Serene

The removal test leaves the reactive position the company exists to correct, where difficulty is noticed once arrears or complaints arrive. Behavioural models read transactional data for signals the firm's existing systems cannot see, described as rooted in mental health, life events and behavioural patterns, then predictive modelling forecasts how a customer's circumstances are likely to develop, and a recommendation engine converts that into specific interventions. Detecting distress before it surfaces, and forecasting its direction, is achievable no other way.

The platform recommends rather than acts, generating intervention strategies the institution chooses to apply, and the company describes translating insight into auditable targeted support, which puts an evidence trail around every judgement the system makes. Severity assessment is explicit, so cases are ranked rather than treated identically, which is how a support team with finite capacity actually works.

Held at B because no threshold, escalation route or human review requirement is described, and because the most consequential question, whether a person is ever told a system has classified them as vulnerable, is not addressed.

No accuracy, precision, recall or validation figure was located for detection or for the vulnerability trajectory forecasts, and both error directions carry real cost. A false positive attaches a vulnerability inference to someone who is not in difficulty, potentially affecting how they are treated and what they are offered. A false negative means the person the system exists to find is missed, and the firm may now believe it has coverage it does not have. Nothing describes how models are validated, how often they are reassessed, or how an institution tests performance on its own customers.

A major United Kingdom banking group holds a minority investment and describes deploying the platform to detect early signs of financial distress and offer personalised support, with its innovation director quoted publicly, which is unusually strong validation because the same institution is both investor and user. The company came through that bank's accelerator in 2023 and was selected from its fintech showcase.

It demonstrated at a leading European industry conference in 2026 and exhibits at another. Against that, around two million pounds raised, one named institution, and no published outcome figures for detection or intervention effectiveness.

No boundary statement was located. Behavioural models of this kind improve by observing which signals preceded difficulty across large populations, and the platform is distributed through financial institutions and partner platforms, so the question of whether patterns learned at one firm inform scoring at another is direct and unanswered. Nothing states whether vulnerability inferences persist, whether they follow a customer between products, or what a client contributes by participating.

No data protection agreement, retention schedule, subprocessor list or consent framework was located, and this is the most sensitive data holding in the index. The platform infers mental health difficulties, life shocks, bereavement, illness and scam victimisation from spending patterns, producing conclusions about a person's circumstances that the person has not disclosed and may not have told anyone.

Under United Kingdom and European rules health inferences attract special category protection, and nothing published addresses lawful basis, retention, whether an inference is recorded on the customer's file, or who inside the institution can see it.

No attestation, certification, trust centre or enumerated framework was located. A major banking group has taken an equity position and deployed the platform, which implies its security assessment was passed, and for a company processing inferred health and distress data on retail customers a published control set is the disclosure other institutions would need before their own assessment could begin.

The product is built on the regulator's own taxonomy rather than alongside it, segmenting customers against the four published drivers of vulnerability covering health, life events, financial resilience and capability, which means its output maps directly onto what a supervisor asks a firm to evidence.

It targets the Consumer Duty obligation specifically, under which firms must ensure customers in vulnerable circumstances receive outcomes at least as good as everyone else, and auditability is designed in so that evidencing is a by product rather than a separate exercise. Few vendors anywhere in this index align to a named regulatory framework this precisely.

The purpose is the case, and it addresses a documented failure rather than an asserted one: regulatory research across 700 firms and 1,500 customers found 58 percent of vulnerable customers do not disclose their circumstances, and that 44 percent had negative experiences against 33 percent of customers generally, while support given to those who did disclose largely worked. Detection, not provision, is the binding constraint, and this attacks detection.

Responsible artificial intelligence is claimed. Held at B because the dual use risk is unaddressed and severe: a list of customers identified as vulnerable is also a list of people least able to resist, and the regulator has warned specifically against pricing that exploits disengagement, inertia or vulnerability. Nothing published describes what prevents the output being used for targeting rather than support, and no fairness testing appears.

No guarantee, indemnity or correction process was located, and the gap matters more here than almost anywhere else in this index because the subject is the person being assessed. Someone whose spending is read as indicating mental health difficulty, a relationship breakdown or scam exposure is not stated to be told, cannot see the inference, has no described route to correct or contest it, and no stated ability to decline the analysis.

The regulatory research the company itself relies on found people are uncomfortable discussing these circumstances with financial firms, which makes an unseen inference about them a particularly sensitive artefact.

Inputs are described as the institution's own transactional and financial data interpreted through behavioural science, which places the dependency inside the customer relationship rather than on external data purchases and removes the usual provenance question.

What is not disclosed is any model provider, hosting arrangement, subprocessor list, or the research basis for the behavioural models themselves, which for a product making health adjacent inferences would be the substantiation a clinical or ethics reviewer would ask for.

The platform is described as a behavioural compute layer sitting on top of financial data, which conveys the architecture without naming what it connects to. No core banking, collections, customer relationship or communications system is identified, and no developer documentation was located. Distribution through financial institutions and partner platforms implies integration work exists, and none of its shape is published.

No hosting provider, region selection, residency commitment or private deployment option was located. Given the platform derives health and life event inferences about identifiable retail customers, and that a regulated bank would treat such inferences as among its most sensitive holdings, where processing occurs and whether it can run inside the institution's own environment are questions a buyer would raise immediately.

No pricing, packaging or basis of charge was located. Routes to market are described with more precision than most, covering direct business sales, distribution through financial institutions and other platforms, and licensing, which tells a buyer how it can be bought without indicating what it costs or whether the three products are sold separately.

Buyers span banks, lenders and fintechs, with credit unions and community banks identified as a specific fit, which matters because smaller institutions have the least capacity to build vulnerability detection themselves while serving populations where it is most needed. Functional reach runs the whole relationship from onboarding through to collections rather than sitting at one stage. The constraint is jurisdictional: the product is built around one country's regulatory framework, and while the underlying need is universal the taxonomy that structures it is not.