The trust and safety tech stack: best tools for each layer in 2026

A trust and safety tech stack is the set of tools a platform uses to decide who can join, which accounts and sessions to trust, what content stays up, and how each case is reviewed and enforced. Most teams build it in layers: identity verification at signup, device and network intelligence, fraud and risk decisioning, content moderation, case management and threat intelligence, plus account investigation, the research into who is behind an account. Sixtyfour works in that investigation layer: give it the email address, phone number, username or name an account has used, and it researches public sources and returns the person and the related accounts it finds, each finding with its source.

This guide takes each layer in turn, names the tools teams use for it, and says what each one does well and how it is sold, from the vendors' own sites as checked on 4 November 2026. We make Sixtyfour, so it is the first entry, and its section sets out what it does, what it leaves to the other layers and the evidence behind it. Our guides to linking related accounts and finding out who is behind a fake account go deeper on the investigation method.

We split the stack by the question each layer answers, because tools that sound alike often answer different ones. Identity verification checks that a real person matches a document at a moment in time. Device intelligence recognises the hardware and session behind a visit. Fraud decisioning scores an event, such as a signup, login or payment, against your platform's own signals and the data the vendor adds. Moderation judges a piece of content against your policy. Case management records who reviewed what, and why. Threat intelligence watches for harm being organised elsewhere. Account investigation researches who is behind an account, mostly from evidence outside your platform.

For layers 2 to 7 we chose two to four tools whose own sites describe that job directly. Many of them span more than one layer, so we place each where its own site leads and say when it also covers a neighbouring one. Every fact and price below comes from the vendor's own pages, checked on 4 November 2026. Prices change, so confirm before you budget. Within a layer the tools are not ranked. We make Sixtyfour, the tool in layer 1.

Layer 1

Account investigation and identity research

Who is behind this account, and which other accounts are theirs?

After a report, a flag or a ban, and when a new account looks like an old one

Credits, with a Free plan of 64 credits. Atlas and Lattice enabled on request for Enterprise customers

Layer 2

Identity verification

Is this a real person who matches their ID?

At signup, and again before payouts or other higher-risk steps

From $250 a month

From $0.80 a verification

Through sales

Formerly Onfido

Through sales

Layer 3

Device and network intelligence

Have we seen this device before, and is the session hiding something?

From the first visit, on every session

Free up to 1,000 API calls a month, Pro Plus $99 a month

Volume-based, with a free proof of value

Layer 4

Fraud and risk decisioning

Should we allow, review or block this signup, login or payment?

At each signup, login and payment

Through sales

Starter $699 a month

Through sales

Layer 5

Content moderation

Does this post, image or message break our policy?

Each time the account posts

Formerly Hive

$3.00 per 1,000 visual and $0.50 per 1,000 text requests on its entry tier

By demo

Layer 6

Case management and enforcement

Who reviews this, what did we decide and why?

From the first flag to the last appeal

Through its team

Through its team

Layer 7

Threat intelligence

What harm is being organised elsewhere that will reach us?

Continuously, often before the harm reaches your platform

ActiveFence, from Alice

By demo

By demo

Sixtyfour builds research agents for people and companies, sold through a web app and one API. In trust and safety work its job is the question that lands on an analyst once an account has been flagged: who runs this account, and what else do they run. You start from what the account has given you. Our trust and safety page puts it as "Start with an email or username", and the People Intelligence endpoint also takes a name, a company, a location or a profile URL. An Atlas investigation can also take up to five attached files, images or documents, such as screenshots of what the account posted.

From there Sixtyfour researches public sources, including the open web, public records, directories, archived pages and profiles on other sites, and links accounts through what their operator reused off your platform: a distinctive handle or handle pattern on forums and other platforms, or an email address or phone number that appears in older listings and profiles. Our trust and safety page describes a seller who returns under a new name, and the agents linking the new account back to the same operator. Reverse Email and Reverse Phone return the person behind an email address or phone number. Lattice, in beta, turns rows of your own accounts into one graph and finds groups of different-looking accounts that reuse the same phone, email or address. Lattice never merges two people on a name alone, and when it is not sure it asks a person.

