FAQ

The questions that come up before a contract does

Grouped by who usually asks. If the answer you need is not here, ask us directly — the list gets updated from real questions, not from a keyword tool.

Product

Are all four modules actually live?

Yes. Sentinel, CreditGraph, PayRoute and Ledger Mind are all in production with paying customers. Sentinel and Ledger Mind have the longest production history; PayRoute is the newest of the four. Where a capability inside a module is not shipped, the module page says so rather than implying it.

Which chains do you cover?

Full coverage — all four modules — on Ethereum, Solana and Tron. Screening only on Base, Arbitrum One, Polygon PoS and BNB Smart Chain. Bitcoin is not ingested. The integrations page is the authoritative list and every API response repeats its own coverage.

Can we use one module without the others?

Yes. They share authentication and a rate limiter, and nothing else. Most customers start with one and add a second within a year.

Do you offer a UI, or is it API only?

API first, with a review console for analyst workflows — alert queue, evidence viewer, case notes. The console is included; it is not where the value is, and we would rather you integrate the API into the tools your team already lives in.

Scores and methodology

Is the risk score comparable to another vendor's?

No, and treat any vendor who says otherwise with suspicion. Scores are sums of weighted signals under a specific methodology. Ours decomposes so you can see exactly what drives a number; you cannot map that onto a competitor's index.

Can we change the weights?

Yes. Defaults are configurable on all plans; fitting weights against your own realised alert and loss history is included on Enterprise and available as a one-off engagement below it. Version pinning means a methodology change never moves your alert volume without you choosing it.

How do you handle false positives?

By exposing reason codes so you can tune rather than guess, and by treating a high false-positive rate as our problem to help fix. We publish a working note on why false positives happen and what actually reduces them.

What does a sanctions match mean in your response?

It is deliberately a separate boolean from the score, not a large weight inside it. A sanctions hit is a binary legal fact and should not be averaged with behavioural signals.

Integration

How long does integration take?

A first screening call takes about ten minutes from the quickstart. A production integration with webhooks, retries and your own alert routing is typically one to three engineering weeks depending on how much of that plumbing you already have.

Do you have SDKs?

TypeScript, Python, Go and Java. All thin wrappers over REST — you can ignore them entirely and the docs show raw cURL for every endpoint.

What are the rate limits?

Plan-dependent, returned in headers on every response, and documented on the errors and limits page. Burst allowances are generous; sustained limits are what your plan says.

Is there a sandbox?

Yes, with fixtures for known-bad addresses, thin-file wallets, congested-network routing and unmatched reconciliation items — the cases you need in a test suite and cannot conjure on mainnet.

Commercial and legal

How is this priced?

Three plans: Free, Builder at $499 a month, and contracted Enterprise. Metered overage above each allowance. The pricing page has the full comparison; the per-call metered rates on it are illustrative and come in writing after a short conversation about volumes.

Do we need to hold $FTAI to use the APIs?

No. No plan requires the token, and fee settlement in $FTAI is planned rather than shipped. The $FTAI page separates what exists from what is designed.

Are you SOC 2 certified?

A SOC 2 Type II audit is in progress, with the report expected in Q4 2026. Until it is issued we say "in progress", not "compliant". A bridge letter and the security pack are available under NDA.

Where is data hosted, and can it stay in the EU?

AWS eu-central-1 and us-east-1. EU-only residency is available on Enterprise, as is deployment inside your own VPC with no outbound calls. See security.

Still deciding?

A thirty-minute working session with your own data answers more than a page of FAQ ever will.