Alloy
Capability scores
Methodology →- Authentication
- 4.0
- SSO & Federation
- 2.0
- Authorization
- 2.5
- Lifecycle & Provisioning
- 2.5
- MFA & Passwordless
- 3.0
- Governance & Audit
- 4.5
- Developer Experience
- 4.0
- Deployment Flexibility
- 4.0
- Pricing Transparency
- 3.0
- Support & Ecosystem
- 3.5
Scored 0–5 against a published rubric. Independent analysis, no vendor sponsorship.
Overview
Alloy is an identity and fraud decisioning platform for banks, credit unions and fintechs. It orchestrates third-party identity, KYC, KYB, credit and fraud data behind one API and one decisioning layer, and increasingly layers its own models on top. It is best understood as an orchestration hub rather than an identity verification data provider, which matters when building a shortlist: Alloy often sits in front of the vendors it is compared against.
Founded in 2015 and led by co-founder Tommy Nicholas, it reports more than 900 financial institution and fintech customers as of July 2026.
What it is good at
Breadth of network and the commercial simplification around it. The September 2026 partner directory lists 250 or more prebuilt integrations across 85 or more solution partners, spanning identity verification, business verification, credit underwriting, fraud intelligence and watchlist screening. Crucially, Alloy resells many of those under one contract and manages sourcing, billing and vendor risk, which removes a real procurement burden for institutions that would otherwise negotiate and diligence each data provider separately.
The decisioning and case management layer is mature, covering onboarding, perpetual KYC and KYB, transaction monitoring across ACH, RTP and FedNow, wire, card and stablecoin, and SAR and CTR filing. Distribution through core banking is strengthening, with a Q2 Holdings partnership from January 2025 and a Nasdaq Verafin partnership announced September 2026 that exposes Verafin consortium data inside Alloy.
Where it falls short
No published pricing whatsoever; the pricing page does not exist.
Two transparency gaps matter for regulated buyers. ISO 27001 applies to Alloy's data centre, not to Alloy, so the widely repeated claim that Alloy is ISO 27001 certified is wrong. And there is no public model risk documentation: no SR 11-7 alignment claim, no model validation artefacts, no model cards, despite Alloy now shipping its own predictive models.
Self-reported figures need care. Alloy's own materials give both 700 and 900 customers two months apart, and the AI Assistant automation claims carry no published methodology.
No financing has been disclosed since September 2022.
Pricing
Unpublished. Resold partner solutions carry no-commit pricing under a single Alloy contract, and first-time trials of a resold solution include up to 1,000 entities at no cost. Model your all-in cost with our TCO calculator.
Best for, and who should look elsewhere
Choose Alloy when you are a bank, credit union or fintech that wants one contract and one decisioning layer across many data vendors, and you have the risk function to diligence the models yourself. If you need the verification itself rather than routing, look at Persona, Sumsub or Jumio.
Bottom line
The strongest orchestration and decisioning layer for financial services, with a genuinely large data network, let down by zero pricing transparency and no public model risk documentation.
Alloy: frequently asked questions
- How much does Alloy cost?
- Alloy publishes no pricing at all. Its pricing URL returns a 404, and no per-application, per-decision, platform fee or minimum commitment figure appears in any primary source. Two pricing-adjacent facts are documented: third-party solutions resold through Alloy come with what it calls flexible, no-commit pricing under a single contract, with Alloy managing sourcing, billing and vendor risk; and customers can test up to 1,000 entities at no cost when first trialling a resold partner solution. Note that several software directories publish Alloy pricing that actually belongs to unrelated companies sharing the name, so treat any figure you find with suspicion.
- How many data sources does Alloy actually connect to?
- Its September 2026 partner directory states 250 or more prebuilt API integrations from 85 or more solution partners. Alloy separately markets a network of more than 270 data solutions. These count different things and are not interchangeable, so the precise construction matters. Categories span consumer identity verification, KYB and business verification, consumer and business credit underwriting, banking authentication, fraud intelligence covering account takeover, device risk, document fraud, email risk, first-party and synthetic identity fraud, cryptocurrency, and watchlist screening and monitoring. Named partners include GBG, LexisNexis Risk Solutions, TransUnion, Prove, Twilio, Innovis, Early Warning and Experian.
