Ravelin

Three model classes carry the product: machine learning trained on each merchant's own history, graph link analysis exposing fraud rings in real time, and behavioral analysis across the shopper journey. Without them only an anonymized cross merchant lookup table would remain, which the company treats as one signal rather than the proposition.

Machine learning is paired with customer configured rules set to the merchant's own risk appetite, and Insights lets a fraud team probe anomalies and build reports with an AI query builder. With no chargeback guarantee the merchant holds both decision and loss, and defaults before configuration are unpublished.

The company explains why per merchant models beat generic ones and publishes its reasoning for choosing machine learning over rules from its own testing. No accuracy, precision or false positive figure is published for any model, not even a headline claim, so a reviewer learns how the system is built and nothing of how well it works.

A 2025 year in review reports more than 3.5 billion transactions secured, 755.2 million unique shoppers and over $61.5 billion in orders, enough to size the platform without asking. Worldpay's February 2025 acquisition is externally attested, but no merchant is named and no outcome is attributed to an identified customer.

Modeling is per merchant, so one customer's models are not built from another's transactions, while a separate cross merchant lookup flags whether a shopper was seen elsewhere and is stated to be fully anonymized. Whether a merchant can opt out of that lookup, what anonymized means when it must still recognize a returning person, and how long records persist are undocumented.

A Data Protection Officer is reachable by dedicated email and London postal address, a European Union representative is published, and the company names itself a data controller. It cites the GDPR, the Data Protection Act 2018 and the ePrivacy Directive specifically, but no processing addendum, subprocessor list or retention schedule appears.

ISO 27001:2022 is certified by the British Assessment Bureau, PCI Data Security Standard certification is held, and the Visa Global Registry of Service Providers lets a buyer confirm card certification independently. No SOC report, Statement of Applicability or trust center offers obtainable artifacts.

Card industry 3DS certification covers the 3DS Server, Access Control Server and Directory Server functions, defined roles that put the company inside the authentication rail. Rightly for a supplier, no financial license is claimed, and its 3D Secure material cites local rules and card network requirements without naming the authentication directive.

The cross merchant lookup carries a prior fraud association into a decision at a merchant that never saw the shopper, and nothing describes how such an association is reviewed, aged out or corrected. No false positive rate, fairness test or model change approval is published, and per merchant training's possible limit on imported bias is never argued or tested.

Scoring sits with the platform and deciding with the merchant, so chargeback liability stays with the customer and no accuracy commitment is published. Because the cross merchant record is anonymized, a shopper flagged elsewhere has no practical way to access or correct it, so the privacy design also removes the route to fix an error.

Ekata and Ethoca, both Mastercard businesses, are named as identity and dispute intelligence partners, so a buyer can check them against its own supply chain. Custom models train on the merchant's own history, but no subprocessor list, cloud provider or model provider is identified.

Operating 3DS components lets the platform use data card networks return through that flow to sharpen its own decisions, a two way integration rather than a single call. Transaction optimization sits in the payment path and developer guides address payment service providers, but no commerce platform or gateway catalog lets a merchant check support before contact.

The platform is cloud hosted, and sustainability material confirms third party hosting without naming the provider. For a United Kingdom company serving shoppers worldwide, which publishes a European Union representative for exactly these questions, no processing location or transfer mechanism is stated.

Rate, tier, trial and even the metering unit are all withheld, so a buyer cannot tell whether charges follow transactions, order value, modules or a subscription. The silence stands out against how much else the company publishes, from transaction counts to certification bodies and data partners.

Merchants and payment service providers are both served, with more than 340 merchants accepting payments from customers in over 250 countries and territories. Coverage reaches past checkout into refund and promotion abuse, account takeover and marketplace supplier collusion, with distribution now through its acquirer's payments network.