Cenvoriq Intelligence Network

Fraud intelligence and response infrastructure for connected financial systems

Fraud crosses accounts, devices, integrations, institutions and rails. Most controls see one fragment. Cenvoriq connects the fragments into intelligence your analysts can act on, with evidence that holds.

Become a Design PartnerExplore the Platform
Sentinel Engine 0.2.0Stage A replay · Stage B SHADOWGlobal by design
  TrustGraph · scenarios C + Dsynthetic data
API clientsyn_api_partner · integration 100Transaction2,000 XTS · 03:00 · new networkRecipientsyn_mule_1 · recipient 69Deviceshared by 3 accountsMulemule 85Mulepass-throughMuledormant → burstShared identityone factor, several accountsCash-out agentsyn_agent_7 · agent 85MULE CLUSTER · SHARED DEVICE
API clientintegration 100Transaction2,000 XTS · 03:00Recipientrecipient 69Deviceshared × 3Mulemule 85MuleShared identityCash-out agentagent 85
INTEGRATION_NEW_SOURCE_NETWORKMULE_SHARED_DEVICEMULE_RAPID_CASH_OUT
decisionrecommended BLOCK · applied ALLOW · SHADOWtrace 3 hops · cash-out in 30 min · evidence appended · verified
INTEGRATION_NEW_SOURCE_NETWORKMULE_SHARED_DEVICEMULE_RAPID_CASH_OUT
recommended BLOCK · applied ALLOW · SHADOWtrace 3 hops · cash-out in 30 min

The problem

Fraud is networked.
Defence is fragmented.

A compromised integration creates hundreds of transfers. A victim connects to a mule, the mule to a collector, the collector to a cash-out agent on another rail. Every institution sees its own slice, scored one transaction at a time.

  • Bankcore ledger
  • PSPacquiring · payouts
  • Mobile moneywallets · agents
  • TelecomSIM · device
  • API clientpartner integrations
  • Merchantcheckout · refunds
  • Insiderprivileged actions
  • Confirmed caseslabels · signals
Cenvoriq intelligence layerSentinel Engine · IntegrationGuard · TrustGraph · ControlGraph
  • Risk dimensions
  • Reason codes
  • Graph signals
  • Integration status
  • Recipient intelligence
  • Evidence record
  • Recommendation

Sentinel Engine

Separate dimensions. Never one magic score.

Who is acting, what is happening and to whom are different questions. Identity trust stays apart from behaviour, so a verified customer cannot mask a scam, and every score comes with the reason codes that produced it.

  • Ten dimensions, each 0 to 100 with its own contributions
  • A fixed recommendation ladder that rules can only raise
  • Baselines judged on established history, so a burst cannot normalise itself
Every dimension
  Sentinel Engine 0.2.0 · decisionsynthetic
Scenario F
Authorised scam pattern
Identity trust100
Account takeover0
Scam63
Transaction45
Recipient54
Mule45
Network0
Integration—
Agent—
Control—
RecommendedMANUAL_REVIEW
AppliedALLOW · SHADOW
Decisions1
ModeSHADOW
Reason codes
  • AMOUNT_OUTLIER
  • FIRST_TIME_RECIPIENT
  • HIGH_VALUE_LOW_ASSURANCE_CHANNEL
  • MULE_DORMANT_TO_EXPLOSIVE
  • MULE_UNRELATED_SENDERS
  • RECIPIENT_FIRST_TIME_SENDER_CONCENTRATION
  • RECIPIENT_MANY_SENDERS_1H
  • RECIPIENT_NEW_ACCOUNT

IntegrationGuard · TrustGraph · Mule and recipient intelligence

Integrations, recipients and cash-out paths are first-class subjects

An API credential that starts paying out at 03:00 from a new network. A new account collecting from ten strangers and forwarding within minutes. The engine scores both, and traces where the money went.

