Alloy
Identity and risk orchestration
Alloy combines onboarding, ongoing risk management, fraud models, credit decisioning, compliance workflows, and an AI Assistant. It connects external data services and applies configured policy across customer journeys. Native workflow execution and ownership of the underlying data are different questions.
Our assessment
Broad through orchestration and its own risk tools. It does not make every connected verification product native.
Best fit and limitations
A strong candidate when the main challenge is coordinating identity and compliance providers. For a payment processor, it could coordinate checks while merchant risk and payment controls remain in the processor stack.
- Confirm which providers, contracts, and responsibilities sit inside the proposed configuration.
- Data source availability does not establish included licenses, regional coverage, or equal integration depth.
- Credit decisioning is documented. A complete merchant-loss, reserve, or settlement-control system is not established.
Tools 6
OnboardingKYC and KYB decision flows+
- Coordinate data checks and step-up verification
- Configure policies by customer, product, and channel
Data orchestrationProvider connection layer+
- Connect external identity and risk solutions
- Run checks in parallel and adapt provider choices
Fraud Signal + Fraud Attack RadarPredictive fraud tools+
- Customer fraud risk scoring
- Portfolio-level detection of coordinated origination attacks
Compliance + perpetual KYC/KYBOngoing relationship review+
- Refresh customer and business risk
- Combine ongoing AML and fraud review with policy
AI AssistantProcedural review+
- Document review, watchlist investigation, and KYB research
- Recommendations or configured automated actions
Credit decisioningLending policy execution+
- Combine bureau and alternative data with configured credit policies
- Use decision trees, matrix models, and imported models
- Backtest, shadow-test, or compare workflow versions
AI capabilities
Fraud models + a native AI Assistant
Alloy separates predictive fraud intelligence from an agentic assistant for procedural work. The assistant uses the context of its decisioning and identity platform.
What to validate
Require source attribution, action approval rules, decision write-back records, and evidence that an assistant cannot change policy outside its role.
Implementation
Integration checklist
- Inventory checks, provider contracts, data rights, and fallback routes.
- Define the system of record for application, merchant, owner, and monitoring status.
- Test provider timeout, duplicate webhook, manual review, and policy rollback behavior.
Commercial scope
Quote required. Separate platform fees, evaluations, connected data, monitoring, cases, and AI Assistant usage. No annual price is assumed.
Questions for the demo
- Which checks are included, separately billed, or contracted directly with providers?
- Can we move every policy and case record out of Alloy if needed?
- What remains to build for merchant exposure and settlement controls?
Engineering
- Inputs
- Person and business entity information for a Journey Application · Credit bureau, cash-flow, employment, and other configured underwriting data
- Outputs
- Journey application state and evaluation outcomes · Policy outcomes and manual-review routing
- Webhooks
- Acknowledge with HTTP 200 within the documented 10-second timeout. Delivery can be duplicated or out of order; process asynchronously and idempotently.
- Decision timing
- Initial responses can be synchronous; manual review and other long-running steps complete asynchronously. The guide targets an initial response within about 25 seconds. Running or pending_workflow_service can mean work continues asynchronously; this is not a guaranteed final-decision SLA.
- Deployment
- Deployment options not verified.
- Dependencies
- Credentials with access to the configured Journey · Basic token/secret or OAuth client-credentials authentication · Distinct test and production external identifiers · Credit decisioning depends on selected provider contracts and the lender's configured policy
Verified details 15
- Inputs
Person and business entity information for a Journey Application
Source Checked 2026-09-18 - Outputs
Journey application state and evaluation outcomes
Source Checked 2026-09-18 - Decision timing
Initial responses can be synchronous; manual review and other long-running steps complete asynchronously.
Source Checked 2026-09-18 - Dependency
Credentials with access to the configured Journey
Source Checked 2026-09-18 - Dependency
Basic token/secret or OAuth client-credentials authentication
Source Checked 2026-09-18 - Decision timing
The guide targets an initial response within about 25 seconds. Running or pending_workflow_service can mean work continues asynchronously; this is not a guaranteed final-decision SLA.
Source Checked 2026-09-18 - Webhooks
Acknowledge with HTTP 200 within the documented 10-second timeout. Delivery can be duplicated or out of order; process asynchronously and idempotently.
Source Checked 2026-09-18 - Dependency
Distinct test and production external identifiers
Source Checked 2026-09-18 - Inputs
Credit bureau, cash-flow, employment, and other configured underwriting data
Source Checked 2026-09-18 - Outputs
Policy outcomes and manual-review routing
Source Checked 2026-09-18 - Connected provider
Nova Credit
Source Checked 2026-09-18 - Connected provider
Argyle
Source Checked 2026-09-18 - Connected provider
Plaid
Source Checked 2026-09-18 - Connected provider
Codat
Source Checked 2026-09-18 - Dependency
Credit decisioning depends on selected provider contracts and the lender's configured policy
Source Checked 2026-09-18
Illustrative contract
An example for your internal adapter. This is not a vendor endpoint, request, or response.
{
"contract": "internal-risk-review/v1",
"vendorId": "alloy",
"internalCorrelationId": "example-001",
"vendorRecordId": null,
"control": "KYC and KYB decision flows",
"evidence": [],
"status": "pending",
"decision": "review",
"requiresHumanReview": true
}Integration limits
- Illustrative internal integration contract. This is not a vendor request, response, endpoint, or SDK example.
- Empty country, deployment, or provider lists mean not verified in this review. A documented country refers to the specific product noted in its source, not universal platform coverage.
- OAuth bearer tokens have a documented one-hour lifetime. The guide distinguishes migrated account-level credentials from legacy workflow tokens; do not assume every key is workflow-scoped.
- The guide recommends retrying 429/5xx with retry-after, backoff, and jitter. Request idempotency and a universal retry count were not verified.
- Sandbox and production are processing modes within a shared account data store, not separate storage environments. Sandbox avoids live provider calls; production may incur charges.
- The named providers are examples of credit data connections. A provider listing does not establish universal country coverage or an included data license.
Sources 7
Source review dates are shown above. Product claims come from public sources. Fit, limits, and evaluation questions are our analysis. This is not a hands-on performance test. Methodology · Changelog