SHIELD

The removal test is unusually clean because the product is an inference and nothing else. SHIELD Device ID exists to identify a physical device across sessions, applications and browsers, and the company states it does so with over 99.9 percent accuracy even after advanced manipulation.

That qualifier is the point: a fingerprint that survives deliberate spoofing, emulation, application cloning and virtual private network use cannot be a lookup against stored attributes, because the attributes are exactly what the adversary is changing. It has to be learned inference over a signal space.

Around it sit continuous session profiling, detection of emulators, tampering and location spoofing, and behavioural analysis of interactions as subtle as device orientation and swipe speed. The company brands the engine SHIELD AI, incorporates as SHIELD AI Technologies, and operates a Global Intelligence Network spanning a stated seven billion devices and 500 million accounts. Strip the models and there is no device identity, no session profile and no product, because unlike the guarantee sellers in this lane there is no underwriting business underneath to fall back on.

The architecture puts the decision with the customer and, unusually, the company says so in a binding document rather than a marketing page. The privacy policy states that SHIELD generates an automated risk score and that it is the merchant's own discretion to follow it and make an automated decision, citing Article 22 of the General Data Protection Regulation. So the vendor never refuses anyone; it supplies intelligence and the customer's own system acts.

Supporting that, more than 30 configurable risk thresholds across application and web let a customer set their own tolerances rather than accept vendor defaults, and the commitment that all generated data belongs to the customer means the signals behind any given verdict can be inspected after the fact. What is absent is specification of the defaults.

Nothing published describes what the thresholds are set to before a customer tunes them, what a given signal contributes to a risk verdict, or how a customer is notified when signal behaviour changes underneath their configuration. A customer holds the controls without being told where they start.

A specific, falsifiable accuracy claim on the core capability, plus an architecture that lets a customer test it. The company states SHIELD Device ID identifies devices across application and web with over 99.9 percent accuracy even after advanced manipulation, and the adversarial qualifier is what makes the claim meaningful rather than decorative, since it names the condition under which device fingerprints normally fail.

More usefully for a model risk function, the commitment that all generated data belongs to the customer means the raw signals behind every verdict can be logged and validated against the customer's own realised outcomes over time, which is a stronger position than receiving only a score and far stronger than receiving only a verdict. More than 30 configurable thresholds make the operating point explicit and adjustable. What is missing is the documentation.

No methodology, population or measurement period accompanies the 99.9 percent figure, no false positive rate is published anywhere, and no validation report, model documentation or monitoring statement was located.

The named customer set is the strongest asset here and it reaches markets no other vendor in this lane touches. Alibaba, Razer, inDrive, Swiggy, Meesho, TrueMoney, BEAT and Buymed span Chinese ecommerce, gaming hardware, ride hailing across emerging markets, Indian commerce and Southeast Asian payments, and several appear with attributed testimonials rather than as bare logos.

Scale is stated at more than seven billion devices and 500 million user accounts protected, and headcount is around 254 as of May 2026. One quantified outcome exists, a study with inDrive reporting 1,377 percent return on investment, which is a vendor commissioned figure and is treated as such. Two things hold this below the top grade.

Beyond that single study there are no quantified customer results, no fraud prevented figure, no false positive reduction and no approval rate movement, which the strongest records in this lane supply for several named customers each. And the funding record shows a Series B in June 2018 with nothing since, against reported totals that themselves disagree across sources at roughly 25.6 million and 31.7 million dollars, so eight years have passed without an external valuation event.

Two published commitments here are better than the lane norm and they are separate from the privacy documentation. The first is data ownership: the company states that all data generated by the platform belongs to the customer, who may log it, inspect it, or feed it into their own models.

A signal vendor that hands over its output rather than retaining it as leverage has given up the usual lock in, and it also means a customer can audit what was produced about their users rather than taking a score on trust. The second is the permissions position: the company states it runs with a customer's existing user permissions, so deploying it does not require asking end users to grant anything new, which limits the expansion of consent that adding a fraud layer normally causes.

