Fraud · Anomaly · Risk
Real-time fraud, anomaly and risk detection you can actually explain.
Rokkit scores every event with rules, unsupervised anomaly detection and a per-tenant model, blended into one number you can defend, with the reasons attached. It runs in shadow next to your stack and never acts on its own.
Why now
Fast decisions, opaque models, painful onboarding.
Real-time, but unexplainable
Fraud moves in milliseconds, yet most engines hand analysts a bare number that no reviewer or regulator will accept.
Black boxes don't pass review
A score you can't explain can't be signed off. Teams need the signals behind every decision, not just the decision.
Onboarding means a rebuild
Adopting a new engine usually means re-plumbing pipelines. It should be a mapping file and a shadow run, nothing more.
How it works
One pipeline, one explainable score, a human at the end.
Events are normalised to one canonical schema, scored by three complementary signals blended into a single number, turned into a case by the analyst copilot, and a person always makes the call.
- Ingest. CSV file drops or a REST feed map onto one canonical event schema with a declarative YAML mapping, with no bespoke parser per source.
- Score. Config-driven rules, an unsupervised anomaly model and (once there are enough labels) a per-tenant supervised model blend into one explainable score.
- Explain & triage. The analyst copilot summarises the case, correlates signals on the same entity and recommends next steps.
- Approve. Nothing is emitted until a human confirms. Approve & emit is the only way an alert leaves Rokkit.
Capabilities
Everything a risk team needs, on one chassis.
Explainable scoring
Every score carries the detectors that fired and a plain-language reason, not a black box.
Rule packs as config
Rules are YAML rule packs, so a new client is a config change, not a code change.
Cold-start anomaly
Unsupervised detection flags the unusual from day one, before you have a single label.
Per-tenant models
As analysts label cases, a tenant-specific supervised model trains and blends in.
Shadow mode
Consumes a copy of your stream, never inline. It observes and scores; it never blocks or acts.
Analyst copilot
Summarises each case, correlates signals on one entity and recommends next steps.
Multi-tenant + RLS
Postgres row-level security isolates each tenant, so data never crosses tenants.
Append-only audit
Who did what and when, per tenant, in a log the database won't let anyone alter.
Intelligence module
Entity and counterparty risk, on the same chassis.
A second module for verification, tracing, entity risk and due diligence over a person or company. It reuses Detect's rule engine, blend, entity-link graph and analyst copilot rather than rebuilding them, so every output carries the same explainable reasons, stays advisory with a human in the loop, and is tenant-scoped under row-level security and fully audited.
Verification
Checks identity number, date of birth and address for consistency and against reference lists, each flag citing its source.
Link and network graph
Surfaces connected people and companies, shared addresses, phones or accounts, and control rings as an ego graph.
Risk score, red flags
A config red-flag pack blends into a score, a band and a proceed, review or decline call, with plain-language reasons.
Due-diligence dossier
The copilot assembles evidence, flags and connections into a dossier with next steps, exportable as HTML or Markdown.
Real checks, with a person in charge: every check records its purpose and, where needed, the subject's consent. The official sanctions lists are live; paid verification providers switch on per workspace.
Add-on Early access
E-Tender Intelligence
Due diligence on South African public tenders, from National Treasury's eTenders data.
Tender monitoring and alerts
Search public tenders, set watchlists, and get alerted when a new or changed tender matches.
Supplier and bidder screening
Awarded suppliers and your bidders checked against sanctions and National Treasury's restricted-supplier lists, reviewed by a person.
Tender-integrity red flags
Explainable indicators such as repeat awards, split awards, amendments, and bidders who share directors or bank accounts.
Tender due-diligence report
Every supplier and bidder on a tender with their checks, flags and links, exportable in one click.
Coverage depends on what buyers publish on eTenders.
Risk-free adoption
Runs in shadow, right next to your stack.
Rokkit consumes a copy of your event stream, never in the live path. It scores, opens cases and measures itself against your analysts' own decisions, so you can see how it performs on your data before it influences a single outcome.
What shadow mode proves
- Scores every event and opens cases, but emits nothing.
- A precision / recall and confusion-matrix view built from your analysts' confirm / dismiss labels.
- Turn it live only when the numbers earn your trust.
Integration
Onboarding is a config file, not a rebuild.
Point an adapter at a CSV drop or a REST feed, describe how its fields map to the canonical schema in YAML, and run it in shadow. A new source, or a new client, is configuration, not engineering.
- Adapters: CSV file drop and paginated / NDJSON REST.
- Mapping: one declarative YAML file per source.
- Shadow first: validate before anything goes live.
# mapping.yaml: a source's fields to the canonical schema event_type: { from: txn_type } amount: { from: amt, parse: decimal } currency: { from: ccy, default: ZAR } occurred_at: { from: ts, parse: iso8601 } customer_id: { from: cust_ref } # unmapped fields are kept under attributes include_unmapped: true
Trust & governance
Built for POPIA, GDPR and PCI-DSS alignment.
Rokkit is designed so a regulated risk team can defend every decision and keep control of its data.
Tenant isolation
Postgres row-level security on every table; one client's data is never visible to another.
Human-in-the-loop
Rokkit explains and recommends. A person approves; nothing is emitted automatically.
No autonomous action
Detection runs in shadow by default; going live is an explicit, per-tenant decision.
Encrypted & audited
Secrets encrypted at rest; every meaningful action written to an append-only audit log.
Also available: Rokkit AppSec, authorised security assessment (known-CVE identification and OWASP Top 10 detection) for your own assets, under an explicit authorisation record. Detection and reporting only.
Get started
See Rokkit score your data, in shadow.
Book a walkthrough and we'll run Rokkit against a sample of your events, in shadow, and show you the scores and the reasons behind them.