Protect

Prevention runs where control runs

Fraud signals are evaluated in the same pass as everything else: before authorization, not reconciled from a chargeback report weeks later. Velocity, device clustering and address reuse are inputs to the eligibility decision rather than a dashboard somebody checks on Mondays.

This is a narrower claim than it sounds. Signals make a transaction less likely to be fraudulent; they do not make it safe, and nothing here prevents fraud. What the platform does is stop a transaction the institution's rules say should not proceed, and keep the record of why.

Screening produces a record, not a verdict

Sanctions and adverse-media screening return a resemblance with a stated similarity, under a stated provider and list version, queued for a person to read. Nothing in the product concludes anything about anyone.

Recording the provider and the version is what makes a screen re-examinable. A rescreen under a newer list is a different check, not a repeat of the same one, and a match that looked weak in March is only defensible in September if you can show what it was matched against.

Security is stated, including where it is unfinished

Encryption in transit and at rest, append-only audit logging with no update or delete path for any role, and no cardholder data anywhere in the schema — card entry is hosted fields served by the acquirer's gateway.

Several things are not finished. A SOC 2 readiness programme has not started, no penetration test has been commissioned, and the PCI scope assessment is pending. Those appear as they are, because a readiness page reporting every row green is the one a diligence reviewer stops believing.

Coverage is a separate question, and it is unresolved

A distinct idea has been discussed under this heading: whether insurance coverage for defined eligible events could sit on top of these controls and the evidence they produce. A carrier prices what it can verify, and controls applied before authorization with evidence assembled as events happen are a different underwriting proposition from a compliance dashboard.

That is an argument, not a product. Coverage validation is the sixth of eight scaling gates and it has not started. A term sheet would need to name insured parties, covered events, limits, exclusions, effective dates, evidence requirements and a claims procedure, and a licensed entity would need to review how any of it may be advertised state by state. Whether a given card-brand assessment or regulatory penalty is legally insurable is itself unsettled and varies.

The coverage module inside the product has no COVERED state and no route to reach one. A potential event stays under review until a carrier confirms it under an applicable policy.