SHIELD

The product is an inference and nothing else. SHIELD Device ID exists to identify a physical device across sessions, applications and browsers, and the company states it does so with over 99.9 percent accuracy even after advanced manipulation. That qualifier is the point. A fingerprint that survives deliberate spoofing and emulation, application cloning and VPN use cannot be a lookup against stored attributes, because the attributes are exactly what the adversary is changing.

It has to be learned inference over a signal space. Around it sit continuous session profiling, detection of emulators, tampering and location spoofing, and behavioral analysis of interactions as subtle as device orientation and swipe speed. The company brands the engine SHIELD AI, incorporates as SHIELD AI Technologies, and operates a Global Intelligence Network spanning a stated seven billion devices and 500 million accounts. Strip the models and there is no device identity, no session profile and no product. Unlike guarantee sellers, SHIELD has no underwriting business underneath to fall back on.

The decision sits with the customer, and the company says so in a binding document rather than a marketing page. The privacy policy states that SHIELD generates an automated risk score and that following it to make an automated decision is the merchant's own discretion, citing Article 22 of GDPR. So the vendor never refuses anyone. It supplies intelligence and the customer's own system acts.

More than 30 configurable risk thresholds across application and web let a customer set their own tolerances rather than accept vendor defaults. Because all generated data belongs to the customer, the signals behind any given verdict can be inspected after the fact. What is absent is a specification of the defaults.

Nothing published describes what the thresholds are set to before a customer tunes them, what a given signal contributes to a risk verdict, or how a customer is notified when signal behavior changes underneath their configuration.

The core capability carries a specific, falsifiable accuracy claim, and the architecture lets a customer test it. The company states SHIELD Device ID identifies devices across application and web with over 99.9 percent accuracy even after advanced manipulation. The adversarial qualifier makes the claim meaningful rather than decorative, since it names the condition under which device fingerprints normally fail.

More useful for a model risk function, all generated data belongs to the customer. The raw signals behind every verdict can be logged and validated against the customer's own realized outcomes over time, a stronger position than receiving only a score and far stronger than receiving only a verdict. More than 30 configurable thresholds make the operating point explicit and adjustable. The documentation is missing.

No methodology, population or measurement period accompanies the 99.9 percent figure, no false positive rate is published anywhere, and there is no public validation report, model documentation or monitoring statement.

Named customers are the strongest evidence, and they span very different markets. Alibaba, Razer, inDrive, Swiggy, Meesho, TrueMoney, BEAT and Buymed cover Chinese ecommerce, gaming hardware and ride hailing across emerging markets, along with Indian commerce and Southeast Asian payments. Several appear with attributed testimonials rather than as bare logos.

Scale is stated at more than seven billion devices and 500 million user accounts protected, and headcount is around 254 as of May 2026. One quantified outcome exists: a study with inDrive reporting 1,377 percent return on investment, which is a vendor commissioned figure. Two limits matter. Beyond that single study there are no quantified customer results, with no fraud prevented figure, no false positive reduction and no approval rate movement.

And the funding history shows a Series B in June 2018 with nothing since, against reported totals that disagree across sources at roughly $25.6 million and $31.7 million, so eight years have passed without an external valuation event.

Two published commitments stand apart from the privacy documentation. The first is data ownership: the company states that all data generated by the platform belongs to the customer, who may log it, inspect it, or feed it into their own models. A signal vendor that hands over its output rather than keeping it as leverage has given up the usual lock in. It also means a customer can audit what was produced about their users rather than taking a score on trust.

The second is permissions: the company states it runs with a customer's existing user permissions, so deploying it does not require asking end users to grant anything new. That limits the expansion of consent that adding a fraud layer normally causes. Against both sits an open question. The Global Intelligence Network pools device observations across a stated seven billion devices and every customer, so a device seen at one application informs the risk verdict at another. Nothing published states whether a customer can decline to contribute, how one customer's observations are kept apart from another's, or what is retained about each device.

The privacy policy names Article 22 of GDPR, the provision on solely automated decisions about individuals, and allocates the roles under it. The merchant is the data controller, SHIELD generates an automated risk score, and acting on that score is at the merchant's own discretion. That tells a buyer exactly where the obligation sits before they sign.

Sections covering data sharing, data retention and transfer to third countries exist, and data subjects in the European Economic Area get cookie controls at the point of collection. Beyond that the position is thin. There is no public data processing addendum, only a privacy policy. No supervisory authority is named and no retention period is stated. GDPR is the only regime engaged, though the company's center of gravity is Southeast Asia and India. Singapore, Indonesia and India all now have their own data protection statutes, and none is mentioned.

No certification, attestation, trust center, penetration test summary or enumerated control framework held by this company is public. What exists is inherited rather than held. The privacy policy commits any subprocessor to treating data to the same standards as SHIELD and to complying with data protection requirements. It names Amazon Web Services as the storage subprocessor and directs the reader to that provider's compliance certifications.

Pointing at an infrastructure provider's certificates is a real disclosure about where the assurance comes from. It is not assurance about this vendor's own controls. At least six unrelated companies trade under the name Shield. Several of them hold SOC 2 Type II and ISO 27001 and publish detailed security pages. A certification found under that name applies only if it belongs to the correct legal entity, SHIELD AI Technologies Pte Ltd.

