JUDI.AI

The removal test leaves a loan application form. A proprietary categorisation engine and risk detection logic read raw bank transaction data and turn it into a creditworthiness assessment, and both are described as the product of more than 10 million banking transactions analysed and over a billion dollars of small business applications evaluated, so the models are the accumulated asset rather than a layer on top of one.

The same engine drives automated underwriting, continuous monitoring of a borrower's financial health after funds are advanced, and portfolio level reporting. Cash flow underwriting on live transaction data has no rules based equivalent.

Configuration to the institution's own credit policy is the control, and it is stated as a deployment property rather than an option, with each implementation tailored to that lender's unique policies inside eight weeks. That keeps the standard applied the accountable institution's own.

The chief executive frames the proposition the same way, saying the company is not selling a platform but championing a methodology, and that success blends people, process, technology and intentional growth, with people named first. What is absent is anything at decision time: no referral threshold, no manual review path for marginal applications, and no confidence indication accompanying an automated decision.

The headline performance claim is stated in the form a credit risk function would want, holding default rate constant while measuring the change in approvals, which is a materially more disciplined claim than the approval speed or cost reduction figures most vendors in this lane publish. Behind it sits a decade of performance data and ten million analysed transactions, so the models have observed outcomes across a full credit cycle including a pandemic.

What is not published is any of the underlying evidence: no accuracy, discrimination statistic, backtest result or validation documentation appears, and the same default rate claim is asserted rather than shown by cohort.

More than 35 community lenders use the platform and seven are named, spanning a 4.3 billion dollar federal credit union with 240,000 members and 21 branches, two further credit unions at 1.1 billion and 722 million in assets, a large Canadian credit union whose community business vice president is quoted, a regional credit union quoted separately in trade press, a Seattle bank and a Hawaiian federal credit union.

Volume is stated at more than two billion dollars in loan applications processed against ten million banking transactions analysed, with a decade of performance data behind the models. A 2026 round drew investment from a credit union backed venture firm and from a community credit union directly, which is the fifth instance recorded in two days of customers funding their own supplier.

Pooling is stated openly as the source of the engine's quality, with the categorisation logic and risk detection attributed directly to ten million transactions and a billion dollars of applications evaluated across the customer base. That is the Upstart position, disclosed as a strength rather than concealed, and the institutions concerned include credit unions competing for the same small business members in overlapping regional markets. Nothing states whether a lender can decline to contribute its application and performance data, what is aggregated, or how a departing customer's contribution is treated.

No data protection agreement, retention schedule, subprocessor list or deletion commitment was located. The payload is live bank transaction data for small businesses, categorised at line level, and monitoring continues after a loan is advanced, so the platform holds an ongoing view of a borrower's finances rather than a snapshot taken at application.

Nothing published states how long that record persists, what happens to the data of a declined applicant, or how it is handled across the Canadian and United States privacy regimes the company operates under simultaneously.

No attestation, certification, trust centre or enumerated framework was located. More than 35 community lenders including a 4.3 billion dollar institution have completed vendor due diligence on this platform, so the assessments exist and have been passed repeatedly, and none of the resulting assurance is published. For a company whose growth depends on credit unions recommending it to one another, publishing that control set would remove the slowest step in every new sale.

No supervisor, statute or rule is named. That omission is becoming consequential in this specific market, because small business lending in the United States is moving from a lightly documented activity to a reported one, with data collection requirements designed to expose disparities in who receives credit and on what terms, and equal credit opportunity obligations including adverse action notice already applying to business applicants. A platform automating those decisions for dozens of community lenders sits directly in the path of that regime and does not address it.

One published claim is an unusually good form of inclusion evidence and deserves credit: approval rates rise by 20 percent at the same default rate. Holding the risk metric constant while moving the volume metric is the correct way to demonstrate a credit model improvement, because it means the system found creditworthy borrowers the previous method rejected rather than simply accepting more risk.

The company frames the problem accordingly, that between 40 and 50 percent of small businesses rank access to capital as their top challenge. What is missing is who those additional approvals went to. No analysis across borrower demographics, geographies or business types is published, no fair lending testing is described, and continuous post drawdown monitoring means a business's standing can deteriorate on signals it never sees.

No guarantee, indemnity or falsifiable accuracy commitment was located. The lending institution remains the decision maker and the regulated party, and because deployments are configured to its own policies it can reconstruct which policy produced an outcome, which supports internal accountability.

The small business applicant has nothing described: no statement of what a declined borrower is told, no route to correct a miscategorised transaction that depressed a cash flow assessment, and no notice mechanism where continuous monitoring downgrades an existing borrower.

Input categories are named clearly, covering real time bank transaction data alongside conventional credit scores and financial statements, and the categorisation engine and risk detection logic are stated to be proprietary and built in house from the company's own accumulated data, which shortens the chain at the decisive point.

No individual provider is identified anywhere: no bank data aggregator supplying the transaction feeds, no credit bureau, no model provider and no hosting arrangement, and the aggregator in particular determines what the underwriting can actually see.

The platform is built to supplement rather than displace, explicitly adding automated analysis of live banking data to the traditional sources an institution already uses in credit scores and financial statements, which is the posture that lets a conservative lender adopt it.

The company also addresses the integration question publicly and unusually honestly, confirming it can integrate with an institution's existing loan origination system while arguing that doing so may not be the optimal approach, which is a vendor arguing against the easier sale. What is not published is any named system on either side, with no origination platform, core banking system or bank data aggregator identified.

The platform is described as cloud based and no hosting provider, region selection or residency commitment was located. The question is live rather than theoretical here because the company operates on both sides of the Canada and United States border with customers in each, and financial institution data location is treated differently in the two jurisdictions, so a Canadian credit union will ask where its members' transaction data rests.

No pricing, packaging or basis of charge is published. Implementation effort is stated concretely at eight weeks or less with configuration to the institution's own policies, and the value case is quantified as three times the application volume with no additional staff, which tells a buyer what adoption costs in time and what it returns in capacity. Neither says what the platform costs, and nothing indicates whether charge falls per application, per institution, on origination volume or as a subscription.

Coverage is deliberately narrow and the narrowness is the strategy. This serves community based financial institutions, credit unions and community banks, in Canada and the United States, for small business lending specifically, and the company argues explicitly that those institutions can and should lead this market rather than cede it to fintech lenders.

Within that segment the range is genuine, from a credit union with 55,000 members to one with a quarter of a million, and the product spans origination, underwriting, post drawdown monitoring and portfolio reporting rather than one step. The limit is that this is one buyer type and one loan category in two countries.