Against both sits the unexamined question that runs through this whole lane. The Global Intelligence Network pools device observations across a stated seven billion devices and every customer, so a device seen at one application informs the risk verdict at another, and nothing published states whether a customer can decline to contribute, how one customer's observations are separated from another's, or what the retained device record contains.

One genuinely distinguished disclosure sits inside an otherwise ordinary document. The privacy policy addresses automated decision making by naming Article 22 of the General Data Protection Regulation directly and allocating the roles under it: the merchant is the data controller, SHIELD generates an automated risk score, and it is the merchant's own discretion whether to act on that score.

Almost nothing else in this lane engages the specific provision governing solely automated decisions about individuals, and doing so tells a buyer exactly where the obligation sits before they sign. Sections covering data sharing, data retention and transfer to third countries exist, and data subjects in the European Economic Area are given cookie controls at the point of collection. Beyond that the position is thin. No data processing addendum was located, only a privacy policy.

No supervisory authority is named. No retention period is stated in what was retrievable. No regime other than the General Data Protection Regulation is engaged, despite the company's centre of gravity being Southeast Asia and India, where Singapore, Indonesia and India all now have their own data protection statutes and none is mentioned.

Two dedicated passes located no certification, attestation, trust centre, penetration test summary or enumerated control framework held by this company. What exists is inherited rather than held: the privacy policy commits that any subprocessor must treat data to the same standards as SHIELD and comply with data protection requirements, names Amazon Web Services as the storage subprocessor, and directs the reader to that provider's compliance certifications.

Pointing at an infrastructure provider's certificates is a real disclosure about where the assurance comes from and it is not assurance about this vendor's own controls, which is what the axis asks for. Pre emptive negative finding, and an unusually important one here: searching for this vendor's security posture is actively hazardous because at least six unrelated companies trade under the name Shield, several of which do hold SOC 2 Type II and ISO 27001 and publish detailed security pages. A certification found under that name must be confirmed against the correct legal entity, SHIELD AI Technologies Pte Ltd, before it is credited to this record.

A Singapore incorporated private company holding no financial licence, with no supervisory relationship, named regulator counterparty or regulatory approval located. The most specific regulatory engagement on the record is the treatment of Article 22 of the General Data Protection Regulation in the privacy policy, which is credited on the privacy and autonomy axes where its substance sits.

No payment card industry certification appears, which is consistent with the product not touching cardholder data directly. No named regulator appears as a customer or partner, no scheme membership or industry body affiliation was located, and the company makes no compliance claim against any Southeast Asian or Indian regulatory regime despite operating substantially in both. Nothing here counts against a technology supplier that is not expected to hold a licence, and nothing lifts the record above the floor either.

A dedicated AI Information page exists in the site footer, which suggests the company has published something on this subject, and its contents were not retrievable in this session, so nothing in it is credited here. What was retrievable does not amount to governance. No error rate, false positive rate, confidence measure or calibration statement is published for any signal. No fairness testing, disparate impact analysis or coverage statement exists.

The exposure specific to this product is worth naming: device fingerprinting has a known and well documented tendency to misclassify shared, refurbished, rooted and older hardware, which correlates with lower income users and with particular markets, and this company operates heavily in exactly those markets across Southeast Asia and India. A device wrongly identified as manipulated does not get an explanation, and nothing published describes how such an error is detected or corrected. Nothing states who approves a model change or what validation a new signal passes before it starts affecting verdicts.

There is no guarantee and structurally there could not be one, because this vendor never makes the decision that causes a loss. No accuracy commitment, indemnity, service level or falsifiable performance promise attaching to the signals was located, and the 99.9 percent device identification figure is a marketing claim rather than a contractual term. What lifts this above the floor is a disclosure that most vendors leave unstated.

By citing Article 22 of the General Data Protection Regulation and allocating the roles explicitly, the company tells both the merchant and, in a public document, the affected individual that the merchant is the data controller and the merchant makes the decision. That means an individual's rights under that article, including obtaining human intervention and contesting an automated decision, run against a named and reachable party rather than disappearing into a vendor chain.

It is a signpost rather than a remedy. SHIELD itself offers the affected person nothing: no notification, no visibility of the signals that flagged their device, no appeal and no correction path for a device wrongly assessed as manipulated.