- Is Alloy an identity verification vendor or something else?
- Something else, and the distinction changes your shortlist. Alloy is an orchestration and decisioning layer: it routes to, combines and resells third-party data rather than operating its own biometric or document-verification engine. Biometric verification appears in its partner directory as a category it routes to. So the right comparison set is other orchestration and decisioning platforms rather than primary IDV vendors like Jumio, Onfido (now Entrust IDV) or Persona, which Alloy may well sit in front of. It does run its own machine learning on top: Fraud Signal is an identity-centric predictive model, Fraud Attack Radar detects portfolio-scale attack patterns, and an AI Assistant automates case research.
- Is Alloy ISO 27001 certified?
- No, and this is a common misreading worth correcting. Alloy's security page attributes ISO 27001 to its data centre facility, not to Alloy as an organisation. What Alloy does hold is SOC 2 Type 2, confirmed on its own security page, with the report and vendor due-diligence documentation available through a gated trust centre. GDPR, CCPA, PCI DSS and HIPAA attestations are not stated publicly. Ask for the full certification list directly rather than relying on summaries.
- Does Alloy provide model risk management documentation?
- Not publicly, and for a platform sold to banks this is a genuine gap worth raising in procurement. No Alloy page claims alignment with SR 11-7, publishes model validation documentation, offers model cards, or describes examiner-ready model risk packages. Alloy has published blog commentary on Federal Reserve, FDIC and OCC model risk guidance, but that is content marketing rather than a compliance claim. Since Alloy now ships its own predictive models alongside third-party data, ask specifically how Fraud Signal and the AI Assistant are validated and documented for your model risk programme.
- How many customers does Alloy have?
- Alloy's July 2026 press release states more than 900 financial institutions and fintechs. Its own September 2026 partner directory says more than 700, so the company's collateral disagrees with itself two months apart; the 900 figure is the more recent claim. Earlier disclosed milestones were over 200 clients at its 2021 Series C and over 300 at the 2022 extension. Named customers include Ally Bank, Gemini and Ramp, plus a Suncoast Credit Union case study reporting fraud losses down more than 35 percent across 269 million logins verified annually. All customer figures are self-reported.
- How well funded is Alloy and is it stable?
- Alloy raised a 100 million dollar Series C led by Lightspeed in September 2021 at a 1.35 billion dollar valuation, then a 52 million dollar extension co-led by Lightspeed and Avenir Growth in September 2022 at 1.55 billion, which was an up round rather than a down round. No financing event has been disclosed since September 2022, so the last round is four years old as of this review. Revenue, ARR and headcount have never been disclosed, and the figures circulating on data aggregators are modelled estimates rather than disclosures. Co-founder Tommy Nicholas remains CEO.
- What are the best Alloy alternatives?
- Compare Alloy against other orchestration and decisioning layers rather than primary verification vendors: Sardine and Unit21 for fraud and AML decisioning, and Persona's workflow product where you want orchestration and first-party verification from one vendor. If you need the underlying verification itself rather than routing, look at Persona, Sumsub, Jumio or Onfido. Many institutions run both, with a primary IDV vendor behind an orchestration layer.
More Identity Verification vendors
All Identity Verification →Related on Start with Identity
- VendorAU10TIX
strong
- VendorBioCatch
strong
- VendorBureau
strong
- Comparisonjumio-vs-onfido
Jumio and Onfido do the same job: check a document, match a face, screen a watchlist. The split is independence against Entrust ownership, and SDK quality.
- Comparisonpersona-vs-veriff
Persona is a verification flow you design and branch. Veriff is a high-automation document and biometric check you switch on. How varied your users are decides
By SWI Community Team · Last evaluated 2026-10-16
Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to community@startwithidentity.com.