Q2 Holdings
Q2 Holdings sells the digital engagement layer that banks, credit unions, alternative finance companies and fintechs put in front of their customers, spanning retail, small business and commercial banking on a single platform. That single platform claim is the commercial thesis rather than an architecture note, because running consumer and commercial banking on one system gives the company behavioral signal across both, which it uses to argue a data advantage in detecting account takeover.
The company describes its position as a system of context, capturing real time digital signals across logins, transactions, alerts, messages and user decisions at the engagement layer, while also operating at the execution layer where workflows run and transactions complete. AI is concentrated in three stated areas: banker efficiency, fraud prevention and personalization.
Three named AI products arrived during 2026. Q2 Code, announced 16 April 2026, is a governed development environment that turns natural language prompts into extensions compliant with the company's software development kit. It is built for teams working through Q2 Innovation Studio, and the company states openly that it is built with Anthropic's Claude Code running on Amazon Bedrock. Q2 Assistant, launched 2 June 2026, is a unified conversational layer embedded across the product portfolio. It connects to product specific agents that execute tasks, beginning with a Customer Care Agent inside Digital Banking, and is stated to run under the same data isolation, audit logging and compliance controls the platform applies elsewhere. It serves institution staff rather than account holders, acts only within the roles and permissions an institution defines, leaves consequential actions for staff to approve, and never uses institution data to train models across the platform. A separate account takeover product using behavioral signals reported double digit early adopters in its first quarters.
Security controls run deep. The company publishes a SOC 2 Type II report covering security and confidentiality for its software platform, and describes a dedicated enterprise security, risk and compliance function with several external reviews each year. Its cybersecurity mesh architecture lets one tool inform the others, alongside zero trust and behavioral anomaly detection. A data protection capability fragments payment card data across a private blockchain network. Its platform migration moved online banking stacks for more than 450 financial institutions onto Amazon Web Services.
Scale is reported under securities law. Second quarter 2026 revenue was $219.8 million, up 13 percent. Subscription annualized recurring revenue was $826 million and total annualized recurring revenue $971 million, with backlog of $2.8 billion up 17 percent. The balance sheet is debt free after repaying convertible notes. More than 1,200 financial institutions run on the platform, reaching more than 27 million digital banking users, with average customer contract length above ten years and initial commitments averaging more than five. Q2 has built digital banking for banks and credit unions for more than 21 years. The company is listed on the New York Stock Exchange and headquartered in Austin, Texas.
Capability Axes
Capability grades
15 of 15 axes rated · 8 graded A or B
Strip the models out and the engagement platform serving more than 1,200 institutions keeps running, which is what customers buy. AI is applied to banker efficiency, fraud prevention and personalization, three improvements to that platform rather than its basis.
What counts as a consequential action is not defined. Within that limit, Q2 Assistant does not make autonomous decisions: it answers questions, guides staff through workflows and executes tasks through product agents, while staff review and approve consequential actions. Agents act only within the roles and permissions the institution defines, and every agent interaction is logged for compliance monitoring, supervisor review and investigation.
Speed figures exist for the Customer Care Agent, which delivered 6 to 720 times performance gains and cut execution times by 83 to 99.9 percent in tracked workflows, while accuracy, resolution and escalation rates are left out. The account takeover product competes on behavioral signal, a claim a published false positive rate would test, and none appears.
Securities filings make scale examined rather than asserted, with second quarter 2026 revenue of $219.8 million up 13 percent and a $2.8 billion backlog up 17 percent. Adoption of the account takeover product is reported candidly as double digit early adopters, and no accuracy or outcome figure is published for any model.
How long conversation content is kept and what reaches an external model provider are not stated, but the pooling answer is plain: institution data is encrypted and isolated, never shared with other customers and never used to train models across the platform. That boundary covers Q2 Assistant and its agents, the layer that reaches customer records.
A data processing agreement, retention schedule and subprocessor list are not published, and the control assessment covers security and confidentiality while leaving out the privacy criterion that governs collection, use and retention of personal information. An information security program covers the sensitive financial information Q2 receives, under a data governance roadmap begun in 2021, and card data is fragmented across a private blockchain network rather than held centrally.
A SOC 2 Type II report tests operating effectiveness over a period, and zero trust controls and a mesh architecture that shares threat detection across tools are published in detail. Availability, a headline commitment, sits outside that audit scope, and the maturity level claim against a federal framework is self assessed.
Examination support, regulator facing documentation and a position on the AI guidance from United States banking supervisors are not published. Supplying software to licensed banks rather than holding a license itself, the company frames its posture around its customers' examinations, and its information security program is built to comply with federal law.
Account takeover detection learns behavioral baselines that vary with how people bank, so false positives may fall unevenly across customers. Personalization infers circumstances from transaction data given for another purpose, and no fairness testing or model card covers either product.
An allocation of liability between vendor and institution, and any service commitment covering model errors, are not published. Fraud intervention happens as the event unfolds, and a blocked account holder gets no notice that a model acted and no route to the vendor, though every Q2 Assistant interaction is logged for supervisor review and investigation.
