← Zurück zum Verzeichnis
Logo: RiskCogs

RiskCogs

Estonian payment risk scoring API with shadow mode, inspectable signals and readable rules that sit beside your existing payment provider.

Teilweise in der EU gehostet
fraud detectionrisk scoringshadow modepayment riskestonia
Webseite besuchenFeedback & Korrekturen

RiskCogs is a payment risk scoring product from Orsun Tech OÜ in Tallinn. It scores checkout and payment events through an API, returns a 0 to 1 risk score with a recommendation band, and shows the signals and rules that drove each assessment.

It exists for teams that already have a payment service provider and do not want to replace that stack to get fraud context. You start in shadow mode: every payment is scored and logged while your current flow stays in control, then you promote rules into enforcement when the trade-off looks right.

The concrete differentiator is the combination of shadow reports, a risk inspector with contribution breakdowns, and readable rule precision on your own traffic before anything blocks a customer.

EU-operatedAPI-first scoringShadow modePSP-agnosticBIN-only card context

Shortlist when you need provider-agnostic payment risk scoring with shadow-mode rule testing and inspectable signals under an Estonian operator. Skip when you need Stripe-native Radar depth, a chargeback guarantee, or verified public security certifications. Consider Stripe Radar instead for Stripe-only stacks.

Key capabilities

Score live payments while your current provider stays in control. Shadow mode logs would-have-blocked outcomes and weekly reports before any rule enforces a decline.

POST /v1/risk-score returns riskId, a 0 to 1 score, low/medium/high level, allow/review/block recommendation, flags, and the signals behind the result for analyst review.

Define velocity, shared-device, country-mismatch, allowlist and blocklist rules, review hit counts and example precision in shadow, then promote a rule to enforce deliberately.

Collect device and session context with a publishable key, score from your backend with a secret key, and send chargeback or confirmed-good outcomes to /v1/risk-feedback against the original riskId.

Card context is limited to BIN metadata. Session replay is optional, consent-controlled, masks sensitive fields, and can be erased with customer risk records on request.

Auf einen Blick

HQ
Tallinn, Estonia
Legal entity
Orsun Tech OÜ (17418287)
Product type
Payment risk scoring API (SaaS)
Commercial model
Free shadow tier; paid plans by monthly decisions and active users
Self-hosted
No (cloud API)
Open source
No public OSS license found
Published processing regions
Railway NL region; Scaleway Paris; AWS eu-central-1 (Frankfurt); optional Vertex AI EU

Best fit when

  • Merchants and platforms that already have a PSP and want an independent score before authorization
  • Teams that want to test velocity and device rules in shadow mode before declining live traffic
  • Multi-PSP or orchestration setups that need one risk logic across providers
  • Risk analysts who need contribution breakdowns and matched rule IDs, not only a black-box score
  • EU buyers who want an Estonian contracting entity and published EEA storage claims

Poor fit when

  • Organizations that require published ISO 27001 or SOC 2 evidence before any pilot
  • Buyers seeking a chargeback guarantee or full underwriting product rather than a recommendation API
  • Stripe-only merchants happy with Radar bundled into their existing Stripe graph
  • Teams that need a battle-tested vendor with multi-year public operating history

Consider instead when

  • When: Your payments and fraud controls already live entirely inside Stripe

    Consider: Stripe Radar

    Radar uses Stripe's payment graph; RiskCogs stays outside the PSP and stays shadow-first.

  • When: You only need device identity signals and will build scoring yourself

    Consider: A device-intelligence API (for example Fingerprint-class tools)

    RiskCogs packages score, rules, and inspector; device-only APIs leave orchestration to you.

  • When: You need payment routing and checkout orchestration rather than fraud scoring

    Consider: OrsunPay (same Estonian company)

    OrsunPay is orchestration; RiskCogs is the anti-fraud module.

