Decide who gets through, in milliseconds
FraudZero is an anti-fraud rules engine. You describe the data you receive, write the rules that decide on it — in plain language, with words instead of symbols — and the platform answers approve or deny on every request.
One rule, two ways to write it
Write the script or draw the flowchart. One of them is the source of truth — the other is generated — and you decide which, rule by rule.
let score = input.risco + input.velocidade
if score > 80 and input.pais is not "BR" {
Deny("risco alto no exterior")
} else if score > 5 {
Deny("risco elevado")
}In words: it adds the risk score to the velocity count. A score above 80 coming from outside Brazil denies for high risk abroad; otherwise, a score above 5 denies for elevated risk. Reaching the end without denying approves.
Words, not symbols
and, or, is, between, in. Reaching the end without a single Deny approves — there is no "approve" to write.
The editor knows your input
After input. it offers the fields you declared, and only those. A syntax error is underlined on the right column, before you save.
One truth at a time
In drawing mode the server compiles the blocks into a script on save. In text mode the drawing is ignored and never even stored.
The detection tree, drawn
Each shape is a step of the script, and the number inside it is the step number. The drawing is not an illustration of what the rule does: it is the rule.
Shapes
The number in each shape is the matching step in the script.
How a group evaluates
The group's rules run by priority and, on a tie, by order.
The first Deny wins and the evaluation STOPS there.
Reaching the end without a single Deny approves. The decision is binary, not a sum.
Rules from those who already solved it
One company publishes a rule; another acquires the one that fits its input. As an editable copy or as use-only — and the script never leaves whoever wrote it.
Blacklisted card
Antifraude BR
Velocity by document
Rede Pagamentos
Restricted MCC range
Acquirer Norte
No card shows the expression. It is not a missing permission — the listing simply does not carry it.
The script never leaves
The listing says what the rule decides and which fields it consumes. Expression, AST and references show up for no account, under no role.
The field mapping is mandatory
The author's rule speaks their vocabulary; your input has another. The acquisition wires one to the other and is refused if any field is left unmapped — finding that out in production would cost dearly.
With reference, fixes arrive on their own
A copy is yours to edit and gets no fixes. A reference is execution only, and when the author fixes the rule the acquirer's units rebuild the bundle.
Every evaluated request becomes a record
The unit returns every decision to the console in batches, over a port that only exists on loopback. The aggregate is kept hourly, so "how many denials today" never scans the table.
Evaluations per hour
Evaluations in 24h
12,480
Denied
3.1%
Average latency
0.015 ms
Alert configuration
Recording never slows the decision
The unit does not wait for the console: it drops the event on a roomy channel and keeps answering. If the channel fills up, the event is discarded with a log warning — this is diagnostics and statistics, not bookkeeping.
Who can do what — and what was recorded
Roles per operation, bundled into IAM-style policies. Plus an append-only trail that the console itself neither edits nor deletes.
Roles bundled into policies
The role is the permission atom, one per operation. The policy is the bundle, IAM-style — and the policy is what you grant a person.
Seeing the code is a separate right
Without RuleScriptRead the response omits the expression and flags script_hidden. You can distribute the decision without distributing the intelligence.
Mandatory second factor
TOTP for every account, with no way to turn it off. Sign-in has two stages, and the password-stage token opens no route at all.
A hierarchy that only goes down
The parent reaches the branches and their own children. A branch never reaches the parent — except for what the parent shares, explicitly.
Audit trail
ana.souza updated the rule risco-cartao-exterior
2 min agocarlos.lima published on the marketplace velocidade-documento
18 min agoana.souza rotated the unit's token transacao
1 h agoroot-admin approved the registration Acme Pagamentos Ltda
yesterdayWritten by a middleware after the response, on every request that changes something. Append-only: no route edits or deletes a line of the trail.
Rules in plain language
Write the decision the way you write a sentence: if, else, and, or, between. No developer in the middle.
Visual builder
The same rule drawn as a flowchart, with a decision diamond and Yes and No paths. Drawing and script are one and the same.
Decisions in milliseconds
Each input has its own processing unit, always up, answering approve or deny over HTTPS.
Data from where you already keep it
Plug in a CSV or your own database and query it from inside the rule, without exporting anything anywhere.
History and numbers
Every evaluated request becomes a record: the decision, the rule that weighed in and the payload. Volume, denial rate and latency on one dashboard.
Rules marketplace
Publish a rule for other companies or acquire someone else's — as an editable copy or as use-only, without exposing the script.
Accounts in a hierarchy
A parent company and its branches, each with its own rules. The parent reaches the children; a child never reaches the parent.
Fine-grained permissions and MFA
Roles per operation, bundled into policies. Mandatory second factor. Seeing a rule's code is a permission of its own.
Audit trail
Who changed what, and when. Append-only: the console neither edits nor deletes its own trail.
How to get started
Send your company registration with your contact details. You get a protocol number right away; our team reviews it and, once approved, the administrator you named receives the invitation by e-mail.
Register my company