What we learn over the user's lifetime.
Nothing expires while the user is active. Patterns that take months to form still get caught.
Every tag, with its timestamp and the event that produced it.
A clean signup in March that starts sharing a device with a banned account in June gets the tag in June, on the event where it happened. The timeline is what your support team and the AI analyst read.
GET /v1/users/usr_0f3a/timeline
2026-03-02 signup email.no_footprint 0.71
2026-03-02 login device.new 0.99
2026-06-14 login device.shared_with_banned 0.87 ← new
2026-06-14 withdrawal decision: hold + step_upAccounts grouped by what they share.
Shared devices, IPs, payment instruments and behavior connect accounts into clusters. Tags describe the cluster, not just the account, and explain why it's a cluster.
One click labels the cluster and every account in it. Multi-accounting and bonus abuse are the first thing the cluster explorer was built for.
cluster.size_5pluscluster.shares_device_with_bannedpromo.multi_claimreferral.self_looppayment.instrument_reusedYour outcomes, fed back.
Chargebacks, bans, confirmed-good users. Labels tune your policies and, pseudonymized, become network signals. Without them the graph would only ever be as smart as day one.
await ordent.labels.report({ user: "usr_0f3a", outcome: "chargeback" });
await ordent.labels.report({ cluster: "cl_2210", outcome: "banned" });
await ordent.labels.report({ user: "usr_88ab", outcome: "verified_good" });Merchants who contribute, receive.
Identifiers seen elsewhere surface as tags. Never raw data, never merchant names, never below the anonymity threshold.
How the network works, in full, including what leaves your account and what doesn't.
network.seen_3plusnetwork.banned_elsewherenetwork.chargeback_historyYour risk team starts here.
$99 a month, 10,000 events, sandbox before you pay, money back in 14 days if it doesn't fit.