Every finding comes back with its source. People Intelligence returns each source it read with what it found there, and with confidence scoring switched on each field gets a 0 to 100 score, a short justification and the URLs it was read on. Atlas builds a workspace and an attribution graph that links every finding to its source, then writes a report. Anything the agents could not establish is reported as open, and a person on your team decides what happens to the account.

Sixtyfour is listed first because we make it. The evidence for its research is RECON, a benchmark of 140 people and 514 verified fields that Sixtyfour built and HUD validated externally. Each answer is graded correct, wrong or missing by a GPT-4.1 mini judge that agreed with human review on 98.5 percent of a 200-field sample, and weighted accuracy is the number of correct answers minus wrong ones, divided by all fields. Sixtyfour XHigh scored 70.6 percent (434 correct, 71 wrong, 9 missing), against 41.1 percent for the strongest external system, Parallel Ultra 2x. GPT-6 Astra had the highest precision, 90.6 percent against XHigh's 85.9. Sixtyfour built RECON and offers five of the systems evaluated, and the benchmark measures people research only, so it says nothing about the other six layers.

Sixtyfour leaves several jobs to the other layers. It does not verify identity documents or selfies, fingerprint devices, or hold IP address or device data, so those signals come from layers 2 and 3. It does not score signups or payments, moderate content or run your review queue. Its research reaches what is public, so who registered an account and how it logs in stay with your platform's own records.

As of November 2026, People Intelligence, Reverse Email and Reverse Phone are API endpoints priced in credits, with a Free plan of 64 credits given once and paid plans that add a monthly allowance. Atlas and Lattice are available to Enterprise customers and enabled on request, and an MCP server connects Sixtyfour to AI assistants. Choose Sixtyfour when an account has been reported or banned and you need to know who runs it, whether a new account belongs to someone you removed, or whether a cluster of accounts is one operator, with evidence a reviewer can check.

This layer answers whether a real person, present at the camera, matches the identity document they hold. It runs at signup, and again at higher-risk moments such as a first payout or an account recovery.

Persona describes itself as a way "to verify real people and real businesses online". Its verifications include government ID, selfie, database, and phone and email checks, as well as selfie age estimation, and its platform adds Graph, which it says can "Detect coordinated fraud in real time with link analysis and signals", and Cases for review. As of November 2026 its Essential plan starts at $250 a month with a 12-month minimum term, Growth and Enterprise are priced on request, and eligible startups, small businesses and developers can apply to the one-year Persona Startup Program, which includes a monthly allotment of free services on a select set of its products.

Veriff verifies people "using document checks, face matching, and liveness detection", supports more than 12,500 documents across more than 230 countries and territories, and can estimate age from a selfie with no ID document. Its network also flags identities, documents and devices that have shown risk elsewhere in that network. As of November 2026, self-serve plans start at $0.80 per verification with a $49 monthly minimum, rising to $1.39 and $1.89 for plans that add review by trained specialists, with a 15-day free trial. Above 5,000 verifications a month, Enterprise pricing is custom.

Jumio supports more than 5,000 ID types and pairs verification with biometrics, including liveness detection, face matching and age estimation. Its Jumio Identity Graph, which it describes as a network of more than 30 million identities, is used to recognise trusted returning users and block repeat fraudsters across transactions. Jumio sells through its sales team.

Entrust Identity Verification, formerly Onfido, combines AI biometrics, document intelligence and device and behavioural signals, and lets an identity established at onboarding be reused for authentication, account recovery and higher-risk transactions. Pricing is available from Entrust's sales team.

Choose this layer when a fake or stolen identity is expensive: sellers who get paid, hosts and drivers who meet users in person, or spaces with a minimum age. A pass shows that a document and a face matched when the check ran, which is why teams run it again at higher-risk steps and let the other layers watch what the account does in between. Our guide to verifying a marketplace seller covers the checks that sit beside it for sellers.

This layer answers whether you have seen a device before and whether the session is trying to hide what it is. It works from signals your own app or website collects on every visit, so it can catch a banned user who comes straight back on the same hardware.

Fingerprint identifies browsers and mobile devices with an identifier whose accuracy, it says, "lasts for months or years, even when cookies are cleared", and reports when a visitor uses a VPN, incognito mode or a tampered browser or device. Its Smart Signals add more than 100 further attributes, and it detects bots and AI agents. As of November 2026 the Free plan covers up to 1,000 API calls a month, Pro Plus costs $99 a month for 20,000 calls and $4 per 1,000 calls after that, and Enterprise plans are custom.

