OrsunPay vs RiskCogs

Vergleichen Sie OrsunPay und RiskCogs nach Funktionen, Rechtsraum, Nachweisen und Einsatzpassung.

Beide als Alternativen zu: stripe

OrsunPay

Estonia· Cloud Computing

Needs review

Shortlist OrsunPay when you need Estonian-operated orchestration software on top of your own PSP accounts, with hosted checkout, payment links, and signed webhooks. Skip it when you need the vendor itself to acquire or hold funds, when EU-only application hosting is mandatory (Railway USA is disclosed), or when you only need a single PSP native stack. Consider Stripe (or your primary PSP) alone if one provider already covers your methods and you do not need a multi-PSP control plane.

EU-operatedBring-your-own PSPHosted checkoutSigned webhooksHosted SaaS

Eintrag ansehen Webseite besuchen

RiskCogs

Estonia· Cloud Computing

Needs review

Shortlist when you need provider-agnostic payment risk scoring with shadow-mode rule testing and inspectable signals under an Estonian operator. Skip when you need Stripe-native Radar depth, a chargeback guarantee, or verified public security certifications. Consider Stripe Radar instead for Stripe-only stacks.

EU-operatedAPI-first scoringShadow modePSP-agnosticBIN-only card context

Eintrag ansehen Webseite besuchen

Hervorgehobene Zeilen unterscheiden sich zwischen den Produkten.

OrsunPay vs RiskCogs: Überblick
Merkmal	OrsunPay	RiskCogs
Herkunftsland	Estonia	Estonia
Kategorie	Cloud Computing	Cloud Computing
Open Source	Nein	Nein
Self-Hosted	Nein	Nein
Hauptsitz	Estonia	Estonia
Rechtsträger	Orsun Tech OÜ (registry code 17418287)	Orsun Tech OÜ
Anwendbares Recht	Nicht angegeben	Estonian law (OrsunPay terms; RiskCogs site terms still draft)
US-Mutter / Kontrolle	Keine bekannte US-Mutter	Keine bekannte US-Mutter
CLOUD-Act-Exposition (indikativ)	Mittel	Mittel
EU-Hosting-Status	Teilweise	Teilweise
Hosting / Residenz	Application and website hosting disclosed on Railway Corporation (USA). Website proxy/security may use Cloudflare where configured. Transactional email via Resend with US storage when enabled. Optional Google Analytics/Ahrefs on the marketing site. Payment card data is stated to stay on PSP-hosted pages, not OrsunPay servers.	EEA storage claimed. Core paths on Railway (US corp, NL region), Scaleway SAS (France), and AWS EMEA (Frankfurt). Optional Google Vertex AI in an EU region. Marketing site analytics may use Google Analytics 4.
Zusammenfassung	OrsunPay gives merchants one API to route payments through their own payment service providers, with hosted checkout, payment links, refunds, and signed webhooks.	Estonian payment risk scoring API with shadow mode, inspectable signals and readable rules that sit beside your existing payment provider.
Tags	estonia payment orchestration hosted checkout payment links webhooks fintech psp	estonia fraud detection risk scoring shadow mode payment risk

Auf einen Blick: OrsunPay vs RiskCogs
Auf einen Blick	OrsunPay	RiskCogs
HQ	Tallinn, Estonia	Tallinn, Estonia
Legal entity	Orsun Tech OÜ (17418287)	Orsun Tech OÜ (17418287)
Product type	Payment orchestration SaaS (BYO PSP)	Payment risk scoring API (SaaS)
Self-hosted	No (hosted API and cabinet)	No (cloud API)
Open source	Not positioned as open-source platform	No public OSS license found
Commercial model	Software fees via merchant agreement; PSP charges separate	Free shadow tier; paid plans by monthly decisions and active users
Published processing regions	Nicht angegeben	Railway NL region; Scaleway Paris; AWS eu-central-1 (Frankfurt); optional Vertex AI EU

Key capabilities: OrsunPay vs RiskCogs
Key capabilities	OrsunPay	RiskCogs
EU-operated	Ja	Ja
Bring-your-own PSP	Ja	Nicht angegeben
Hosted checkout	Ja	Nicht angegeben
Signed webhooks	Ja	Nicht angegeben
Hosted SaaS	Ja	Nicht angegeben
API-first scoring	Nicht angegeben	Ja
Shadow mode	Nicht angegeben	Ja
PSP-agnostic	Nicht angegeben	Ja
BIN-only card context	Nicht angegeben	Ja

