Sift

The score is the product. Sift returns a real time risk assessment on every event a customer sends, from account creation, login and transactions to content posting and custom events. The company describes an ensemble of custom predictive models rather than a shared rulebook, with per customer models trained on each customer's own outcomes alongside the network.

The scale is stated: more than 16,000 signals, more than a trillion events a year, and a network of 34,000 sites and applications learning from hundreds of millions of positive and suspicious events each day. The company says a single data point, such as an email address, becomes hundreds of derived signals covering similar addresses, disposable domains and address age. That is feature engineering, not lookup.

Sift also sets itself against what it calls checkbox machine learning and reactive rules based competitors. Take the models away and there is nothing left to sell, since there is no liability product underneath and no verdict to fall back on.

Oversight is the selling point, and the company puts it up front rather than burying it. The decision stays with the customer: Sift returns a probability score and the customer decides. The company contrasts this with what it calls opaque outsourced decisioning that creates blind spots and erodes visibility. Four mechanisms sit on top. An analyst console with review queues puts a human in the loop on flagged events by design, not by exception.

A rules builder lets a customer write and change risk logic in real time without asking the vendor for a change. Automated workflows let a customer hand off repetitive routing deliberately, choosing what gets automated. And the score can feed the customer's own risk models, so the vendor's output becomes one input to a decision the customer owns outright. Business logic can block, accept, or add and remove friction by risk level, instead of issuing a yes or no verdict. What is not published is a specification of what the defaults do before a customer configures anything.

The score export design is the strength here, and it is a structural answer rather than a documentary one. Sift returns a probability score that the customer can feed into their own risk models, not a verdict they must accept. A customer's model risk function can therefore hold the vendor's output as one input among several and validate it against their own realized outcomes over time.

That is a materially better position than a black box approve or decline, which leaves a reviewer nothing to test. The supporting disclosure is real but thin. An ensemble of custom predictive models is described rather than a single scorer, per customer models are stated, and the signal count is given at more than 16,000. An example explains how secondary signals are derived from a single primary data point, and the benchmarking product supplies outside comparison data.

The documentary half is missing entirely. Sift publishes no validation report, accuracy figure, precision or recall measure, error rate, benchmark result or monitoring statement for any model, and the signal count measures scale, not performance.

The customer names are strong. The outcome evidence behind them is thin. Twitter, McDonald's, DoorDash, Wayfair, Twilio and Alaska Airlines all appear as named customers, a set spanning social platforms, quick service restaurants, delivery marketplaces, home retail, communications infrastructure and aviation. These are companies with the procurement rigor to make a reference mean something.

Scale is stated at 34,000 sites and applications and more than a trillion events a year, and an Alaska Airlines case study is published. Peer reviews are plentiful, with several hundred on the major software marketplaces averaging above four and a half out of five. What is missing is a measured result. Sift publishes no named customer outcome with a revenue, loss reduction, approval rate or chargeback figure attached, and as a privately held company it files no audited financials. Named logos at scale, without a number behind any of them.

The global network is the asset, and the reciprocity question goes unanswered. The company describes what it calls an unrivaled global data network, learning from hundreds of millions of positive and suspicious events each day across 34,000 sites and applications. That necessarily means an end user's behavior at one customer shapes the score they receive at another, including at that customer's competitors. It is presented as the central benefit and never governed as a boundary.

Nothing published says whether a customer can decline to contribute events to the shared network, or how one customer's data is kept from another's view. Nor does anything say what the retained end user profile contains, how long it persists, or what happens to contributed data when a customer leaves. The trust center asserts strict data governance and secure end user identities. That addresses confidentiality against outsiders, not what the network does with the data inside.

There is a structured place to look, but its contents are not public. The trust center at trust.siftscience.com runs on a dedicated vendor review platform and says everything needed for a security and privacy review can be found there. It describes a privacy first posture, with strict data governance and privacy controls meant to keep customers' end user identities secure. That is the right setup, and more than a policy page. The substantive documents sit behind the portal, though.

No data processing addendum, subprocessor list, retention schedule, named supervisory authority or named privacy regime is available in public. The exposure makes them worth having: the platform takes in behavioral, device and transactional data on end consumers across 34,000 sites and keeps it as a persistent identity across that network. Before contact, what a buyer can read is a claim about a portal rather than a document. A buyer who requests portal access will likely find more.

A real trust center exists at trust.siftscience.com, built on a dedicated vendor security review platform, and the company says it holds everything needed to complete a security and privacy review. Two credentials are named there: ISO 27001:2022 certification and a SOC 2 Type II report, described as the technical proof behind a defense in depth strategy. The SOC 2 evidence is solid.

The company published its original attestation announcement naming Coalfire as the third party auditor, then a renewal announcement describing new controls added the following year. A buyer gets the auditor's name, the report type and evidence of an annual cadence, not a one time badge. Earlier disclosure also mentions regular third party security assessments and code review practice. Some things are still missing.

No report can be downloaded without contact, no scope statement or trust services criteria are listed, and no penetration test summary is offered. No payment card industry certification appears either, a notable gap for a vendor scoring payment transactions.

Privately held, with no financial license, supervisory relationship, named regulator customer or regulatory approval. Compliance is claimed in general terms rather than against named rules. The company says it complies with data protection regulations without saying which, and it claims compliance with no named payments directive or transaction risk analysis exemption regime.

