningful stewardship commitment at the operational layer. The unanswered question sits one level up.

The platform is marketed as getting smarter with every signal and every decision across the client base, and nothing public says whether one institution's data contributes to models serving another, whether customers can opt out, or what the training data boundary is.

The standard artefacts are present and public: a privacy policy, terms of service, a California do not sell control and a modern slavery statement. The gap is architectural. Consumer identity data is routed through more than 270 third party providers under customer authored workflows, which makes permissible purpose, subprocessor disclosure and downstream retention the central privacy question for this vendor specifically, and no public document sets out how those flows are governed or which provider holds what.

A dedicated security page is published and linked from the primary navigation, with certification seals presented in the site footer under an enterprise grade security heading. That is a disclosed and navigable security posture, ahead of vendors that respond only to questionnaires.

The seals render as images rather than as a readable framework list with dates and scope, so the specific attestations in force and their audit periods cannot be confirmed from the public site, which is what holds this below the top grade.

Alloy is a technology vendor holding no banking or money transmission licence, which is the correct posture here. The platform reaches unusually far into regulated workflow, covering perpetual customer and business due diligence, sanctions and watchlist screening, and suspicious activity and currency transaction report filing. Sitting inside the filing path raises the stakes on accuracy, and the material is clear that the underlying obligation stays with the institution. The regulatory position is stated plainly, which is what this axis measures for a software vendor.

This is the sharpest gap in an otherwise well documented vendor. Alloy sells credit decisioning, pre qualification and line management, which places its models squarely inside Equal Credit Opportunity Act and Regulation B territory, where adverse action reasons must be specific and disparate impact is a live supervisory concern. Nothing public offers fair lending testing, demographic performance analysis, adverse action reason code documentation or a bias audit. The explainability claim covers audit logging of workflow steps, which is a different thing from model level fairness evidence and should not be read as satisfying it.

Integration breadth is the product. More than 270 partner solutions are individually documented on their own pages, spanning the credit bureaus, sanctions and screening providers, document and biometric vendors, business registry data and payment networks, and several are direct competitors of one another, which is what makes the swap without reintegration claim credible. Delivery is through one API and one dashboard with a public developer hub and help centre. Channel coverage extends to branch and call centre alongside digital, so the same controls apply to in person applications.

Delivery is cloud hosted software as a service. A separate United Kingdom presence is maintained with its own site, which indicates some European delivery footprint, but nothing public identifies hosting regions, in country residency options, data transfer mechanisms or the locations of the subprocessors that the data partner ecosystem necessarily involves. For a platform whose core function is moving consumer data between providers, that omission carries more weight than it would for a self contained product.

Pricing is demo gated with no published rates, tiers or minimums. The orchestration model compounds the problem in a way that is specific to this architecture: the platform fee sits on top of per call charges owed to whichever of the 270 plus data providers a customer routes through, so a buyer cannot estimate total cost of ownership from public materials even approximately. Independent reviewers make the same observation.

Coverage is documented segment by segment with distinct material for banks, credit unions, fintechs, sponsor banks and crypto. Credit unions get unusual depth, with dedicated best practice content and four named credit union case studies, which matters because most vendors in this category treat them as an afterthought. Payment rail coverage is enumerated rather than implied, spanning peer to peer, automated clearing house, real time payments and FedNow, wire, card and stablecoin. Onboarding is broken out by consumer, small business, commercial and merchant.