Fingerprint
Fingerprint sells device identification as a developer primitive rather than as a fraud decision. Its commercial product, Fingerprint Identification, combines browser and mobile signals with server augmented matching to produce a visitor identifier the company states is 99.5 percent accurate and stable across months rather than days, delivered through an API with software development kits for web, Android, iOS, React Native and Flutter. Smart Signals sit alongside the identifier, covering bot detection, virtual private network detection and internet protocol geolocation.
The company also publishes FingerprintJS, a source available browser library carrying more than 28,000 stars on its public repository, which the company itself notes is materially less accurate than the paid server augmented product. Because the identifier is a primitive, it is sold horizontally, and only the financial uses are covered here: payment fraud covering fraudulent orders, unauthorized transactions, card testing and chargeback evidence, promotion and multi accounting abuse, loan application validation against previously rejected submissions, and account takeover.
Personalization, paywall enforcement, content metering, persistent shopping carts and analytics are sold from the same identifier and are left out. Its pricing is public: a three tier rate card with a free plan, a $99 monthly plan including 20,000 web and iOS requests plus 500,000 Android requests, overage at $4 per thousand, a 14 day unlimited trial, and a precise definition of what constitutes a billable request. Assurance runs through a trust center carrying a SOC 2 Type 2 report, ISO 27001 certification with its Statement of Applicability, a penetration test report and a full policy set. Named customers include Neiman Marcus, Uni Cards and Zebeede.
Capability Axes
Capability grades
15 of 15 axes rated · 11 graded A or B
The vendor says its free browser library identifies visitors at a materially lower rate than the paid server augmented service, so the accuracy gap is the model and the product. An identifier that survives cookie clearing, incognito browsing and virtual private networks for months cannot come from lookup alone.
The service returns an identifier and discrete signals for bots, virtual private networks and geolocation, and the customer's own code makes every decision. Nothing states the confidence attached to an identifier or how a borderline match should be treated.
Identification accuracy is stated at 99.5 percent with stability over months, a specific claim on the core capability. No methodology, population or measurement period supports the figure, though customers can validate identifiers against their own outcomes.
Named product managers at Uni Cards and Zebeede are quoted publicly, and a Canadian fintech reports roughly 70 percent of logins no longer needing a multi factor challenge. Marketplace reviews average 4.7 out of 5, but no request volume, customer count or fraud prevented figure is published.
Zero Trust mode resists requests impersonating another visitor, and a customer configurable filter limits which properties may call the service. Whether a device identified at one customer informs identification at another, the difference between a per customer tool and a global tracking graph, is never stated.
Separate data processing addenda for European and Californian law allocate the controller, processor and service provider roles explicitly, and a deletion process is documented. Published guidance separates legal bases by use case, telling customers that fraud prevention rests on legitimate interest while personalization likely needs consent.
A trust center publishes SOC 2 Type 2 and ISO 27001 with the Statement of Applicability, the scope document defining which controls the certificate covers. A penetration test report, nine governance policies and a four hour recovery time objective sit alongside it.
Privately held, the company claims no financial license, supervisory relationship or regulator counterparty. A software directory lists it as supporting payment card and second Payment Services Directive compliance, but its own material makes neither claim.
Shared, refurbished and older devices are harder to tell apart and skew toward lower income users, and a device wrongly matched inherits another visitor's fraud history. No false positive rate, coverage breakdown by device or fairness testing is published, nor any account of how collisions are detected or corrected.
The company will not bill requests generated during a denial of service attack and will waive charges if a malicious surge gets through, though identification quality carries no guarantee. A person whose device is matched to another's history has no appeal at the vendor, only the deletion route through the customer as controller.
The client side collection library is published as source with more than 28,000 repository stars, so an engineer can read exactly what is gathered from a browser. Server augmented matching, where the accuracy advantage comes from, discloses no data, models or external sources.
Client kits ship for web, Android and iOS among others, and edge integrations at Cloudflare, Akamai and Fastly let identification run through the customer's own first party origin. Segment and Google Tag Manager connectors and public developer documentation complete a catalog aimed at engineers rather than fraud analysts.
Data sits in Amazon Web Services data centers, named openly, but no region, country of processing or transfer mechanism is stated. No private or single tenant deployment of the commercial service appears, despite customers on four continents.
A free plan, Pro Plus at $99 a month for 20,000 web and iOS requests, overage at $4 per thousand and a 14 day unlimited trial make up a full rate card. A request bills only when it identifies a device and returns an event identifier, and cached responses never bill, which defines the unit precisely.
