NoFraud

The published review rate settles this and it is worth stating precisely because the marketing sounds like the analyst heavy competitor in this lane. NoFraud describes AI plus expert analysts, but it also discloses that fewer than half a percent of orders are held for analyst scrutiny, with everything else returned as a pass or fail decision in milliseconds.

The analyst team is therefore sized for an exception tail rather than for the volume, which is the opposite of the vendor here that routes every flagged order to a person and staffs more than two thousand reviewers to do it. Strip the models from NoFraud and there is no decision path for the other ninety nine and a half percent, and no human capacity anywhere close to absorbing it.

The signal set is named rather than gestured at, covering merchant specific data, persona tracking, global blocklists, device fingerprinting, geolocation and velocity detection, and machine learning is claimed explicitly alongside custom rules. Persona tracking and device fingerprinting at this latency imply learned identity resolution rather than lookup.

Three distinct oversight mechanisms are published and one of them is unique in this lane. Merchants can write custom rules and overrides governing what happens to flagged orders, which the company positions directly against competitors that do not permit rule customisation, so the buyer holds real configuration authority rather than accepting vendor defaults. Manual analyst review catches the ambiguous tail, disclosed at fewer than half a percent of orders.

And Cardholder Verification brings the affected consumer into the decision: for a limited set of high risk orders an analyst contacts the cardholder to confirm legitimacy before the order is refused. Every other vendor in this lane decides about the shopper without ever involving them, and this one asks.

Against that, the overwhelming majority of decisions are fully automated at millisecond latency with no human involvement, the output is a binary pass or fail rather than a graduated risk signal, and no specification is published for review turnaround, analyst authority, verification criteria or how often a human overturns the model.

The signal inventory is named more openly than most and the performance is not measured at all. On disclosure, the company identifies the categories feeding its decision engine as merchant specific data, persona tracking, global blocklists, device fingerprints, geolocation and velocity detection, which lets a reviewer reason about what kind of inference sits behind a refusal, and it publishes its manual review rate at under half a percent along with millisecond decision latency.

On performance there is nothing. No accuracy figure, precision or recall measure, false positive rate, validation report, model documentation or monitoring statement was located, and unlike the analyst heavy competitor in this lane there is no contractual accuracy service level either. The two published customer outcomes describe revenue and chargeback movement at individual merchants rather than model performance, and carry no baseline, population or methodology. A reviewer here can see what goes in and has no way to assess what comes out.

Two named customer results carry real figures: Obvi reporting a 1.6 percent revenue lift with fraud chargebacks down 70 percent, and Caraway halving fraud while gaining 68,000 dollars in monthly revenue. Independent review evidence is unusually good for a vendor this size and sits on a platform the vendor does not control, with 127 reviews on the Shopify application marketplace averaging 4.8 out of 5 and 91 percent of them at five stars, alongside G2 recognition as a Leader and for Best Results and Best Usability.

One operational figure is published that most competitors withhold entirely: fewer than half a percent of orders held for manual review, which tells a buyer how much friction the service actually introduces. What is absent is scale and standing.

No transaction volume, customer count, order count or geographic footprint is stated anywhere, the two named customers are direct to consumer brands rather than enterprises, the company is privately held with no financial disclosure, and no analyst house ranking or third party market position was located.

The network question applies as it does everywhere in this lane, and one element here is more intrusive than anything its competitors do. On the network, the named signal set includes global blocklists and persona tracking alongside merchant specific data, which necessarily means shopper reputation is carried across merchants, and nothing published states whether a merchant can decline to contribute, how one merchant's data is separated from another's, or what a retained persona record contains.

On the more specific point, Cardholder Verification involves an analyst telephoning or otherwise contacting the cardholder to confirm a transaction. That is a fraud vendor initiating direct contact with a merchant's customer using contact details supplied for a purchase, and while it is plainly done to help the shopper, nothing published describes consent, script, identification, call retention, opt out, or how the shopper is meant to distinguish that call from the social engineering attack it structurally resembles.

