Socure

An identity graph drawing on more than 400 data sources and some 40 billion historical known outcomes trains the Sigma fraud models, and RiskOS is built as an AI native decisioning layer on top. Assistants sit inside that layer, suggesting case outcomes, turning plain language into rules and explaining workflow changes. Agent Intelligence, launched in October 2026, applies the same models to detecting AI agents acting for customers, so every product Socure sells runs on its models.

Accept, review and escalate thresholds are set by the institution through no code RiskOS workflows, so customers stay in the decision loop and choose how to treat each score and reason code, and no sampling of automated approvals is published. Decisions then execute automatically at sub second latency, with named fraud escalation paths and a Control Center beside them. The Case Review Assistant suggests approve, escalate, decline or fraud with its reasoning while an analyst decides, and Socure's own fraud investigators review a sample of its results.

Every score comes with reason codes, and customers get dashboards with score distributions and reason code firing rates. Socure describes a model governance framework modeled on financial services model risk management, covering inputs, processing and outputs, with validation for every model and independent validation stated for its Verify and Watchlist products; performance is tracked on false positives and negatives, true accept and reject rates and the Population Stability Index.

Its model governance documents are not mapped openly to SR 26 2, which superseded SR 11 7 in April 2026, but for Sigma Synthetic and Sigma All v4 they are released on request through the trust center, a package a validator can obtain.

Socure claims up to 99% capture of identity fraud among the riskiest 5% of users, decisions under 150 milliseconds and up to 40% better auto approval, all on its own measurement. It reports more than 6,000 customers, including 19 of the top 20 American banks, the largest payroll providers and more than 500 fintechs. Logos such as Citi, Capital One, Chime, SoFi and Robinhood carry no outcome of their own, and an unnamed top five global bank reports a 25% auto approval lift.

The figure tied to a named client comes from Green Dot, a founding member of Socure's first party fraud consortium, which sees about 45% of the same behavior across the consortium's members. Annual recurring revenue reached $364 million in the second quarter of 2026, up 63%.

Pooled learning is stated plainly: Socure's models are trained with customer data, and beyond processing each transaction Socure may use the same data as controller to build fraud insights across its customer base. Socure also states that customer data stays confidential and is not shared with third parties for its US AI products, and a data governance council sits beside its privacy and security teams. AI training data and AI security sections of the trust center sit behind access, and no deepfake red teaming is described despite deepfake resistance being a central claim.

Retention is spelled out in the privacy notice effective October 1, 2026: no more than seven years for most categories and one year for biometric data, or two if flagged as suspected fraud, with Socure acting as processor for each customer transaction. The notice names neither federal financial privacy law nor the Fair Credit Reporting Act.

SOC 2 Type 2, ISO 27001:2022 and a FedRAMP Moderate authorization head a long list on its SafeBase trust center, alongside penetration test reports and a Standardized Information Gathering (SIG) Lite self assessment. ISO 27017, 27018 and 27701 cover cloud security and personal information management, and its public sector environments carry GovRAMP authorization and Texas TX RAMP Level 2. Reports are released on an access request.

Socure sells eCBSV, the Social Security Administration's consent based check of name, birth date and Social Security number, which requires the company to enroll with the agency. Bank Secrecy Act and Patriot Act customer identification duties frame the platform, and no banking or money transmission license is needed.

Socure publishes how it tests for bias: it follows fair lending rules and tests its responses for disparate impact by race, color, sex and age across all customers and uses, although it uses no protected class status in its models, and it benchmarks performance across genders, ages, races and skin tones on curated datasets. Model governance runs across the life of each model with data science, product and legal involved, and fairness testing is stated for the fraud products.

The subgroup results themselves are not published, and the trust center's bias section is gated. Its research on legacy verification puts incorrect match rates near 5 percent and failures above 10 percent for some age, race and income groups, the problem its inclusion pitch is built against.

Socure offers no published indemnity or remedy, and someone denied an account on a fraud score is usually not told which vendor judged them or given a route to revisit the outcome. Consumers can still access and correct what Socure holds about them in the identity graph, which fixes the data a future decision reads.

The Sigma models and the identity graph are Socure's own, built on some 40 billion historical known outcomes. The graph draws on more than 400 databases whose suppliers go unnamed, as do the models behind the newer AI assistants. Snowflake, Google Cloud and Amazon are named as subprocessors in the trust center, and Socure states that customer data is not shared with third parties for its US AI products.

One API endpoint resolves the ID+ suite, RiskOS integrates by software development kit (SDK) or API across web, mobile and back office, and its developer documentation is published. A Model Context Protocol (MCP) server brings RiskOS into code editors such as Visual Studio Code and Cursor without reaching customer personal data, and the Effectiv engine connects more than 50 third party data and solution providers into one workflow. Mobile driver's licenses from Google and Samsung wallets can now be checked. No core banking, loan origination or case management integration is named.

A separate government cloud runs alongside the commercial platform with its own documentation, a real control boundary rather than a label. Specific hosting regions and in country residency options are not enumerated.

Socure Launch publishes its prices: document verification at $0.80 per evaluation, document verification with a watchlist check at $0.90, identity, fraud and watchlist checks with a document step up at $1.00, and the same with prefill at $1.30. Every Launch account gets $1,000 in free credits a month, with evaluations beyond that billed at the solution rate, and goes live through self serve sign up in about an hour. Socure Enterprise, which adds the full RiskOS configuration, case management and dedicated support, is priced on volume and spend through a quote.

Segments each carry their own positioning, from banking and sponsor banks to crypto, payroll and the public sector, with international reach through market specific RiskOS workflows. Sponsor banks stand out, since fintech controls management for them is a distinct regulatory posture. Crypto reach widened in 2026, with Binance.US choosing Socure and an integration with Circle's Arc blockchain.