One event in.
One decision out.
You send events: signup, login, deposit, withdrawal, checkout, anything with a user behind it. We enrich, tag, decide and, if you want, act. Here is what happens in between.
Every event, enriched in one call.
Device intelligence — a stable device identity across sessions, incognito and VPN, with emulator, tampering and automation signals. Our models sit on top of an industry-standard device intelligence layer.
Signup intelligence — email, phone and IP footprint: disposable domains, VoIP numbers, datacenter and TOR ranges, age and reputation of the identifier.
Behavior — velocity, session shape, form-fill timing, impossible travel.
Actor type — human, bot, or AI agent, and for agents: verified or not, and who they act for.
await ordent.events.send({
type: "signup",
user: { id: "usr_0f3a", email, phone },
device: req.ordentDevice, // from the web/mobile SDK
ip: req.ip,
});Signals become tags. Tags become a decision.
Tags are facts about a user with a confidence and a suggested action. They accumulate for the user's whole lifetime, so a clean signup that starts sharing a device with a banned account six months later gets the tag then.
A policy maps tags to a decision: allow, step_up, review, block, kyc. You start from a preset for your vertical and edit the table. Custom tags from your own event rules join the same table.
| Family | Examples | Typical action |
|---|---|---|
email.* · phone.* · ip.* | email.disposablephone.voipip.datacenter | require phone · step up |
device.* | device.emulatordevice.shared_with_banned | review · block |
velocity.* | velocity.signups_per_ip_high | step up |
cluster.* · promo.* | cluster.size_5pluspromo.multi_claim | review · block |
payment.* · card.* | card.testing_patternpayment.geo_mismatch | block · review |
actor.* · agent.* | actor.botagent.verifiedagent.principal_known | per agent policy |
network.* | network.banned_elsewherenetwork.seen_3plus | review |
kyc.* | kyc.recommended | route to partner |
custom.* | custom.withdrawal_burst | yours |
Choose how much to hand over.
| Mode | Ordent | You |
|---|---|---|
| Advise | Returns tags, suggested actions and the decision. Executes nothing. | Act on decision in your code. |
| Recommend | Applies your policy, returns the decision, queues edge cases for review. | One if. Clear the review queue when you like, or let it auto-close. |
| Autopilot | Shows the step-up widget, freezes the withdrawal via webhook, routes to KYC, lifts the hold when the user passes. Logs every action. | Read the weekly report. Change thresholds if you want. |
Mode is set per policy, not per account. Autopilot on card.testing_pattern, Recommend on cluster.*, Advise on everything else is a normal setup. Every automatic action is reversible from the ops panel, and a daily cap on automatic blocks drops the policy back to Recommend if it trips.
Tell us what happened. The graph learns.
Report outcomes (chargeback, banned, verified_good) with one call or one click in the review queue. Labels tune your thresholds and, pseudonymized, strengthen the network.
await ordent.labels.report({ user: "usr_0f3a", outcome: "chargeback" });Your risk team starts here.
$99 a month, 10,000 events, sandbox before you pay, money back in 14 days if it doesn't fit.