Customer Risk (Pilot)

Pilot — Customer risk is in pilot. To join, write to Support. The API and the webhook described here can still change during the pilot.

If you sell usage (API calls, tokens, minutes), some of your customers can abuse it: a sudden burst of usage, several accounts run by the same person, usage from an unexpected country. Customer risk finds these customers from the usage you report, and tells you what Inflow recommends.

Inflow never acts on your customers. You receive a recommendation, and you decide.

How it works

You report usage. Each time one of your customers consumes something, your server sends Inflow a usage event.
Inflow analyses it. Twice a day, at 06:30 and 18:30 UTC, Inflow looks at the activity of each of your customers over the last 24 hours and the last 7 days.
A person at Inflow reviews every finding. An automated finding never reaches you directly. The reviewer confirms it or dismisses it, and chooses a level and a recommended action.
You receive a recommendation. When a finding is confirmed and approved for sending, you receive the risk.customer_flagged webhook, within about 10 minutes.
You decide. You can watch the customer, ask them to sign in again, ask for an identity check, or suspend them in your product.

What you receive

Each recommendation names one of your customers and carries three values.

Value	What it tells you
`level`	How serious the risk is: `normal`, `elevated` or `high`.
`category`	What kind of risk Inflow found (see below).
`recommendedAction`	What Inflow recommends: `monitor`, `require_reauthentication`, `require_kyc` or `suspend`.

You never receive a score or the rule that fired. The categories are broad on purpose: naming the exact rule would tell a fraudster which limit to stay under.

`category`	What Inflow found
`usage_anomaly`	The customer's usage is unusual: much higher than their own recent usage, or much higher than your other customers.
`linked_accounts`	The customer shares an IP address with other customers. Inflow compares the IP addresses you report across all Inflow merchants, so a link with a customer of another merchant counts.
`location`	The customer's usage comes from a country other than their billing country.

What you need

A secret API key (inflow_prod_…). Public and SDK keys are not accepted.
Your customers as Inflow customers (cus_…): every usage event names one.
A webhook endpoint subscribed to risk.customer_flagged. A marketplace also subscribes to connect.risk.customer_flagged for the customers of its sub-merchants. See Customer risk.
Optionally, the details of your end user on each event: IP address, user agent, country and the id of the API key you gave them. Without them, Inflow can only find usage anomalies: the linked_accounts and location categories need the IP address and the country.

Start the pilot

Tell Support that you want to join, and which account sends the events.
Send your usage events. Start with a batch of past usage from the last 35 days, then send events as they happen. See Customer usage events.
Subscribe your webhook endpoint to risk.customer_flagged.
Decide, before the first recommendation, what your product does for each recommendedAction.

What Inflow does not do

Inflow does not block, suspend or charge your customers. It recommends; you act.
Usage events are not invoiced and do not change any amount.
Inflow does not send you a finding that its reviewer dismissed.

Your end users' data

All the details of your end user are optional. Send only what you have the right to share.
Inflow uses the IP address you report to find linked accounts across Inflow merchants. It does not show you another merchant's customers or data.
client_ip and client_user_agent are deleted 12 months after Inflow receives the event. The rest of the event is kept as the record of the usage.