Fraud, risk and abuse signals

Real-time behavioral signals, in milliseconds.

Send your events. Describe what to count. Ask for a ready-made answer at the moment of a login, a checkout or a payment.

Request accessRead the docs

From events to answers

Three steps, and new signals go live without a deploy.

  1. 1

    Your systems send events

    A failed login, an order, a payment: one HTTPS call each, or up to 500 per request. Each event counts once, even when retried.

  2. 2

    The engine keeps running totals

    Per customer, card, email, device, IP address or company: counts, sums, minimums, maximums, distinct counts, over the windows you choose.

  3. 3

    You ask a profile

    One call returns the values and the rules that hold, such as high_card_spend. Your service decides: allow, step up, review or block.

Built for decisions that depend on recent behavior

All of it is configuration, not code.

Sign-in risk

Three failed logins in 15 minutes, a device never seen before, many accounts from one network.

Payments and orders

Card spend in the last 24 hours, payments per hour, new customers placing large orders.

Abuse and misuse

Bursts of sign-ups, coupon redemptions or messages from one device, email domain or network.

Usage and limits

Usage per customer or organization over rolling or calendar periods, in each customer's own time zone.

Why Aggrelis

Fast enough for the critical path. Safe enough to change every day.

Milliseconds, measured
Answers come from memory. Locally measured p99: about 0.65 ms to record an event and 0.8 ms to evaluate a profile.
Live in seconds
Risk teams add or tune a signal and it reaches every server within seconds. No deploy, no restart.
Safe to change
Validate, dry-run, backfill, shadow, activate and roll back. Every change is versioned and audited.
Exact money
Amounts never pass through floating point, and currency rules keep a USD order out of a EUR total.
Understands relationships
A user's failed login also counts for the user's company. Profiles read the numbers of linked entities.
Private and isolated
A database per tenant, identifiers hashed with a key per tenant, event data encrypted inside the system.

One call, a clear answer

Values, the rules that hold and the profile version. Values it cannot compute are named, never treated as zero.

Request
POST /v1/entities/user/u_42/profiles/signin_risk:evaluate
{ "context": { "email": "alice@example.com" } }
Response
{
  "values": { "failedForEmail15m": 3 },
  "reasons": ["failed_attempts"],
  "profileVersion": "signin_risk@v1"
}

Hosted or on-prem

The same engine, wherever your data has to live.

Hosted

Subscribe here and your workspace is prepared right after checkout. Your team signs in to the console with Aggrelis accounts.

See pricing

On-prem

Run the engine in your own cloud or data center on Kubernetes or Docker, with PostgreSQL and Redis, under a signed license.

Contact sales

Ship your first signal today

Aggrelis is invite-only for now. Ask us for access and we will set you up.

Request accessRead the docs