How it works

From form submit to verdict in 73 milliseconds.

A walkthrough of what actually happens when a user clicks Sign Up on a page protected by Veritus — from the browser, through enrichment, into the model, and back.

1

User submits your signup form

The Veritus widget intercepts the form’s submit event before it hits your server. The form fields (name, email, phone, address, country, password hash, plus optional custom fields) are bundled into a JSON payload along with the widget’s behavioural signals (time-to-fill, paste-vs-type, focus events).

If you’re using the API rather than the widget, you build the payload yourself and call POST /v1/score with your bearer token.

2

Veritus enriches the payload

In parallel, the scoring node fans out lookups against the seven enrichment sources. Most are answered from Redis cache (hit rate >90% in steady state); cache misses go to the underlying provider with short TTLs.

// parallel fan-out, all complete in <60 ms typical
email_check(payload.email)      // syntax, MX, disposable, age
phone_check(payload.phone)      // validity, line type, carrier
address_check(payload.address)  // UK + intl postal validation
ip_check(connection.ip)        // geo, ASN, VPN/Tor
breach_check(payload.pwhash)    // HIBP k-anonymity
consistency_check(payload)     // geo alignment
behaviour_check(widget_signals) // widget-only
3

LightGBM model scores the enriched payload

The combined feature vector (around 80 features after one-hot encoding the categoricals) is passed to a LightGBM classifier loaded into memory at startup. Inference is ~2 ms; the model returns a probability between 0 and 1.

If you’ve been training Veritus with your own labels for at least 30 days, your customer-specific model layer is consulted alongside the global model and a weighted average produces the final probability.

4

Score becomes verdict

The 0–1 probability is multiplied by 100 and compared against your configured thresholds:

  • Score ≥ block threshold (default 85) → block
  • Score ≥ review threshold (default 50) → review
  • Otherwise → allow

Your allow/block rules are evaluated alongside the score and can override the verdict. A rule like “always block *@temp-mail.io” will block regardless of score.

5

Reasons are attached

SHAP-style feature attribution identifies the top signals that pushed the score up. Reason codes are returned as a list of stable strings so you can switch on them programmatically:

"reasons": ["ip.tor_exit", "phone.voip", "email.young", "password.breached", "geo.mismatch"]
6

Response is returned

The full response — score, verdict, reasons, advice, latency, check ID — is returned to the widget or API caller. Total wall time from form submit to verdict: typically 73 ms.

The widget acts on the verdict automatically: allow lets the original submit fire, block shows a friendly message, review submits but flags. API callers decide for themselves.

7

Verdict lands in your dashboard

The check is written to PostgreSQL with full payload (encrypted at rest) and streamed to your dashboard’s live feed. Webhooks fire if you’ve configured them.

If you later confirm or overturn the verdict (e.g. release a quarantined signup that turned out to be real), that decision becomes a training label for tomorrow’s model retrain.

How Veritus compares to alternatives

Approach Catches modern fraud Friction for real users UK data residency
CAPTCHA onlyNoHighDepends on vendor
Email validation APIPartialNoneRarely
US fraud SaaS (SEON, IPQS)YesLowNo
VeritusYesNoneYes

Sign up — 1,000 hits a month, free forever.

No credit card, no trial countdown, no expiry. Every account gets 1,000 fraud checks per month for life. Upgrade when you outgrow it.