Zoot Enterprises

A business rules platform that has added learned components, and the chronology settles it. The company has been delivering hosted decision management since 1992, three decades before anything in the current product could be called machine learning, and the two components at its centre remain a stateless application processing service and a graphical business rules editor built for non technical users.

Current descriptions place business rules, machine learning and agentic artificial intelligence together in the decisioning path, and the ordering in that phrase is accurate rather than incidental. The removal test is answered by the product's own selling point: the company states that clients hold absolute control to implement rules, processes and policies, and a named customer describes taking direct hands on control of boarding rules without engineering involvement. A platform whose value proposition is that a business user can write the decision logic themselves is one where the decision logic is not, in the main, learned.

The institution owns the logic completely, which is the strongest form of control, and the mechanism that delivers it also creates a governance question nobody addresses. Control is genuine and evidenced from the customer side rather than claimed: the rules editor is built for business users, the company states clients hold absolute control to implement rules, processes and policies across the enterprise, one named customer reports direct hands on control over boarding rules without engineering involvement, and another describes being able to change the entire origination flow rather than only the decisioning portion.

A vendor that hands the decision logic to the customer is not making autonomous decisions on anyone's behalf. The unexamined consequence is change control. When a business user can alter the rules that determine who receives credit without the involvement of a technology function, the review, testing and approval that an engineering release process would impose is bypassed by design, and nothing published describes what governance surrounds a rule change.

Tooling for the customer's process, no measurement of the vendor's own. The platform provides configurable testing tools, auditable records and access to what the company describes as proven models for assessing risk and profitability, which supports a lender in documenting and defending its decisions. What is absent is any evidence about performance.

Across two passes no accuracy figure, separation or discrimination metric, benchmark against an incumbent method, validation methodology, sample, observation period, or drift and retraining disclosure was located for any component of the platform.

The gap is widest precisely where the product has changed most recently: machine learning and agentic capabilities have been added to a decisioning path that was previously deterministic, and nothing published describes how those components were validated, how they perform, or how a lender would evidence them to its own model risk function. The single quantitative figure published anywhere is an availability percentage, which measures uptime rather than decisions.

Named customers on the record and a marquee claim that has aged. Three institutions are quoted with attribution on the European surface, covering a specialist consumer credit bank, a mortgage lender and a payments business, and the quotes are specific about what changed rather than generically complimentary, one describing direct control over boarding rules without engineering involvement and improved approval rates without loosening controls.

Longevity and scale are real: continuous operation since 1990, hosted decisioning since 1992, roughly 223 staff across four continents, separate United States and European operations, and stated capacity for billions of real time decisions annually. An independent analyst assessment records a client base including three of the top five United States banks, which is the strongest institutional claim available and also the oldest, dating from 2012 and not restated in current material. Two shortfalls hold this at the lower end of the band: no current United States customer is named, and no quantified outcome figure of any kind is published.

Auditability offered as a product feature, nothing published about the models. The compliance material emphasises clear auditable records for reporting and transparency, and the company provides configurable testing tools described as supporting compliance needs and credit risk management best practice, which gives a customer the means to evidence its own decisions to an examiner. Annual independent audits of the processing environment add assurance about the platform's operation.

All of that concerns the system's behaviour rather than the behaviour of what has recently been added to it. Across two passes nothing was located describing the machine learning or agentic components introduced into the decisioning path: no model card, no evaluation methodology, no red team result, no incident history and no acceptable use boundary. Nor is there any statement on whether data passing through a multi tenant decisioning environment handling application flow for multiple institutions informs models or benchmarks offered to others.

A compliance surface pointed at the wrong statute for the business. The company's assurance material states adherence to health information privacy regulation and holds a certification under the health sector security framework, alongside payment card security certification. Payment card certification is coherent for a platform touching card origination.

The health privacy references are harder to place in a company whose published business is credit decisioning, loan origination and collections for banks, retailers and captive finance, and a buyer should establish whether they reflect a genuine line of business, a legacy client, or copy that has drifted.

What is absent is the statute that does govern this work: the Gramm Leach Bliley Act appears nowhere across two passes, despite a client base of United States financial institutions and a platform carrying consumer credit application data through hundreds of external data connections. No privacy programme description, retention schedule or subprocessor list was located on either the United States or European surface.

The most complete credential stack in this lane, with one detail that matters more than the list. The company states it holds payment card industry security certification and a health sector security framework certification, and that it undergoes service organisation control audits of both the first and second type, at the second level, annually.

The annual cadence is the part worth drawing out: an attestation of that kind covers a defined observation period rather than conferring standing, so stating that audits recur each year answers the currency question that undermines several other records in this index where a single announcement sits years in the past. Physical security is described concretely through the owned data centre, its structural rating and its availability figure. Two deductions.

No trust centre exists and no report is obtainable without contact, so the scope of any credential cannot be read from outside. And the European site describes the same credentials loosely and incorrectly, referring to certification under a malformed standard number and calling the attestation a certification, where the United States material states it correctly.

An unregulated software supplier positioning compliance as a product line without documenting any standing of its own. A dedicated compliance offering is published, promising support in adhering to evolving regulation, auditable records for reporting, and configurable testing tools to address compliance needs, and the financial services material states that a client's growth, credit risk and buildout strategy will meet its specific regulatory requirements.

That is compliance delivered to the customer. Across two passes no financial services authorisation, supervisory examination outcome, or citation of the governing statutes by name was located. Two absences are specific to this company's footprint. Nothing addresses the equal credit rules that bear directly on automated credit decisions in its home market.

