Alloy release round-up: July 2026

Featuring a smarter, more auditable Alloy AI Assistant and self-service aggregation rules for logins

While some people vacation in July, we were busy shipping! Even the non-headlines are all significant projects that we’re proud of, so brace yourself and read to the end!

This month, Alloy’s AI Assistant got materially more capable and transparent in how it reasons through KYC and KYB workflows. We also now support self-service aggregation rules on login events, bringing flexible and real-time risk-based decisioning to authentication. Alongside those we’ve got: new dashboard navigation, significant Journey latency improvements, and a fresh batch of data integrations!

Alloy’s AI Assistant keeps getting smarter

We've made significant updates to the AI Assistant's ability to solve for various KYC and KYB use cases as part of automating your review process. Also, just as importantly, we’ve improved how transparent and auditable that work is.

See how the AI Assistant reasons. You can now follow the agent's chain of reasoning in real-time as it reviews an application. You get the step-by-step logic behind every recommendation, like which sources it checked, what it found, and how it got there. That makes agent output far easier to trust, and gives your team (and your auditors) a clear record of the why behind every decision.

Continuous improvement to catch what traditional manual review misses. The AI Assistant isn’t static; we're continuously tuning iterations of the agent, and they're already surfacing risk that slips past manual review. In one recent KYB case, an applicant presented as an allowed business category and had been approved by a human reviewer, but the AI Assistant found public web evidence that the same business also operated in a category prohibited under that customer's policy, and flagged it in its summary. Subtle catches like this are often overlooked in human manual reviews but are simple for the Alloy AI Assistant.

AI Analysis, now on your terms. The AI-generated summaries for Evaluations, Journey Applications, and Investigations that used to live only in the Alloy dashboard are now available via API and webhooks. Kick one off with an API request, subscribe to the webhook to know the moment it's ready, and pull cached results anytime with no regeneration cost. Customers and partners who review outside the Alloy dashboard can now have full programmatic access to these timesaving summaries.

Self-service aggregation rules on logins

Risk-based authentication with flexible self-service rule writing has been one of our most-requested capabilities, and until now clients had to rely on IEV (Identity Element Velocity) or custom workarounds to catch suspicious login patterns. Now, our Aggregations service supports login events as a dynamic object, on the same real-time, high-throughput data infrastructure that already backs entity and transaction aggregations.

You can load and decision on aggregations over login history in real-time — a natural fit for risk-based authentication. Write rules directly against standard login fields and device-detail fields like IP address and device alias. A few examples:

• Count of logins for this entity in the last 7 days > 3
• Count of logins from this device alias in the last 24 hours > 10
• Distinct count of IP addresses per entity in the last 30 days
• Count of distinct last names per device in the last 30 days

Login Aggregations also support data routing from third-party device intelligence vendors directly into your rules. Iovation and Socure are live today, with others coming soon.

Also shipped in July 2026

Platform & product

• New dashboard navigation. A redesigned sidebar rolls out as part of the incremental release of our new frontend dashboard. That gives you cleaner grouping of similar pages, collapsibility, better scrolling and interactivity.

• Flexible Custom Lists. Alongside general availability, we re-architected how Custom Lists are stored and served so your team can manage rows, columns and expirations directly, keeping decisions accurate and up to date without waiting on engineering support. Existing API endpoints are unchanged.
• Significantly faster Journeys. A really cool new architecture involving write-through caching shaves roughly half a second off p50, p95, and pMax execution time on every Journey Application. That means larger savings on larger Journeys, no action needed on your end.
• Application Queue: single- and multi-entity outcomes. View single- and multi-entity Application Entity Outcomes directly from the Application Queue, with new filtering to surface exactly the results you need.
• Alerts Queue: counterparty column + filtering. A new counterparty column and filtering on the Alerts Queue.
• Easier Data Routing. More flexible, dynamic data routing inside workflows, including support for routing on save and clone.

New data integrations

• CRB Monitor Businesses. Search and retrieve detailed profiles of cannabis-related businesses. Look at things like industry tier classification, ownership, and subsidiary relationships to support enhanced due diligence and compliance workflows.
• GeoComply BrowserGuard (SDK plugin). Geolocation and device-integrity signals delivered through a new SDK plugin.
• BioCatch Interrupted Session Support. Behavioral-biometrics coverage now handles interrupted sessions end-to-end across the SDK and dashboard.