You built payments into the platform. Connect the risk around them.
Your software earns the subscription. Your payment service carries a different risk. SENTR connects merchant activity, end-customer behaviour and payment events so you can investigate the money moving through your platform—not just the invoices paid to it.
Platform · merchant · end-customer context together
SaaS billing kept separate from facilitated payments
A paid subscription does not make a merchant trustworthy.
Product teams add payment features faster than risk can standardise policy. Each merchant wants a different appetite;
platform liability does not change with their preference. End-customer signals live in product systems fraud tools never
see — and engineering will not accept another opaque box that cannot explain a declined merchant payout.
Tenant risk appetite varies while platform exposure stays concentrated.
Facilitated payments scored as if they were your own SaaS subscription charges.
MOTO and operator-entered flows with weaker device signals than self-serve checkout.
Protected platform journey
Nested risk from onboarding through settlement — still limited to events and fields you can supply.
Treat SaaS billing and facilitated payment volumes as separate protected planes even when they share a processor.
How the decision is composed
Platform programmes fail when billing risk policy is copy-pasted onto facilitated money movement. Composition keeps the planes distinct.
Platform decision anatomy
01Separate money planesSaaS subscription billing is not the same risk surface as facilitated payments. Map them as distinct event families so policy appetite does not bleed across.
02Nested identifiersConnect platform, merchant and end-customer identifiers from the events you supply, so each decision has the relevant context.
03Rules & scoring by planeOnboarding, facilitated payment and settlement can use different profiles while sharing entity history.
04Decision & action policyAllow, review, block, case or webhook — with explanations that survive engineering and partner review.
What this looks like in practice
The subscription clears. The merchant’s payment activity needs review.
A merchant’s monthly platform subscription clears without friction. The same week, end-customer MOTO charges spike through that merchant with reused cards and mismatched shipping identifiers.
SaaS subscription clears
MOTO charge spike
Reused cards · ship mismatch
Merchant settlement
Response
Settlement → review · SaaS access stays open
Evidence
Facilitated-payment velocity and identifier mismatch — separate from billing policy
Finance does not freeze a healthy account for a payments problem — and risk does not ignore settlement because the subscription looked fine.
Product status
Map platform, tenant and payment events through universal ingestion, then connect entity decisions, explanations and review queues. Integrations require field mapping rather than assumed native connectors. For qualified SENTR.Citadel teams, read-only Shadow Mode evaluates an agreed scope alongside current controls.
Inside the workflow · illustrative configurations
Separate the subscription from the risk you facilitate.
A merchant paying your software invoice tells you little about the end-customer payments they submit. Configure those as different event and policy questions.
Illustrative mechanism
Healthy billing does not clear the merchant lifecycle.Read the diagram
Merchant onboarding, facilitated payments and payout each need their own event policies, with connected history between them. The platform application controls the business action. This is not a payment-rail connector or a claim that SaaS billing and end-customer risk are the same problem.
01The software subscription is healthy; MOTO activity is not
Connect the context
Map platform, merchant and payment references plus available instrument identifiers and historical outcomes. For operator-entered MOTO, do not treat the operator’s device as the cardholder’s device.
Configure the response
Evaluate facilitated-payment velocity and supplied merchant context separately from SaaS billing. Missing end-customer signals must remain missing—not inferred from a browser that belongs to staff.
Investigate and learn
Inspect the merchant’s pattern and linked instrument activity, collect the relevant records and assign the case. Keep actual fraud outcomes distinct from an unusual-volume alert.
02Merchant activity changes before settlement
Connect the context
Join merchant onboarding, account changes, facilitated payments, refunds and payout requests where those events are available.
Configure the response
Use event-specific profiles and decision policies; return the outcome to the application that controls settlement. Keep provider-native controls in their existing role.
Investigate and learn
Follow the case across merchant and end-customer context. Record the conclusion and assess noisy rules, case age and outcomes through standard or SENTR.Citadel custom reporting.
No. SENTR can evaluate mapped events alongside payment providers and internal systems. It is an independent decision and operations layer, not a payment processor. You need a supported data path and explicit response handling; named-provider integrations are not assumed to be prebuilt connectors.
Why separate our subscription billing from customer payments?
The company paying for your software and the end customer paying a merchant create different events and risk exposures. A low fraud rate on platform subscription billing does not establish that facilitated payment or MOTO activity is low risk. Map both planes and assign their controls separately.