The general data protection statement is more useful than most at this size and the rest is thin. The company states it has made significant efforts to ensure compliance with the General Data Protection Regulation for itself and its vendors, and that merchants subject to that regulation can contact support for the necessary paperwork, which acknowledges the subprocessor chain exists and that executable terms are available, without publishing either.

No processing addendum, subprocessor list, retention schedule or named supervisory authority was located. The about page carries a reference to a transatlantic transfer framework administered by the United States Department of Commerce with the European Commission and the Swiss Administration, without naming which framework, giving a certification date or stating status, and a buyer cannot tell whether the current arrangement or its invalidated predecessor is meant.

One exposure is specific to this vendor and undocumented: Cardholder Verification has analysts contact consumers directly to confirm orders, so the platform holds and uses shopper contact details for outbound contact, and nothing published governs that.

Two dedicated passes located no certification, attestation, trust centre, penetration test summary or enumerated control framework. What the about page carries are references to standards bodies rather than claims of standing under them: the Payment Card Industry Security Standards Council is described as a global forum for developing account data protection standards, and a transatlantic data transfer arrangement is described as a mechanism designed by the United States Department of Commerce with the European Commission and the Swiss Administration.

Both are descriptions of what an organisation or framework is, with no verb attaching the company to either, no compliance level, no attestation, no assessor and no date. That is the badge without a claim, which is exactly what the credential test exists to catch, and it is a step below the peers in this lane that at least assert compliance in their own voice. No SOC report of any type was located. Pre emptive negative finding: displaying the same two logos more prominently will not move this grade. A stated compliance level with an attestation of compliance, or any SOC report, is what would.

Privately held, holding no financial licence, with no supervisory relationship, named regulator counterparty or regulatory approval located. Compliance is claimed against one named regime, the General Data Protection Regulation, with paperwork offered on request, which is the most concrete regulatory statement on the record.

Beyond it the references are to standards bodies rather than to obligations: the about page cites the Payment Card Industry Security Standards Council and a transatlantic data transfer framework, in both cases describing what the body or arrangement is rather than asserting the company's status under it. Screening card not present transactions across the major card networks and wallet providers places the product inside scheme rules without conferring any regulated standing. Nothing here counts against a technology supplier, which is not expected to hold a licence, and nothing lifts the record either.

One genuinely useful operational disclosure and no governance behind it. Publishing that fewer than half a percent of orders are held for review is a real number about how the system behaves, and very few vendors in this lane disclose their own friction rate at all. It is not an error rate. No false positive rate, false negative rate, accuracy figure, confidence measure or calibration statement is published for any model.

No fairness testing, disparate impact analysis or coverage statement exists, which matters because the output is a binary pass or fail with no middle ground, so a systematically mis scored population is refused outright rather than routed to friction. Nothing describes who approves a model change, what validation a new model passes, or how a merchant is told when scoring behaviour shifts. The custom rules layer gives a merchant visibility into their own overrides while telling them nothing about the model those overrides sit on top of.

The guarantee is optional rather than bundled, and its scope is published and limited in a way competitors tend to leave vague. The company covers the full cost of a chargeback on any order it passed, and states plainly that this covers chargebacks arising from unauthorised or fraudulent card use and expressly does not cover non fraud disputes such as item not received or item not as described.

Publishing the exclusion is the notable part: a merchant learns the boundary of the protection before buying rather than at the moment of a claim, and the non fraud disputes that fall outside it are handled by a separate Chargeback Management service alongside dispute representment.

For the affected consumer this record is better than anything else in this lane, because Cardholder Verification means a shopper on a high risk order may be contacted and given the chance to confirm the purchase before it is refused, which is participation rather than notification. It remains partial.

Verification applies to a limited set of orders only, a shopper refused without it is still not told and has no appeal, and no accuracy commitment or service level attaches to correcting a wrong decision.