OrsunPay

Bring-your-own PSP orchestration API
Create and track sales through a common merchant API while keeping your own provider agreements and settlement. OrsunPay invoices a separate software fee; processing stays with the connected PSP. Method, currency, and market availability depend on each configured connection.
Hosted checkout with provider-hosted card entry
Redirect buyers to a localized hosted payment journey. Sensitive card details are entered on the PSP-hosted interface; docs state the merchant API rejects raw PAN/CVV. A browser return alone is not proof of payment: confirm verified status server-side.
Payment links for fixed-amount collections
Create amount-and-currency payment links via cabinet or API, share them, and deactivate when done. Opening a link is not a receipt. Cabinet link management is described as live-mode today; supported methods still follow your connected PSPs.
HMAC-SHA256 signed webhooks with retries
Status events are signed with a merchant-specific secret over the exact raw body bytes, with timestamp skew limits. Deliveries are at-least-once; docs require deduplication by event id. Live and test modes use separate endpoints and secrets.
Smart routing and controlled cascading
Configure rules and priorities across your connections, inspect route decisions, and cascade eligible soft declines with safeguards for uncertain outcomes. OrsunPay does not promise lower fees or higher approval rates; results depend on your providers and traffic.

RiskCogs

Shadow-mode scoring beside your PSP
Score live payments while your current provider stays in control. Shadow mode logs would-have-blocked outcomes and weekly reports before any rule enforces a decline.
Inspectable risk score and reason codes
POST /v1/risk-score returns riskId, a 0 to 1 score, low/medium/high level, allow/review/block recommendation, flags, and the signals behind the result for analyst review.
Readable rules with precision on your traffic
Define velocity, shared-device, country-mismatch, allowlist and blocklist rules, review hit counts and example precision in shadow, then promote a rule to enforce deliberately.
Browser SDK plus server feedback loop
Collect device and session context with a publishable key, score from your backend with a secret key, and send chargeback or confirmed-good outcomes to /v1/risk-feedback against the original riskId.
BIN-only card context and consent-gated replay
Card context is limited to BIN metadata. Session replay is optional, consent-controlled, masks sensitive fields, and can be erased with customer risk records on request.

Assurance & compliance: OrsunPay vs RiskCogs
Assurance & compliance	OrsunPay	RiskCogs
Independent security / no-logs audit	Not found Security pages describe design boundaries; no public third-party audit PDF found.	Not found No public independent audit PDF or no-logs attestation found on security/privacy pages.
ISO 27001	Not found Privacy notice states no certification is claimed by that notice; no ISO assertion found on security pages.	Not found Security page does not claim ISO 27001.
SOC 2 / SOC 3	Not found	Not found No SOC 2/3 claim found on primary security materials.
GDPR / EU data protection	Vendor claimed Estonian controller Orsun Tech OÜ; privacy notice and DPA template published; Estonian DPA referenced for complaints.	Vendor claimed EU entity; detailed GDPR privacy notice for merchant-site and riskcogs.com processing; lead supervisor Andmekaitse Inspektsioon.
US CLOUD Act exposure (indicative)	Partial EU entity / no known US parent, but Railway (USA) hosting, Resend US email storage, Cloudflare, and optional Google Analytics create US-group processing paths. Not legal advice.	Partial Estonian entity / no known US parent, but subprocessors include Railway (US) and AWS EMEA plus optional Google services. Not legal advice.
Data processing agreement (B2B)	Vendor claimed Published DPA becomes binding when incorporated into an accepted agreement with completed schedules; page marked draft for review.	On request / NDA Security page: DPA and security questionnaire available on request; Enterprise pricing calls out DPA.
PCI DSS scope (orchestration)	Vendor claimed Vendor states card data stays on provider-hosted pages and API rejects raw card data; merchant PCI scope still depends on integration and acquirer. No OrsunPay PCI attestation package found publicly.	Nicht angegeben
EU AI Act	Not applicable Payment orchestration product; not marketed as an AI system.	Not applicable Primary product is payment risk scoring and rules; optional merchant-enabled Vertex AI analysis is disclosed but the product is not marketed as a general-purpose AI system.

