The COSMOS platform

One platform for the entire alert-to-SAR lifecycle

From the first risk signal to the filed report, COSMOS runs every step in a single workflow — no exports, no swivel-chair, no blind spots.

Join the watchlist Early-stage partners

Risk scoring

No more risky business.

Every customer carries a live risk score built from behaviour, geography and KYC signals. Scores recompute the moment new evidence arrives — and every change shows the factors behind it.

  • Configurable scoring, no data-science team required
  • Per-factor breakdown recorded on every assessment
  • Full explainability for every score change
Customer risk · Scoring in progress

Transaction monitoring

Spot unusual transactions as they happen.

Real-time monitoring with review-policy config to decide which rules trigger which actions — Hold Pending Review, Silent Alerting, or Immediate Reject / Refund.

  • Per-rule review policies, fully configurable
  • Actions: hold, silent alert, or auto reject / refund
  • Real-time and batch in the same engine
Transaction stream · last 60s
Scanned 8,412 Flagged 3 Cleared 8,409

Alerts & triage

Cut the noise, keep the signal

COSMOS scores every alert by your risk appetite, ranks it P0–P4, and applies the disposition your rules define — hold, alert-only, or reject/refund — so analysts spend their time on genuine risk.

  • Configurable priority scoring, P0–P4
  • Per-rule dispositions: hold, alert-only, reject/refund
  • Irreversible actions ship shadow-first, with human review on escalation
Triage · queue (sample)

Cases & SAR drafting

Move away from overflowing sheets and unreadable docs.

Escalate an alert into a case, route it to the right team, and compile a SAR/STR draft from reusable narrative templates — every decision, signal and source captured in the audit trail.

  • Configurable workflows, SLAs and routing
  • Reusable SAR/STR narrative templates
  • Append-only audit trail on every action
Case COS-2249 · SAR draft (sample)

Preparing draft… 06%

Integrations

Designed to plug into your stack

A typed public API and signed webhooks are live today — stream transactions and customers in, read alerts and cases back out. Prebuilt connectors to the tools below are on the roadmap.

On the roadmap

Chainalysis
Elliptic
SumSub
LSEG
Intercom
Slack
Atlassian
Snowflake
AWS
LexisNexis
Blockchain explorers
…and more

Building against the API today? See the developer docs — and tell us which connector you need first.

Security & isolation

Built for the most regulated teams

The parts you can't retrofit — encryption, isolation and auditability — are in the foundation. Here's what's live today, and what's on the roadmap.

Per-tenant encryption

AES-256-GCM field encryption with a dedicated key per tenant — one tenant's key can never unlock another's. PII is ciphertext at rest, with blind-index search so lookups still work.

Row-level isolation

Postgres row-level security is enforced on every tenant table, so one tenant's data never crosses into another's — isolation at the database, not just the app.

Auditable & explainable

An append-only audit trail on every action, and every risk score records the factors behind it. We'll walk your security team through the isolation model.

On the roadmap (targeted, not yet held): SOC 2 Type II & ISO 27001, customer-managed keys (BYOK), SSO, and EU/US/UK data residency.

Roadmap

What we're building next

We build in the open with our early-stage partners. Here's the honest sequence — nearest first. Dates depend on partner demand, so this is direction, not a delivery promise.

Next

  • SOC 2 — Type I, then Type II. The trust baseline enterprise buyers ask for first.
  • SSO (SAML / OIDC) — enterprise sign-in alongside the existing RBAC.
  • Auto alert→case linking — closing the last manual step in the pipeline.

Then

  • Customer-managed keys (BYOK) — bring your own key material to deepen the isolation story.
  • ISO 27001 — international certification once SOC 2 lands.
  • First prebuilt connectors — Chainalysis and a KYC provider, driven by partner demand.

Later

  • EU / UK data residency — regional deployment options.
  • Wider connector library — Elliptic, SumSub, LSEG, LexisNexis and more.
  • Sandbox test mode — a safe environment to trial rules against synthetic data.

See the full platform in action

Join the watchlist for early access, or come in as an early-stage partner and shape what we build next.

Join the watchlist Open the workspace