Gerichtsbarkeit & Eigentum

Rechtsträger
Orsun Tech OÜ
Anwendbares Recht
Estonian law (OrsunPay terms; RiskCogs site terms still draft)
US-Mutter / Kontrolle
Keine bekannte US-Mutter
CLOUD-Act-Exposition (indikativ)
Medium
Hosting / Residenz
Domain / DienstRolleBetreiberStatusNachweis
riskcogs.com / application hostingCore web and app hostingRailway Corporation (USA), NL region · RailwayTeilweiseSub-processors page 2026-11-01; response headers x-railway-edge waw1
infrastructure / data storageEU infrastructure hosting and storageScaleway SAS (France, fr-par) · ScalewayIn der EU gehostethttps://riskcogs.com/sub-processors/
infrastructure / storageInfrastructure hosting and storageAmazon Web Services EMEA SARL (eu-central-1 Frankfurt) · AWSTeilweisehttps://riskcogs.com/sub-processors/

No known US parent. CLOUD Act exposure rated medium because Railway and AWS are US-group providers even when EU regions are used. Indicative only, not legal advice.

Nachhaltigkeit

Nicht gefunden

No public sustainability or renewable-energy data-centre page found on riskcogs.com as of research date.

  • Independent security / no-logs auditNot found
  • ISO 27001Not found
  • SOC 2 / SOC 3Not found
  • GDPR / EU data protectionVendor claimed
  • +3

Considerations & known limitations

  • MediumEarly-stage legal and operating footprint

    Orsun Tech OÜ registered 21 January 2026 with 1 EUR capital. RiskCogs terms page is still a draft placeholder. Treat production contracts, liability caps, and support SLAs as must-verify items.

  • MediumUS-group cloud subprocessors

    Published processors include Railway and AWS (EU regions) and optional Google Vertex AI. Buyers with strict no-US-cloud policies need contract-level confirmation of paths and transfer tools.

  • MediumNo public ISO/SOC audit pack

    Security questionnaire is on request. Procurement teams that require published certs will need NDA diligence or should wait.

  • LowPublic npm package not verified

    Marketing mentions npm i @riskcogs/js, but the package was not found on the public npm registry during research. Confirm SDK distribution during onboarding.

Open questions for due diligence

  • Will the executed DPA list the exact legal entities, regions, and transfer clauses for Railway, Scaleway, and AWS for your tenant?
  • Which hosting path carries production risk scores versus marketing-site traffic?
  • Are ISO 27001, SOC 2, or penetration-test summaries available under NDA?
  • Is the browser SDK delivered via private registry, CDN, or another channel while public npm remains unpublished?
  • When will the RiskCogs terms of service move from draft placeholder to executable terms?
Request vendor DPA / enterprise contact
Webseite besuchenCompare similar toolsView alternativesFeedback & Korrekturen

Häufig gestellte Fragen

No. It scores events before or beside your existing provider. Your backend still decides whether to authorize, challenge, or stop a payment. Provider names on the product site are illustrative of stacks you already run.

A riskId, risk_score from 0 to 1, a level band, a recommendation (allow, review, or block), shadowMode, flags, and signal details. Docs describe default bands such as allow below 0.40, review 0.40 to 0.69, and block at 0.70 and above; confirm thresholds in your project.

In shadow mode every payment is scored and logged, but recommendations do not change your live flow. Enforce mode applies rules and recommendations you have promoted. Paid plans unlock enforce, webhooks, and higher decision quotas; the free Shadow plan is score-only with a hard monthly cap.

The operator is Orsun Tech OÜ in Estonia with no known US parent. The published sub-processor list names Railway (Netherlands region), Scaleway (France), and AWS EMEA (Frankfurt), plus optional Google Vertex AI in an EU region. Railway and AWS are US-group providers even when regions are EU, so CLOUD Act exposure remains a diligence topic.

A DPA and security questionnaire are available on request (called out for Enterprise). Security guidance says not to send full card numbers, CVVs, passwords, or authentication secrets. Card context is BIN metadata only.

Teams locked into Stripe-only fraud tooling may prefer Stripe Radar. Buyers that need a public ISO 27001 or SOC 2 pack, a chargeback guarantee, or a long operating history should treat RiskCogs as early-stage and verify contracts before production.