And with a separate European operating entity and European customers, no position on the European artificial intelligence regulation was located, despite credit scoring being expressly designated high risk under that regime.

Nothing published, and the platform's defining feature sharpens the exposure rather than softening it. Across two passes no fairness testing, disparate impact analysis, model card, bias statement or explainability documentation was located on either the United States or European surface.

The platform executes credit decisions for banks, credit unions, captive automotive finance and retail credit across two continents, and now combines business rules with machine learning and agentic components, so the exposure spans both rule based and learned decisioning. The specific risk here differs from a pure model vendor.

Because business users can write and change decision rules directly through a graphical editor without engineering involvement, a rule producing disparate impact can enter production through a route that carries no model validation, no fair lending review and no technical change control, and the company publishes nothing describing what testing or approval it expects before a rule change reaches live applicants.

One published quantitative commitment and no contractual apparatus behind it. The availability figure of 99.9 percent is specific, tied to a described physical facility with redundant processing, and is more than most vendors in this index put in writing, but it is presented as a capability of the infrastructure rather than as a service level with defined credits, remedies or measurement basis.

Across two passes no terms of service, master agreement, warranty, indemnity, liability cap or service level agreement was located. The exposure is shaped by where the platform sits: this is the path applications travel to reach approval or decline, connected to hundreds of external data sources, operating at a stated capacity of billions of real time decisions a year, so an outage stops lending rather than degrading a report.

One structural mitigation is genuine and worth stating: because customers author their own decision rules through the business user editor, responsibility for the substance of a decision rests more clearly with the institution here than at vendors supplying their own models.

An honest structural disclosure about where analytics come from, with no supplier named. The company describes a partner and provider network giving clients access to an extensive global network of data and service providers with pre built connections to established sources, and states that this connectivity extends to advanced data, artificial intelligence and machine learning models.

That is a real and unusual admission: it tells a buyer that models running in the decision path may belong to third parties reached through the platform rather than to the vendor, and that the platform is partly a conduit. Having disclosed the shape, nothing fills it in.

Across two passes no bureau, fraud provider, identity service, open banking aggregator or model supplier is named among the hundreds of connections, so a buyer cannot assess concentration, cannot see whether sources it already contracts directly are duplicated, and cannot identify whose models would be scoring its applicants. Nothing describes the technique or provenance of the vendor's own machine learning and agentic components.

Thirty six years of integration work, and the architecture is built around the problem rather than around the product. Connectivity spans hundreds of live data sources across credit, fraud, identity and open banking, delivered through a single gateway so a lender integrates once rather than separately per provider, which is the structural difference between a connector list and an integration layer.

A partner and provider network supplies pre built connections to established sources, with stated capability to add new ones quickly, and explicitly includes third party artificial intelligence and machine learning models, so a customer can bring its own or a partner's analytics into the decision path rather than being confined to the vendor's.

On the downstream side the company states it can integrate with any core banking or credit union system a client runs, which is an unusually unhedged commitment and matters most to the smaller institutions that are otherwise told their core is unsupported. Interface access and third party integration are confirmed independently. The reservation is documentation: no public developer portal or connector catalogue was located, so the breadth cannot be verified before contact.

Owned infrastructure with a published rationale, which is rare enough to be the distinguishing feature of this record. The main data centre sits at the company's own headquarters in a seismic rated structure surrounded by a fibre optic loop, with stated availability of 99.9 percent, and the company argues that a location away from dense population insulates its processing from physical and technological threats concentrated in major metropolitan areas.

Whether or not a buyer accepts that argument, it is a real architectural choice with a stated reason, and it means the vendor is not intermediating a hyperscaler relationship it does not control. Delivery is hosted software, and an independent assessment records some on premise deployments historically, though that detail is old and is not restated currently. Separate United States and European operating entities and websites imply European processing capability.

What is missing is the specificity: no region list, no explicit residency commitment for European or other customers, no tenancy description, and no statement of where European client data is processed relative to the Montana facility.

No price, unit or tier is published, and a major software directory states plainly that the company has not provided pricing information for the product. Two passes across the company's United States and European sites, its solution pages and third party directory listings produced nothing further. The published entry route is a contact request.

The structure of the offering makes the omission harder to work around than usual, because this is a platform plus services proposition rather than a licence: the company describes a proven implementation process reaching production in weeks, professional services to embed decisioning logic into customer workflows, and a partner network through which client data connections are arranged.

Each of those is a cost centre with a different shape, and nothing published indicates whether the commercial basis follows decisions processed, applications, modules, seats or a negotiated enterprise fee, nor how data source costs from the partner network are treated.

Breadth across institution types and beyond banking, with the lifecycle covered end to end. The stated client base spans leading banks, automobile manufacturers, retailers and payment providers, which reaches captive finance and retail credit rather than depository institutions alone, and the company separately addresses credit unions and fintechs with a stated ability to work at any client size.

Line of business coverage is the widest in this lane, running from instant prescreen and customer acquisition through account opening, credit decisioning, loan origination and credit risk management to fraud, cross sell, and collections and recovery, so a lender can use one decisioning layer across the whole customer relationship rather than at the application alone. Geographic presence spans four continents with separate United States and European operating entities and websites. Holding it below the top band: the named customers all sit on the European side, no current United States institution is identified, and no count of clients in any segment is published.