Product selections — vendor and platform tradeoffs and our choices
Product selections — tradeoffs and choices
Cross-stack record of what we evaluated, what we traded off, and what we chose. Each section links the governing decision entry; this entry is the comparative context behind those decisions. Prices verified 2026-11-14 — re-verify before external use.
1. CDR data layer (business banking data)
| Option | Cost | Coverage | Friction |
|---|---|---|---|
| Basiq Open Banking (CDR) | $0.50/user/mo, free sandbox | 136 institutions; gaps are account types (trust/business), not institutions | consumer accounts smooth; business needs authority chain |
| Frollo / Consentio / Fiskil / Adatree | quote-based | business/trust accounts via nominated representative | bank-side nomination step |
| Statements Upload (PDF/CSV) | per-vendor | point-in-time fallback | manual, no live data |
| DDC / Web Connector | declining | screen-scrape | banks actively block bots — transition-only |
Tradeoff: Basiq wins consumer CDR on cost and coverage; business/trust accounts need the authority chain (KYB → nominated representative → rep KYC → consent) that only some vendors productize. Choice: Basiq primary + guided authority-chain onboarding as differentiator; Statements Upload as fallback. → kb:cdr-vendor-dual-source
2. KYC / identity verification
| Vendor | Price/check | Notes |
|---|---|---|
| Didit | $0.33 | biometric, broad doc coverage |
| Zyphe | $0.30 | cheapest, narrower coverage |
| Veriff | $0.80–1.89 | enterprise-grade, premium |
| Socure | $0.80+ | risk-scoring focus |
| Sumsub | $1.35+ | KYB strength |
| Stripe Identity | $1.50 (first 50 free) | only if already on Stripe |
DVS (Document Verification Service): government fee $0.40 flat; Didit resells $0.45–0.75 vs Flagship $4 / OverSEER $5 per check. Choice: Didit primary ($0.33 + cheap DVS resale); Stripe Identity only as fallback inside Stripe flows.
3. Sanctions / PEP / adverse media screening
| Option | Cost | Notes |
|---|---|---|
| DFAT consolidated sanctions list | FREE | Australian sanctions — must-have, zero cost |
| ComplyAdvantage | ~$0.10/screen | PEP + adverse media coverage |
| dilisense | €0.10/call or €300/mo (10k calls) | high-volume option |
Choice: DFAT free as baseline + ComplyAdvantage for PEP/adverse media at ~$0.10/screen.
4. Knowledge-base publishing / edge
| Option | Cost | Git as truth | AI-update path |
|---|---|---|---|
| Cloudflare Pages + Access + Workers | $0 at KB scale | yes | Worker → GitHub commit → auto-rebuild |
| Firebase (Hosting+Auth+Firestore) | $0 tier | no — Firestore canonical | Firestore writes (breaks compile gates) |
| Local host + Cloudflare Tunnel | $0 | yes | depends on Mac being on 24/7 |
| ngrok | $0 | yes | interstitial warning page (friction) |
| AWS serverless (S3+CloudFront+Lambda@Edge) | ~$1–5/mo | yes | 10x setup effort for same outcome |
Choice: Cloudflare Pages + Access (Google auth wall) + Workers, behind the seam with local equivalents (wrangler dev / mkdocs serve). AI Search (GA Oct 2026) covers managed search/RAG later. → kb:edge-via-seam
5. Language / compute model
| Option | Containers | Serverless | Bank fit |
|---|---|---|---|
| Go | best-in-class (static binaries, ~10–20MB images, ms cold starts) | good (Lambda provided.al2, no JIT warmup) | rare expertise, but banks run the image not the code |
| C# / .NET | good (~200MB+ images) | smoothest (Azure Functions native) | most bank-familiar estate |
Tradeoff: banks are containers-first, serverless-averse for regulated workloads (control, auditability, data residency). Serverless↔container portability = one binary, two entrypoints, one-shot handler discipline, queues for async, env-only config, env-selected store adapters (queues/Dynamo transaction work; SQL or analytics-direct long-term). Choice: Go core; C# only as a thin bank-facing adapter if a bank demands it. Architecture rules codified in factory/AGENTS.md (PR #13).
6. Form distribution (DSL IP protection)
| Option | DSL exposed | Update path |
|---|---|---|
| Ship DSL + compiler | yes — IP gone | consumer-side |
| Precompiled JS bundles (JotForm model) | no | CI recompile → static asset deploy |
Choice: precompiled self-contained JS bundles only; compiler and DSL never leave the repo; submission contract is the public API; source maps never published. → kb:dsl-compiler-never-distributed
7. Cheap website platforms (GTM funnel)
DigitalPlat One (EdgeAlphix LLC): Pages/Hosting/Website Builder/Short Links/Forms/Mail Relay at near-zero cost; free namespaces' ToS warns against branding/production reliance, paid tiers marketed for production. Choice: use for disposable marketing sites per segment (AML for accountants, tranche-2 checklist) and SEO content; product login/subscriptions stay in our stack (paywall) — never let a website builder own customer auth or data.
8. Bank deployment model
Choice: self-hosted Docker on the bank's EKS + source-code escrow; deployment-agnostic (config-driven, containerized, no hard-coded endpoints). Reference: NAB runs 90% cloud (AWS-primary + Azure + GCP), EKS/GitOps/Terraform.
Sources
- kb:cdr-vendor-dual-source, kb:edge-via-seam, kb:dsl-compiler-never-distributed (decision entries)
- kb:aml-tranche2-market-analysis (competitor pricing)
- Session research 2026-11-14: Basiq/Frollo docs, KYC vendor pricing, Cloudflare limits/AI Search GA, DigitalPlat One dashboard
- factory/AGENTS.md, factory PR #13 (architecture rules)