IntegrationGuard · syn_api_partnersynthetic
Established baseline · 30 days
  • —About ten payouts a day
  • —Business hours only
  • —One known source network
  • —Usual value under 100 XTS
  • —Ordinary recipient spread
  • —Route payouts, permission payouts:create
03:00 · anomaly detected
  • !Requests from a network never seen
  • !40 payouts to 40 recipients it has never paid
  • !2,000 XTS each, far above its usual value
  • !An hour this integration has never been active
  • !Novel route bulk:payouts
  • !Unexpected permission payouts:approve
Integration risk
100
RecommendationISOLATE_INTEGRATION
AppliedALLOW — SHADOW
Across 40 payouts
event stream · syn_wallet_alice · 14 transfers in 5 minsynthetic
  1. #08transfer to first-time recipient · RECIPIENT_FRAUD_PROXIMITY · risk 22ALLOW
  2. #09transfer to first-time recipient · RAPID_RECIPIENT_DISPERSAL · risk 53STEP_UP
  3. #10transfer to first-time recipient · RAPID_RECIPIENT_DISPERSAL · risk 55STEP_UP
  4. #11transfer to first-time recipient · RAPID_RECIPIENT_DISPERSAL · risk 57STEP_UP
  5. #12transfer to first-time recipient · RAPID_RECIPIENT_DISPERSAL · risk 57STEP_UP
  6. #13transfer to first-time recipient · RAPID_RECIPIENT_DISPERSAL · risk 57STEP_UP
  7. #14transfer to first-time recipient · RAPID_RECIPIENT_DISPERSAL · risk 57STEP_UP
first recommendation above monitor: transfer 92 connected to a confirmed case
TrustGraph · forward trace · 3 hops · 30 min to cash-outsynthetic
  1. syn_victim_c_0_0
    Victim pays a first-time recipient. Identity checks pass; the sender is genuine.
    victim
  2. syn_mule_1
    New account, ten unrelated senders in twenty minutes, almost nothing retained, device shared with two others.
    recipient 69mule 85
  3. syn_wallet_collector
    Collector receives from two mules within minutes and forwards on.
    collector
  4. syn_agent_7
    Cash-out agent unlike its cohort: fast inflow to cash-out, high-risk wallet concentration.
    agent 85investigation priority
  • MULE_PASS_THROUGH
  • MULE_UNRELATED_SENDERS
  • MULE_DORMANT_TO_EXPLOSIVE
  • MULE_SHARED_DEVICE
60evidence records, chain verified; a tampered copy fails at record 31
981synthetic transactions replayed with the label-leakage guard
100%precision on the synthetic corpus, 43.5% recall by design
59decisions scored; every applied action was allow (SHADOW)

Figures from the frozen synthetic reference run of Sentinel Engine 0.2.0. They describe the engine on invented data and say nothing about performance on real transactions, which no institution has yet provided.

Safe first deployment

Measure it before it touches a payment

During a SHADOW pilot, transactions continue normally. Cenvoriq receives a mirrored event stream, produces intelligence and recommendations, and allows the institution to measure its value without giving Cenvoriq authority over payment execution.

SHADOW MODE observing
Payment authorityNONE
Transaction impactNONE
IntelligenceACTIVE
Evidence recordRECORDING
Recommended · appliedBLOCK · ALLOW
01

Historical replay

Your historical tokenised events and labels
Cenvoriq replay engine, label-leakage guard
Measured signal quality and detection: precision, recall, alert rate, lead time, candidate clusters
exit replay engine and data deleted; you keep the report
02

Live SHADOW

Mirrored live event stream over a signed API
Cenvoriq intelligence layer in SHADOW
Recommendations, dimensions, graph signals and a verifiable evidence record for your analysts
while payments continue normally: no hold, block, delay, approval or modification
The design-partner programHow it works

Who it is for

Built for any institution whose fraud moves through connections

Banks and PSPs

Instant and account-to-account rails where the receiving account carries the signal.

Fintechs and platforms

API-first businesses whose integrations and partner credentials are an attack surface.

Telecoms and remittance

Agent networks, cash-out points and corridors modelled as entities and edges.

What the current release is0.2.0
  • Tested on every commit; durable PostgreSQL with forced row-level tenant isolation
  • Historical replay and live observe-only SHADOW for design partners
  • Tamper-evident Evidence Mirror with offline verification
  • No customer has run data through it yet
  • ADVISORY and ACTIVE stay closed in code
  • No external penetration test yet
All disclosures →

Design-partner program open

Bring a real fraud problem and your own history

A small number of banks, PSPs, fintechs, telecoms and remittance providers who want an honest measurement, including one that says the engine did not help.

Apply to Become a Design PartnerWalk through the demo