One subprocessor is named and, more unusually, the customer is given a say over future ones. The privacy policy identifies Amazon Web Services as the subprocessor engaged for data storage and points to that provider's own privacy terms and compliance certifications, so a buyer can trace where their data physically rests and assess the operator independently.

Beyond the naming, the policy states that SHIELD may appoint a subprocessor only with the approval of merchants, and that any subprocessor must handle data to the same standards and comply with data protection requirements including the General Data Protection Regulation. An approval right over supply chain changes is a governance control rather than a disclosure, and no other vendor graded in this lane offers one. What is not disclosed is the intelligence chain.

No third party data source, device intelligence provider, telemetry supplier or model provider is named for any component, and the Global Intelligence Network is described as a shared asset without any statement of what feeds it beyond the customer base itself.

Developer first and unusually wide across runtime environments, narrow across business systems. Modular development kits ship for web, Android, iOS and React Native, server side integration is supported, alerts stream over an API into a unified dashboard, and the company states integration takes minutes rather than weeks with no additional code required.

A Unity plugin extends the reach into game clients and is described as the first fraud prevention product published on that asset store, which is a genuine distribution surface rather than a claim. Availability through the Amazon Web Services marketplace gives enterprise buyers a procurement path against existing cloud commitments.

The design intent is explicitly to feed other systems, with the company positioning the output as enriching a customer's existing risk models and data engines rather than replacing them. What is absent is any connector to the business systems a fraud team actually operates: no commerce platform, payment gateway, case management or identity platform integration is named anywhere, which is the layer that separates the strongest records in this lane from this one.

Hosted software consumed through embedded development kits and an API, with no private, single tenant or on premise option located. One residency relevant fact is published and it is more than most in this lane manage: the privacy policy names Amazon Web Services as the subprocessor engaged for data storage and directs readers to that provider's own compliance certifications, so the infrastructure operator is identified rather than left implicit.

That naming is credited on the supply chain axis. What it does not supply is a residency position. No region, availability zone, data centre or country of processing is stated, no region selection is offered to customers, and while the privacy policy contains a section headed transfer of data to third countries its terms were not retrievable.

The gap matters for a company whose customers concentrate in Southeast Asia and India, where several jurisdictions now impose localisation or transfer conditions, and whose European customers need a stated mechanism rather than an inference.

Nothing is published across two dedicated passes. No rate, tier, unit of sale, free tier or trial appears on the vendor's own surface. The Amazon Web Services marketplace listing, which is the one channel where a published price would normally be forced, is configured as a private offer routing to a sales address rather than carrying any figure. A major software marketplace records explicitly that the vendor has not provided pricing information.

There is no stated metering basis either, so a buyer cannot tell whether this is priced per device, per session, per active user, per API call or as a platform fee. One genuine commercial commitment does exist and is worth recording even though it is not a price: the company states that all data the platform generates belongs to the customer, to log, inspect or use in their own models.

That removes the lock in that usually accompanies a signal provider, since a customer leaving keeps the intelligence already produced, and it is a more meaningful commercial term than most vendors in this lane disclose. It is still not a price.

The broadest sector and geographic reach in this lane, and it comes from selling a component rather than a decision. Because SHIELD supplies device signals rather than an order verdict, the buyer is any digital business with an application, and the named customer set reflects that: ride hailing through inDrive and BEAT, gaming through Razer and the Unity ecosystem, marketplaces and ecommerce through Alibaba, Swiggy and Meesho, payments through TrueMoney, and healthcare supply through Buymed.

Product lines extend past fraud prevention into network security, credit intelligence and identity verification. Geographic depth is genuine rather than asserted, with offices across Singapore, Jakarta, Bengaluru, Beijing, Berlin, London, San Francisco and Miami, giving Southeast Asian and Indian coverage that no competitor here demonstrates. What holds this below the top grade is that the buyer remains a consumer facing digital business.

There is no evidence of sales into banking operations, insurance, capital markets or regulatory supervision, and the credit intelligence and identity lines are named without any customer evidence behind them.