The development environment's launch headline names Anthropic's Claude Code running through Amazon Bedrock, letting a buyer diligence that supplier and see where inference occurs. The conversational agents, fraud models and personalization carry no provider, model family or version, and no change notification is promised.
Retail, small business and commercial banking run on one platform above the core banking ledger, extended through a published software development kit and a partner ecosystem. Since April 2026 a generative development environment, Q2 Code, produces kit compliant extensions, turning a partner integration from a services engagement into a build task.
Online banking stacks for more than 450 institutions moved to a named public cloud, and the completed migration shows in a 480 basis point gross margin improvement. Regions, processing location and any contractable residency commitment are unpublished.
Filings show the shape of the relationship rather than its cost: contracts average more than ten years, with initial commitments above five. Management says the 2026 AI products reach revenue faster than core installs, which implies separate terms without confirming whether they are included or licensed apart.
Buyers run from community credit unions through regional and enterprise banks, and past deposit takers to alternative finance companies and fintechs. A merger of two regional banks onto commercial digital banking shows enterprise reach, though the base is predominantly United States.
Compared With
Most editorial comparisons pair two vendors the index assesses as direct competitors for the same buyer. Some pair vendors that are adjacent rather than rival, where the useful question is where one ends and the other begins. Each carries a verdict, the buyer conditions that favor each vendor, and a graded side by side.
Alternatives to Q2 Holdings
Vendors in the same categories as Q2 Holdings whose profiles look most alike, each with a line on what the product does. Similar is not the same: check that each one does the job you need. No vendor pays for placement.
ebankIT sells an omnichannel digital banking platform to banks and credit unions, running web, mobile and branch channels for retail, small business and commercial customers on one stack.
Narmi sells a digital banking platform to community banks and credit unions, founded by two people who had run a community financial institution as its chief executive and technology chief.
Backbase sells an engagement platform that sits above a bank's existing core, payments, cards, risk and customer relationship systems rather than replacing them.
Agent IQ sells Lynq, a digital relationship banking platform for community banks and credit unions in the United States and Canada.
Revio Insight shows community and regional banks and credit unions where their customers are banking elsewhere and where deposits are leaving.
Candescent sells digital banking software to more than 1,300 US banks and credit unions, whose platforms serve over 30 million registered users.
The index publishes no overall score or ranking. See what we assess and the methodology.
Pricing
Vendor-published figures are labeled as such. Figures labeled “Estimated” are derived from third-party sources and have not been confirmed by the vendor.
| Entry Price | Pricing Basis | Data Protection Terms | Implementation | Source |
|---|---|---|---|---|
|
Not published. No price, unit of billing or tier appears on any vendor surface, though securities filings disclose average contract length above ten years and initial commitments averaging more than five
|
Not published at unit level, and securities reporting shows the model is multi year subscription with the majority of revenue recurring, since subscription annualized recurring revenue of $826 million sits inside a total of $971 million with the balance in services and other lines. Nothing published indicates the unit inside that subscription, whether charging follows registered users, active users, accounts, assets, institution size or module selection. The platform spans retail, small business and commercial banking with separate fraud, treasury, relationship pricing and account opening capabilities, and no packaging or module pricing is described for any of them. | No tiered data protection terms are published. Platform level assurance is real and its scope is stated: a SOC 2 Type II report covering security and confidentiality for the software platform, a dedicated enterprise security, risk and compliance function, and several external reviews each year. The privacy criterion sits outside that scope, so the report does not address collection, use, retention or disclosure of personal information. No data processing agreement, retention schedule or subprocessor list is published to cover it. The AI commitments appear in announcements rather than in terms: the conversational layer and its agents operate under data isolation and audit logging. Whether institution or account holder data is used to train or improve any model is not stated. | No implementation or professional services fee is published, and the company reports professional services as a distinct revenue line, so the function is material and separately charged without being priced publicly. Management describes discretionary professional services revenue as under ongoing pressure, which tells a buyer that this line is negotiable and currently a soft market. Implementation duration is characterized rather than committed: digital banking implementations are described by management as complex, against which the newer fraud and assistant products are said to reach revenue materially faster than core platform installs. Independent market commentary places cloud native engagement platforms at three to six months to a first production journey, which is an outsider's figure rather than a vendor commitment. The development environment cuts a different cost, with extension delivery claimed to move from weeks to days, and that claim carries no baseline or measurement basis. | Regulatory Filing |
No price, unit or tier is published for the platform or for any AI product, and third party coverage adds none. Securities reporting is informative about the shape of the commitment even without a figure. Subscription annualized recurring revenue of $826 million is reported separately from a total of $971 million, and backlog is $2.8 billion. Average customer contract length is above ten years, initial commitments average more than five years, and gross margin is roughly 59 percent.
Together they describe a decade scale architectural decision sold on multi year subscription, not a product trial. Two commercial questions remain open. Whether the 2026 AI products are bundled or separately licensed is unstated, and management's remark that they reach revenue materially faster than core platform installs implies separate terms without confirming them.