Architecture
Where it sits, and what crosses the line.
The technical boundary matters more than the feature list, because it determines what an institution is actually exposed to. SentryFox evaluates and records. It does not collect card data, hold funds or approve merchants, and the schema has no way to express any of those.
One transaction, end to end
Presents an order at the merchant's checkout.
Sends the order context to SentryFox. No card data is included, because none has been collected yet.
Evaluates merchant, buyer, product, geography and order against the policy version in force. Returns eligible or blocked, and on eligible the frozen rail set.
Presents only the rails in that set. A block presents no payment path at all.
Collects card data in hosted fields served by the acquirer. This never traverses SentryFox.
Authorizes and settles. Settlement is between processor, acquirer and merchant.
The decision, its inputs, the rule and the policy version are written as the transaction happens.
Who owns what
A responsibility matrix is the first thing an operations reviewer asks for and the last thing most vendor sites carry.
How it fails
Every failure mode resolves the same way. Absence of a successful evaluation is not permission.
- SentryFox is unreachable
- Checkout does not fall through to an unevaluated transaction. The merchant platform treats absence of an eligible response as not eligible, which is the same rule that governs an unconfigured policy.
- The policy version is ambiguous
- Evaluation stops at the platform gate and returns blocked. A decision that cannot name the version it was made under is not a decision that can be defended later.
- A monitoring scan fails
- The scan is retried and the merchant's scan posture ages. A stale posture past the program's tolerance stops transactions rather than passing them on the last good result.
- The evidence store rejects a write
- The decision is not returned as eligible. A decision without a record is indistinguishable, afterwards, from one that never happened.
- A screening provider is down
- Screening-dependent rules fail closed for the duration. Nothing is approved on the basis that a check could not be run.
Implementation
A controlled pilot is an integration against an existing checkout and an existing acquirer relationship, not a platform migration. The institution’s rules are encoded first, the cohort is boarded against them, and nothing is switched on portfolio-wide at any point.
Or read the security postureThe screens an institution would actually operate, on representative data.