Dedicated material covers fintech, banking and buy now pay later fraud, and pricing spans a single developer on the free tier to contracts above nine million requests a year. The buyer is a developer adopting per use case rather than a fraud function, with no sales into banking operations or insurance evident.
Alternatives to Fingerprint
Vendors in the same categories as Fingerprint whose profiles look most alike, each with a line on what the product does. Similar is not the same: check that each one does the job you need. No vendor pays for placement.
Ravelin Technology is a London fraud prevention and payments company founded in 2015 by Martin Sweeney and Leonard Austin, who built it after encountering the problem as merchants at the…
SHIELD, trading as SHIELD AI Technologies Pte Ltd and formerly CashShield, is a Singapore headquartered device intelligence company founded by Justin Lie with roots going back to 2008.
Signifyd sells commerce protection for ecommerce under a financial guarantee, and it sells to two buyer types rather than one.
Coris supplies merchant risk infrastructure to the parties that underwrite merchants rather than to merchants themselves, covering software platforms with embedded payments, independent…
SEON combines fraud prevention and anti money laundering compliance in one platform, built around enriching a thin signup input such as an email address, phone number or address into a wide…
Sift, formerly Sift Science, sells fraud decisioning to business to consumer digital companies.
The index publishes no overall score or ranking. See what we assess and the methodology.
Pricing
Vendor-published figures are labeled as such. Figures labeled “Estimated” are derived from third-party sources and have not been confirmed by the vendor.
| Entry Price | Pricing Basis | Data Protection Terms | Implementation | Source |
|---|---|---|---|---|
|
Free plan at zero cost, Pro Plus at $99 per month including 20,000 web and iOS identification requests plus 500,000 Android requests, overage at $4 per 1,000 requests, Enterprise by contract. A 14 day trial with unlimited calls is offered.
$0 baseline
|
Per identification API request, billed monthly, across three published tiers. Free covers a small monthly allowance for evaluation. Pro Plus at $99 a month includes 20,000 web and iOS requests together with 500,000 Android requests, an asymmetry the company states explicitly rather than burying, with overage at $4 per thousand. Self serve tiers scale by monthly request volume to approximately one million a month, above which an enterprise contract is required, and custom pricing applies from around nine million annual requests. The billable unit is defined tightly: only a request that successfully identifies a device and returns an event identifier is charged, unsuccessful requests are free, and cache served lookups that never reach the backend are not billed, so a customer's caching strategy directly determines their bill. Smart Signals are included at Pro Plus and above rather than metered separately. The company commits to 30 days notice before any change to the billing model. | Two separate data processing addenda are published, one under the General Data Protection Regulation and one under the California Consumer Privacy Act, with roles allocated explicitly under each: customer as controller and Fingerprint as processor in the European case, customer as business and Fingerprint as service provider in the Californian one. A data deletion obligation on controller request is documented, and retention is addressed in published support material. Assurance sits in a trust center carrying the SOC 2 Type 2 report, the ISO 27001 certificate and its Statement of Applicability, a penetration test report, a network diagram, a Cloud Security Alliance self assessment and nine governance policy documents. No supervisory authority is named and the subprocessor list sits behind the trust center access request rather than in public. | None published and none apparent. Integration is self serve through package registries, with client software development kits for web, Android, iOS, React Native and Flutter installed by a single command, and no setup, onboarding or professional services fee appears anywhere. A developer can reach production without contacting the company at all, and one published customer account describes implementing during a live card testing attack and blocking traffic within six hours. Edge integrations at Cloudflare, Akamai, Fastly, CloudFront and Azure are available for first party serving and carry no stated additional charge from this vendor, though the customer's own edge provider costs apply. Smart Signals covering bot detection, virtual private network detection and geolocation are gated to the paid tiers rather than sold as separate add ons. | Vendor Published |
The rate card is public, and the most useful part is the definition around the number. A request is billable only when it successfully identifies a device and returns an event identifier. Requests that fail to produce one are not billed, and requests served from the application cache never reach the backend and are not billed at all.
That means a buyer can calculate cost from their own architecture rather than from a sales conversation, and the company publishes guidance on estimating volume from page views on signup, login and pre payment pages. Three overbilling protections are published: denial of service traffic is not billed, a web application firewall filters abusive bot requests before billing, and a customer configurable filter can reject requests from unknown sources at the header level.
The company states it is willing to waive charges if a surge gets through all three. An unrelated company at a similar domain sells a people search product under the same name with a completely different rate card, so a quoted Fingerprint price may belong to that product rather than to device identification.