Heka

Matching sits at the core. Models take fragments from the open web, contact data, public records and breach datasets, decide which belong to the same person and test whether they agree over time, and every output Heka sells, from the fraud score to the pension trace and the underwriting finding, is built on that step. Heka positions this against static bureau and registry data, which changes far more slowly than people's lives.

Heka supplies evidence and the institution decides. Each identity gets a 0 to 100 risk score with the individual signals behind it, every signal tied to its source, so an analyst can see why an application scored high and where the score thresholds should sit.

Underwriting findings go further: each carries a severity, a verification status that counts its independent sources, a reason code and the supporting records, and lands in one of three outcomes, a material finding, a relevant finding sent for human review, or clear to proceed.

In the payment processor evaluation every decision stayed with the processor's own team, and in pension work family mapping gives trustees an evidence base for an entitlement review while the decision stays with them.

Each evaluation comes with its method. In the card issuer test, Heka scored historical applications before seeing any outcome and reported results at matched operating points: 30 percent more fraud at the same false positive rate, or false positives down from 5.7 to 3.5 percent at the same detection rate.

In the payment processor test, accounts Heka rated high risk despite a low internal warning proved fraudulent in 69.7 percent of cases, and accounts it rated low risk despite a moderate warning proved legitimate in 66.1 percent.

The models themselves, their training data and their versions are not described, but a lender backtest shows loss rates across the score range, 7 to 17 percent for applicants scored below 60 and 70 percent for those scored 90 to 100, which is the curve a validator needs to set a cutoff. Heka notes that retrospective results can differ in live production.

Zedra Governance piloted Heka's tracing, found half of the pension members its schemes had been unable to reach, and then agreed to offer Heka to its clients. Trustees of the Merchant Navy Ratings Pension Fund (MNRPF) and at Dalriada describe members found after other tracing had failed, including victims of pension fraud.

Fraud results come from customers Heka does not name, each measured against the controls they already ran: a digital lender's backtest found 48 percent more fraud, worth $1.3 million in prevented losses and a 4.82 times return, a card issuer cut false positives from 5.7 to 3.5 percent at the same detection rate, and a payments platform cut thin file reviews by 90 percent.

Whether one client's queries train models used for other clients is not stated. On data handling, Heka says it works only with publicly available information, never reaches into private, login gated or credentialed sources, deletes personal data automatically after processing and returns or destroys client data on request. Its fraud score also checks whether an applicant's email, phone or credentials sit in darknet and breach data, a source that fits awkwardly with that public web description.

Heka's published privacy terms cover its pension tracing service, not the fraud score US lenders run on applicants, and they do not address the Gramm Leach Bliley Act. For tracing, a platform privacy notice speaks to the people being traced: Heka acts as processor for the scheme, names its sources, keeps data up to 30 days after an engagement unless the client sets another period, moves it abroad under standard contractual clauses or adequacy decisions, and routes access, correction and objection requests to the scheme, with representatives appointed in the EU and the UK.

Heka holds ISO 27001 certification, cited against the 2013 version of the standard in its platform privacy notice, and describes itself as SOC 2 certified without giving the report type, period or auditor. The controls it lists are concrete: web application firewalls, two factor authentication, infrastructure as code with automated checks and approval workflows, role based access on a zero trust model, centralized key management, cloud security posture monitoring and independent penetration testing. A data processing agreement is available from its data protection officer.

Heka sells software and data, holds no license of its own and has not set out how the Fair Credit Reporting Act applies when lenders use its score on credit applications. Pension tracing runs under European and UK data protection law, with the Information Commissioner's Office named for complaints and representatives appointed in the EU and the UK. In October 2026 Heka joined the American Fintech Council, an industry body, to contribute to its work on responsible fintech innovation and AI driven fraud prevention.

A thin file is not a sign of fraud in itself, Heka says, and it sells its score as a way to clear legitimate newcomers to a country or to credit instead of sending them to review alongside fabricated identities. That claim is not backed by published results by age, population group or credit history, and Heka describes no governance process for its models. Explainability does the protective work instead: every signal is tied to its source, and the institution makes the decision.

Recourse runs through traceability rather than any commitment. Heka publishes no warranty, indemnity or service terms for its scores, and an applicant declined on a score they never saw has no described way to contest it. What it does offer is evidence: every signal and finding carries its source, so a client can check a result before acting on it, and a person traced for a pension scheme can ask the scheme to correct, delete or stop using their data.

The fraud score keeps its breach and darknet sources, its enrichment vendors and the model that resolves identities unnamed. Pension tracing is more open: it names the UK electoral register, Pipl for social media data, Google, Funeral Notices and The Times among its suppliers, consolidates probate filings, death registrations and online obituaries to confirm deaths, and runs on AWS.

The API reference is not public, and no ready connector to a core banking, loan origination, decisioning or pension administration system is named. Heka plugs in beside the existing fraud stack through an API, a batch file or an analyst workflow, and banks and insurers can trial it in a sandbox on NayaOne's fintech marketplace before connecting anything.

All data sits on AWS in the EU, in Ireland, encrypted at rest and in transit, so a US lender's applicant data is held in the EU, and a US hosting region or dedicated deployment is not described. Heka may also store or access data in the UK, the United States and Israel, with standard contractual clauses or adequacy decisions covering each transfer.

Every engagement is priced through a demo and a quote, for the fraud score, pension tracing and underwriting findings alike. Whether a fraud check is charged per application or by volume, and whether a trace is charged per member or per project, is settled in that quote rather than on a price list.

Three buyer groups run on one engine. Digital consumer lenders, digital banks, card issuers, fintechs and payment platforms buy the fraud score, and the 2025 funding round was raised to grow that business in the United States. Pension trustees, administrators, insurers and annuity providers buy tracing and membership screening in the UK, where Heka reports more than 40 scheme projects, and insurers and credit issuers buy the underwriting findings. Members traced from a single scheme's file turned out to live in 61 countries.