Its ISO 27001:2022 and SOC 2 Type II credentials are security assurance, not regulatory status, and are covered under security certifications. Listing on a major cloud provider's commercial marketplace is a buying channel, not a supervisory relationship. None of this counts against a technology supplier, which is not expected to hold a license. Nothing here adds regulatory standing either.

The architecture is transparent. The governance disclosure is not. Exposing a probability score rather than a verdict is a meaningful transparency choice in itself, because a customer can see how confident the model is and where a decision sits against their own threshold, which a binary approve or decline conceals. The benchmarking product goes slightly further by letting a customer compare their own fraud metrics against aggregate network figures. Neither is governance.

No error rate, false positive rate, precision measure or confidence calibration is published for any model. No fairness testing, disparate impact analysis or coverage statement exists. That matters because the product decides whether individual consumers may open accounts, log in or transact across 34,000 sites, so a systematically mis scored population would meet friction everywhere at once. Nothing describes who approves a model change, what validation a new model passes before deployment, or how a customer is told when scoring behavior shifts underneath them.

There is no financial guarantee, and the company does not pretend otherwise. That is a deliberate commercial position, not an omission. Sift scores and the customer decides, so chargeback liability stays with the customer, and what the vendor offers in return is control and visibility rather than indemnity. No accuracy commitment, indemnity, service level on decision quality or falsifiable performance promise is published.

What the architecture does provide is recourse machinery in the customer's hands. A flagged event lands in a review queue where a human can overturn it. Thresholds are set by the customer, not imposed by the vendor. And because the output is a score rather than a verdict, a borderline case can be routed to friction or review instead of refused. The end consumer gets none of that.

Someone scored as high risk is not told, cannot see the evidence, and has no route to the company that produced the score, though at least the decision that affected them was made by the business they were dealing with.

Counts stand where names should be, in both directions. On the input side, the company says its scoring draws on more than 16,000 signals and what it calls an unrivaled global data network processing more than a trillion events a year. It names none of the external sources behind either. No third party data supplier, identity provider, device intelligence vendor or enrichment service is named anywhere.

A buyer cannot assess the quality of any input, check whether a source they have rejected elsewhere is feeding their scores, or judge concentration risk if several signals trace back to one provider. No subprocessor list is public, no cloud infrastructure provider is named directly, and no model or foundation model provider is identified for any component. The only named third party is Coalfire, the security auditor, which sits in the assurance chain rather than the model chain. A precise signal count with no named source behind it describes the scale of the dependency without making it auditable.

API led and well documented, with no published connector catalog. The Sift Score API comes with documentation the company describes as clear and accessible. The integration model is deliberately event based rather than order based, so a customer instruments account creation, login, transactions, disputes and custom events across their own journey instead of dropping a plugin in at checkout. That design reaches further into a customer's stack and asks more of them.

Integrations with ecommerce platforms and payment processors are stated, and third party listings name Magento and Salesforce. Listing on a major cloud provider's commercial marketplace adds a procurement and billing path that some enterprise buyers require. Exporting the score into a customer's own models is an integration in its own right. Without a connector list, a buyer cannot check before contact whether their commerce platform, payment gateway or case management system is supported.

Hosted software consumed through an API, with no private, single tenant or on premise option offered. Listing on a major cloud provider's commercial marketplace shows where at least part of the estate runs, and gives enterprise buyers a way to buy through existing cloud commitments. That is a real, if incidental, deployment fact. Beyond it the residency position is blank.

No cloud region, data center, country or residency commitment is published, no region selection is offered, and no transfer mechanism or standard contractual clause provision is stated for customers outside the United States. That gap is material for a platform whose named customers operate globally and which takes in end consumer behavioral and device data across 34,000 sites. The customer carries the residency obligation and cannot meet it without knowing where processing happens.

Sift publishes no rate, tier structure or unit of sale, and no free tier. Pricing is described only as volume based, and every inquiry is routed to a demo request. Third party estimates exist and disagree with each other. One procurement marketplace puts mid market annual contracts at fifty to $150,000, built from a base platform fee plus a per event rate that falls with volume. Another puts monthly spend between one and $5,000.

A third quotes a per user monthly figure that does not fit a per event model at all. Some third party pricing sites confuse Sift with an unrelated organizational chart product also called SIFT and publish that company's plan names. Check which Sift any quoted figure describes before relying on it.

Coverage is broad in two ways, and it reaches well beyond the checkout. By event, scoring covers account creation, login, transactions, disputes, content posting and customer defined events, so the product reaches identity and account risk as well as payment risk. By customer, the named base spans social platforms, marketplaces, delivery, quick service restaurants, retail, communications and aviation, across a stated 34,000 sites and applications.

The company describes its buyers as business to consumer software teams generally rather than merchants specifically. Fintech gets direct attention, with published material on payment fraud in fintech and on crypto account cash out scams. Two limits matter. Part of the breadth sits outside financial services through Content Integrity, which tackles spam and fraudulent reviews on user generated content platforms and is not covered in this profile. And there is no sign of sales into banking operations, insurance or capital markets. The reach is wide across digital consumer businesses and absent across regulated financial institutions.