Considerations & known limitations: OrsunPay vs RiskCogs
Considerations & known limitations	OrsunPay	RiskCogs
US-group hosting and email subprocessors	Medium Supplier register names Railway (USA) for apps/website and Resend with US storage for email. Sovereignty questionnaires should treat application metadata and enquiry content as potentially US-accessible even though the legal entity is Estonian.	Nicht angegeben
Legal pages marked draft for review	Medium Terms, privacy, DPA, and sub-processors pages carry draft labels. Do not treat website legalese as the executed contract; require signed schedules and confirm deployment-specific suppliers.	Nicht angegeben
Recently registered operating company	Medium Orsun Tech OÜ entered the Estonian register on 21 January 2026 with EUR 1 capital. Limited public operating history; ask for customer references, uptime history, and support commitments in the order.	Nicht angegeben
No public independent security audit or ISO/SOC	Medium Design claims (no card data on OrsunPay servers, encrypted credentials, signed webhooks) are first-party. No public audit report or ISO/SOC certificate was located.	Medium Security questionnaire is on request. Procurement teams that require published certs will need NDA diligence or should wait.
Capability depends on connected PSPs	Low Methods, refunds, cascading outcomes, and settlement timing follow each provider. OrsunPay does not promise fee reduction or approval-rate gains.	Nicht angegeben
Early-stage legal and operating footprint	Nicht angegeben	Medium Orsun Tech OÜ registered 21 January 2026 with 1 EUR capital. RiskCogs terms page is still a draft placeholder. Treat production contracts, liability caps, and support SLAs as must-verify items.
US-group cloud subprocessors	Nicht angegeben	Medium Published processors include Railway and AWS (EU regions) and optional Google Vertex AI. Buyers with strict no-US-cloud policies need contract-level confirmation of paths and transfer tools.
Public npm package not verified	Nicht angegeben	Low Marketing mentions npm i @riskcogs/js, but the package was not found on the public npm registry during research. Confirm SDK distribution during onboarding.

Passung

OrsunPay

Best fit when

Merchants that already have (or will obtain) PSP accounts and want one API across connections
Teams needing hosted checkout or payment links without collecting card data on their own servers
Platforms that require HMAC-verified webhooks and idempotent sale creation before fulfilment
Operators evaluating multi-provider routing rules and controlled cascading on their own credentials

Poor fit when

Buyers seeking a licensed acquirer or wallet that processes and holds funds inside OrsunPay
Organisations that require verified EU-only application hosting with no US-group cloud or email subprocessors
Teams that only need one PSP's native Checkout and have no multi-provider orchestration requirement
Procurement that needs published ISO 27001 or SOC 2 evidence before shortlisting (none found publicly)

Consider instead when

When: You only need one mainstream card/APM stack and want the processor and orchestration in one vendor
Consider: Stripe Checkout / Payment Intents (or your primary PSP alone)
Fewer moving parts; you give up a dedicated multi-PSP orchestration layer.
When: You need a European licensed payment institution or acquirer rather than orchestration software
Consider: Evaluate EU PSPs such as Mollie, Adyen, or local acquirers directly (not currently separate EuropeanStack entries)
OrsunPay can still sit above merchant-owned PSP accounts once those exist.
When: EU-only hosting and subprocessors are a hard gate
Consider: EU-hosted payment or orchestration vendors with published EU infrastructure
OrsunPay discloses Railway (USA) hosting and US email storage for Resend when enabled.

RiskCogs

Best fit when

Merchants and platforms that already have a PSP and want an independent score before authorization
Teams that want to test velocity and device rules in shadow mode before declining live traffic
Multi-PSP or orchestration setups that need one risk logic across providers
Risk analysts who need contribution breakdowns and matched rule IDs, not only a black-box score
EU buyers who want an Estonian contracting entity and published EEA storage claims

Poor fit when

Organizations that require published ISO 27001 or SOC 2 evidence before any pilot
Buyers seeking a chargeback guarantee or full underwriting product rather than a recommendation API
Stripe-only merchants happy with Radar bundled into their existing Stripe graph
Teams that need a battle-tested vendor with multi-year public operating history

Consider instead when

When: Your payments and fraud controls already live entirely inside Stripe
Consider: Stripe Radar
Radar uses Stripe's payment graph; RiskCogs stays outside the PSP and stays shadow-first.
When: You only need device identity signals and will build scoring yourself
Consider: A device-intelligence API (for example Fingerprint-class tools)
RiskCogs packages score, rules, and inspector; device-only APIs leave orchestration to you.
When: You need payment routing and checkout orchestration rather than fraud scoring
Consider: OrsunPay (same Estonian company)
OrsunPay is orchestration; RiskCogs is the anti-fraud module.

Open questions for due diligence

OrsunPay

Which Railway regions and Cloudflare products are enabled for a given merchant deployment?
Will the executed DPA list the final authorised sub-processors and transfer mechanisms for production payment data?
Is a PCI responsibility matrix or AOC available under NDA for the orchestration layer?
Which connectors and refund rails are activated for this merchant's live account versus docs examples?
What contractual uptime, support response, and data-return commitments apply beyond the draft website terms?

RiskCogs

Will the executed DPA list the exact legal entities, regions, and transfer clauses for Railway, Scaleway, and AWS for your tenant?
Which hosting path carries production risk scores versus marketing-site traffic?
Are ISO 27001, SOC 2, or penetration-test summaries available under NDA?
Is the browser SDK delivered via private registry, CDN, or another channel while public npm remains unpublished?
When will the RiskCogs terms of service move from draft placeholder to executable terms?