Categories are named and suppliers are not. The company identifies what kinds of data feed its decisions, listing merchant specific data, persona tracking, global blocklists, device fingerprints, geolocation and velocity detection, which is more than several competitors offer and still stops at the level above the one that matters.

Global blocklists belong to someone, device fingerprinting is a technology usually licensed rather than built, and geolocation resolution is almost always bought, yet no provider is named for any of them. No subprocessor list is published, no cloud infrastructure provider is identified, and no model or foundation model provider is stated for any component.

The one acknowledgement that a chain exists comes in the privacy answer, where the company says it has worked on data protection compliance for itself and its vendors, confirming there are vendors without saying who they are. Naming the blocklist and device intelligence sources would be the single most useful addition here.

Narrow in platform count and unusually deep inside the one ecosystem that matters to its customers. Native paths are named for Shopify, BigCommerce, WooCommerce and Adobe Commerce, with a direct API integration for everything else, and the Shopify application is stated to install in under five minutes.

The depth is in the surrounding ecosystem rather than the platform list: the application is documented as working with Shopify Checkout, Shopify Flow, Shopify Admin, Shop Pay and PayPal, and notably with the subscription infrastructure merchants at this size actually run, including Recharge, Yotpo Subscriptions, Skio and Stay AI.

Subscription commerce is a distinct fraud problem because a single approved order generates recurring charges, and integrating with those systems specifically is a meaningful capability rather than a logo. Payment method coverage spans cards, PayPal, Apple Pay, Alipay and Amazon Pay. What is missing is the payment gateway and acquirer connector layer that lets a guarantee reconcile against the processor, which the stronger records in this lane publish and this one does not.

Hosted software consumed through a platform application or a direct API, with no private, single tenant or on premise option located. The company is stated to be based in the United States on its marketplace listing and nothing further about processing location is published: no cloud provider, region, data centre or country of processing is named, no region selection is offered, and no residency commitment appears.

A transfer framework is referenced on the about page without being named or dated, which is the closest the record comes to a residency position and does not amount to one. The gap has teeth for any merchant selling into Europe, because the company states it has worked on compliance with the General Data Protection Regulation and offers paperwork on request, yet the buyer cannot complete their own transfer assessment without knowing where the data goes or which mechanism covers it.

The strongest position in this lane for the segment it serves, and it is strong because it is testable rather than merely readable. A merchant can install the product, screen up to 100 orders a month, and run it in production indefinitely without paying anything or speaking to a salesperson, with a 14 day trial beginning at the first screened order.

Around that free plan the company publishes no setup fees, charging only on orders it approves, starter plans that include chargeback protection, and the explicit revenue threshold of 50,000 dollars a month above which pricing becomes custom. That is the metering basis, the entry point, the segment boundary and the risk allocation, all available before contact. Two things hold it below the top grade.

The rate itself is never published on the vendor's own surface and routes to a form, with a third party reporting 1 to 1.5 percent of revenue that could not be confirmed. And the free plan excludes manual review and the guarantee, which are the two capabilities the paid tiers exist to deliver, so what is free is the screening engine rather than the service.

One buyer type and a deliberately narrow band within it. The customer is the online merchant, and the company positions explicitly at the small and mid sized end, describing starter plans for even the smallest businesses and setting its custom pricing threshold at 50,000 dollars of monthly revenue, which is a small merchant by the standards of every other vendor in this lane.

Distribution reinforces the narrowness: the centre of gravity is the Shopify ecosystem, with named paths for BigCommerce, WooCommerce and Adobe Commerce and a direct API for everything else. Payment method coverage is genuinely broad, spanning cards, PayPal, Apple Pay, Alipay and Amazon Pay across card not present orders. What is absent is everything beyond that.

No verticals are enumerated, no geographic footprint or country count is stated, no enterprise tier is described beyond custom pricing, and there is no second buyer type: this vendor does not sell to payment providers, banks, insurers or regulators.