SHIELD is a Singapore incorporated private company holding no financial license. No supervisory relationship, named regulator counterparty or regulatory approval is public. Its most specific regulatory engagement is the privacy policy's treatment of Article 22 of GDPR. No PCI DSS certification appears, which fits a product that does not touch cardholder data directly. No named regulator appears as a customer or partner, and there is no public scheme membership or industry body affiliation.

The company makes no compliance claim against any Southeast Asian or Indian regulatory regime despite operating substantially in both. None of this counts against a technology supplier that is not expected to hold a license.

A dedicated AI Information page sits in the site footer, but its contents could not be retrieved. Nothing else published amounts to governance. No error rate or false positive rate is published for any signal, and no confidence measure or calibration statement. There is no fairness testing, disparate impact analysis or coverage statement. This product carries a specific exposure.

Device fingerprinting has a known and well documented tendency to misclassify shared, refurbished, rooted and older hardware, which correlates with lower income users and with particular markets. This company operates heavily in exactly those markets across Southeast Asia and India. A device wrongly identified as manipulated gets no explanation, and nothing published describes how such an error is detected or corrected. Nothing states who approves a model change or what validation a new signal passes before it starts affecting verdicts.

There is no guarantee and structurally there could not be one, because this vendor never makes the decision that causes a loss. No accuracy commitment, indemnity, service level or falsifiable performance promise attaching to the signals is published, and the 99.9 percent device identification figure is a marketing claim rather than a contractual term. What SHIELD does publish is a clear allocation of roles.

By citing Article 22 of GDPR, the company tells both the merchant and, in a public document, the affected individual that the merchant is the data controller and makes the decision. An individual's rights under that article, including obtaining human intervention and contesting an automated decision, therefore run against a named and reachable party rather than disappearing into a vendor chain. It is a signpost rather than a remedy.

SHIELD itself offers the affected person nothing: no notification and no visibility of the signals that flagged their device. There is no appeal and no correction path for a device wrongly assessed as manipulated.

One subprocessor is named, and the customer gets a say over future ones. The privacy policy identifies Amazon Web Services as the subprocessor engaged for data storage and points to that provider's own privacy terms and compliance certifications. A buyer can trace where their data physically rests and assess the operator independently.

The policy also states that SHIELD may appoint a subprocessor only with the approval of merchants, and that any subprocessor is held to the same data handling standards and to data protection requirements including GDPR. An approval right over supply chain changes is a governance control rather than a disclosure. What is not disclosed is the intelligence chain. No third party data source, device intelligence provider, telemetry supplier or model provider is named for any component. The Global Intelligence Network is described as a shared asset with no statement of what feeds it beyond the customer base itself.

The design is developer first: wide across runtime environments, narrow across business systems. Modular development kits ship for web, Android, iOS and React Native, and server side integration is supported. Alerts stream over an API into a unified dashboard, and the company states integration takes minutes rather than weeks with no additional code required.

A Unity plugin extends the reach into game clients and is described as the first fraud prevention product published on that asset store, a real distribution surface rather than a claim. Availability through the Amazon Web Services marketplace gives enterprise buyers a procurement path against existing cloud commitments. The output is meant to feed other systems, and the company positions it as enriching a customer's existing risk models and data engines rather than replacing them. What is absent is any connector to the business systems a fraud team actually operates. No commerce platform, payment gateway, case management or identity platform integration is named anywhere.

SHIELD is hosted software consumed through embedded development kits and an API, with no private, single tenant or on premise option published. One residency relevant fact is public. The privacy policy names Amazon Web Services as the subprocessor engaged for data storage and directs readers to that provider's own compliance certifications, so the infrastructure operator is identified rather than left implicit. That is not a residency position.

No region, availability zone, data center or country of processing is stated, and customers are offered no region selection. The privacy policy has a section headed transfer of data to third countries, but its terms could not be retrieved. The gap matters because customers concentrate in Southeast Asia and India, where several jurisdictions now impose localization or transfer conditions, and European customers need a stated mechanism rather than an inference.

SHIELD publishes no rate, tier or unit of sale, and no free tier or trial. The Amazon Web Services marketplace listing, the one channel where a published price would normally be forced, is set up as a private offer routing to a sales address rather than carrying any figure. A major software marketplace states that the vendor has not provided pricing information.

There is no stated metering basis either, so the unit could be a device, a session or an active user, or an API call or a platform fee. One real commercial commitment does exist, though it is not a price: the company states that all data the platform generates belongs to the customer, to log, inspect or use in their own models. That removes the lock in that usually comes with a signal provider, since a customer who leaves keeps the intelligence already produced.

Sector and geographic reach are broad, and that comes from selling a component rather than a decision. Because SHIELD supplies device signals rather than an order verdict, the buyer is any digital business with an application. The named customers reflect that: ride hailing through inDrive and BEAT, gaming through Razer and the Unity ecosystem, and marketplaces and ecommerce through Alibaba, Swiggy and Meesho. Payments come through TrueMoney and healthcare supply through Buymed.

Product lines extend past fraud prevention into network security, credit intelligence and identity verification. Offices across Singapore, Jakarta, Bengaluru, Beijing, Berlin, London, San Francisco and Miami give real depth in Southeast Asia and India. The limit is that the buyer remains a consumer facing digital business.

There is no evidence of sales into banking operations, insurance, capital markets or regulatory supervision, and the credit intelligence and identity lines are named without any customer evidence behind them.