Sardine

Device intelligence and behavior biometrics are fused into every signal, across a network the homepage puts at 6.5 billion devices profiled. Social engineering pressure and behavioral drift toward laundering cannot be written as rules, so removal would take the differentiating signal with it.

Through its Agentic Oversight Framework, Sardine's credit decisions can run in copilot or autonomous mode, with people calibrating them over time. Teams set their own decision trees, thresholds and review paths, and payment decisions can be set by rail, amount and counterparty. AML agents clear obvious false positives, such as name mismatches and flipped birth date formats, and pass the rest to an analyst with a recommended disposition and its rationale. A person makes the call on filing a SAR. Decision paths, overrides and policy changes land in an audit trail. Default thresholds and any sampling of agent output are not published.

Every underwriting decision logs rule triggers, model outputs, overrides and supporting evidence, and returns reason codes. Policy changes can be backtested, run in shadow mode or A/B tested before release, and rule analytics show risk distribution, trends and anomalies once live. Sardine calls its Agentic Oversight Framework a reference implementation of SR 11-7, but that mapping sits in a playbook rather than in product documentation. Model documentation, a validation summary and error rates are not published.

Prezzee, a digital gift card company, reports more than 90% higher approvals while card fraud fell. That result comes from outside financial services. A US neobank that took down a laundering network and a Canadian bank that stopped bot driven account takeovers are described without names. Customer logos run from FIS and National Bank of Canada to Nubank and Kalshi, and the efficiency figures on the agent pages name no customer.

The privacy policy says de identified data used to improve accuracy will not be reidentified. Sonar, the consortium behind Sardine's shared signals, states that all data is anonymized, and members feed back their risk decisions for a 25% revenue share. Whether one customer's data trains models that serve others, and what Google Cloud retains from its language model services, are not stated.

Transacting users met inside a client's flow are covered, with keystroke, mouse and touch collection described and a US consumer privacy notice in the Gramm Leach Bliley Act format. A public subprocessor list names eight parties with their purpose and location. Retention has no fixed period in the privacy policy. A data retention and disposal policy is released only on request, and enterprise customer data is left to contracts.

Sardine's trust center, run on Vanta, lists a completed SOC 2 Type 2 examination announced in September 2025 and a PCI DSS v4.0.1 SAQ A self assessment dated March 2026. Five 2025 penetration test reports cover the API, the dashboard and the mobile apps, among other surfaces. Every report is released on request. The SOC 2 audit period and auditor are not shown, and no ISO 27001 certification is listed.

Agents for due diligence, screening, transaction monitoring and SAR drafting map onto AML obligations, and credit underwriting brings lending rules into scope. Consortium data is shared under GLBA, Section 314(b) of the USA PATRIOT Act and the FCRA. An affiliate, SardineAI Payments, Inc., is named without its purpose, and no filing path appears.

Credit underwriting for consumers and businesses sits inside Equal Credit Opportunity Act duties. Behavior biometrics infer risk from interaction patterns that vary with age, motor impairment and assistive technology use. The credit product promises reason codes, yet fair lending testing, adverse action documentation and demographic error analysis are all unpublished.

Reason codes, investigation tooling and audit trails let an institution examine a result. No accuracy guarantee, remediation term or error rate is published. Consumer rights cover personal data, not a route to revisit a decline or credit denial driven by a device or behavioral profile.

Sardine's public subprocessor list names Google Cloud Platform for storage, infrastructure and large language model services, hosted in the United States and the European Union. Experian for identity and card verification and Plaid for bank account validation are also listed, beside tools for analytics, support, billing and sign in. FullStory session replay appears in the privacy policy. The email, phone and crypto partners behind enrichment are described only by category, and no Google model is named.

Signals arrive behind one API as a score, model features or raw data, with public documentation at docs.sardine.ai and a status page. Payments are scored inline before settlement across rails from ACH and SEPA to RTP and FedNow. Sardine Flow links data sources, agents and human review in one workflow without code, and agents can be called over the A2A protocol. No core banking or outside case management system is named.

The subprocessor list places Google Cloud and Elastic Cloud in the United States and the European Union. The privacy policy still allows personal information to be processed anywhere in the world under the Data Privacy Framework and standard contractual clauses. No region choice, residency commitment or on premises option is described for device, behavioral and open banking data.

One dashboard, one contract and one API replace separately negotiated fraud, screening and monitoring tools, which addresses cost stacking without sizing anything. Every path ends in a demo.

Banking, wealth management and payments each have an industry page, and sponsor banks get a product page of their own. The banking page reaches from Tier 1 institutions to community banks, credit unions and mutuals. Customers run from FIS, Coastal and LHV to Nubank and Kalshi. Insurance and capital markets are not addressed.