Incandor

Unsupervised behavioral clustering is the product: mouse dynamics, keystroke timing and device orientation place each session on a map where one person forms one cluster whatever account is used. Needing no fraud labels or history, it works from the first session, unlike supervised fraud scoring.

The behavioral map is exposed as a programmable interface rather than a risk score, so the bank's fraud team writes the investigation logic and keeps judgment by construction. Automatic blocking of banned operators at onboarding runs the other way, with no described review of that exclusion.

Because output is a navigable map, an investigator can see why sessions cluster and follow an operator across accounts instead of accepting a number. The above 99 percent account takeover accuracy claim has no methodology, sample or false positive rate, the figure that matters when results can block accounts.

The company is onboarding early customers, names none, and is a 2026 accelerator cohort member at pre seed stage. An independent assessment notes the founders are described only by university affiliation, with no verifiable work history.

Blocking a banned operator on return implies identities that persist beyond any account or credential. Whether behavioral clusters stay inside one customer or an operator identified at one bank is recognizable at another is never stated, and that decides how powerful and how dangerous the system is.

Collection is limited explicitly to behavioral signals, not what users type, read or view, with a stated rationale that behavior alone suffices to reconcile operators. No data protection agreement, retention schedule or subprocessor register covers the continuous session telemetry that remains.

An early company with no attestation, certification or trust center is normal, and it remains the barrier to a first bank deployment. The vendor asks for continuous session telemetry from every customer of a regulated institution.

Customer due diligence rules behind the identity pipelines it supplements are not engaged, and no regulator, statute or supervisory expectation is named. Continuous behavioral monitoring of bank customers raises consent and biometric data questions in several jurisdictions that nothing addresses.

Motor control, disability and device quality all shape mouse and typing signals, so a user with a tremor or a screen reader may cluster as anomalous for reasons unrelated to fraud. Inferring stress or coercion from physical behavior compounds that, and no differential performance testing is published.

Because the identifier is behavioral, a block at onboarding follows a person across accounts, devices and credentials. Someone wrongly clustered has no document to correct, no score to dispute and no described way to learn why they cannot open an account.

The signal comes from the company's own telemetry rather than licensed data, removing an external data dependency. The clustering approach is described only conceptually, with no model, provider or hosting named, so an institution cannot document what produces the identities it acts on.

A software development kit sends behavioral telemetry, after which the query interface goes live inside the institution's existing workflows beside its other signals. No fraud platform, case management or core system is named as a connection.

Every customer session's telemetry goes to the vendor for mapping, yet no hosting provider, region or self hosted option is published. Behavioral biometric data attracts specific handling rules in several places, which makes processing location a live question.

Delivery by software development kit and interface usually implies usage pricing, yet no price or basis of charge is published. Whether charges follow sessions, users or platform volume is unknown.

Commercial and consumer banks, fintechs and digital banks are named as targets, but the company is still soliciting introductions to them. No institution type, size or geography is evidenced as served.