Incognia combines precise location, persistent device recognition and tamper detection. It names account ban evasion, account sharing, promo abuse and collusion among the problems it handles for delivery and ride-sharing apps, and multi-accounting and listing scams for peer-to-peer marketplaces. Pricing is volume-based, by monthly active users or API calls, across Essential, Advanced and Premium plans, and Incognia offers a free proof-of-value trial run in production.

Choose this layer when the same people keep returning on the same phones and laptops, or when location matters to the abuse, as with drivers and couriers. A device link identifies the hardware, so reviewers pair it with other evidence before treating two accounts as one person, since families, shared computers and resold phones can put several people behind one device.

This layer answers, at each signup, login or payment, whether to allow it, send it to review or block it. It combines your own events with device, identity and network signals and, for most vendors, data pooled across their customers.

Sift says it stops "payment fraud, account takeover and fake accounts in real time". At signup its models combine device fingerprinting, identity signals and its Global Data Network, which it says processes more than 1 trillion events a year, and its console includes network visualisation for surfacing multi-account rings and fraud farms. Sift sells through a demo with its team.

SEON builds on more than 1,100 first-party signals. From the name, email address or phone number a user types at signup, it checks their digital footprint along with device and network signals, and it adds behavioural biometrics and case management. As of November 2026 its Starter plan costs $699 a month for 2,500 fraud checks, Premium is custom, and a free trial is available on request.

Sardine serves banks, merchants and fintechs. Its device intelligence and behaviour biometrics run from onboarding to payments, its policy abuse product targets "promo abuse, multi-accounting, and fraud rings", and its Connections Graph maps relationships between users, devices and transactions. Pricing comes from Sardine's sales team.

Choose this layer when decisions have to be made at volume and in real time, above all where money moves. These tools are built to decide in the moment, from your platform's events and the signals and network data each vendor adds.

This layer answers whether a post, image, video, audio clip or message breaks your policy, usually with a model scoring each item and people reviewing the uncertain ones.

Deploy is the new name Hive announced in October 2026, and it keeps Hive's content safety models: visual, text and audio moderation, and a detection API for child sexual abuse material (CSAM) powered by Thorn's technology. Its Arbiter tool, formerly the Moderation Dashboard, orchestrates policy enforcement. As of November 2026, Visual Moderation costs $3.00 per 1,000 requests and Text Moderation $0.50 per 1,000, on a tier limited to 100 requests a day, with higher limits through sales.

Checkstep is a content moderation platform built around a policy engine you configure for your own rules. It gives access to a marketplace of AI models for text, image, video and audio, lets you test and swap them, and blends its automated moderator, ModBot, with human review. Checkstep starts buyers with a demo.

Choose this layer when users post at a volume no team could read, and keep its decisions in the case layer so reviewers see an account's history alongside each item.

This layer answers who reviews a flagged account or item, what they decided, why, and whether the same case would get the same decision next week. It is where the signals from every other layer meet a person.

Cinder builds trust and safety operations software: a system of record for policies and decisions, agents that apply your policies and escalate edge cases "to the right person, with context and a recommended action", audit trails, and integrations with your existing models and third-party tools. It also offers managed operations and red teaming. Cinder sells through a demo.

Tremau builds Nima, which it calls an end-to-end trust and safety platform. It moderates content by "centralising all data signals and detection sources, enabling manual and automated processing", so it also covers layer 5, and Tremau adds advisory services from its trust and safety, policy and risk team. Buyers contact Tremau's team directly.

Several tools in other layers include case features of their own, among them Persona's Cases, SEON's case management and Sardine's. Choose a dedicated case layer when you run several queues and review teams and need one record of every decision and appeal.

This layer answers what harm is being organised elsewhere, on other platforms, in forums and on the dark web, before it reaches yours.

ActiveFence, the trust and safety product of Alice (the name the company ActiveFence took in January 2026), runs live feeds that surface "harmful content, viral narratives, and coordinated manipulation in real time, across languages and regions", monitors the clear, deep and dark web around the clock, and investigates networks and specific threat actors. It also sells moderation tools built on that intelligence. Access starts with a demo.

Graphika maps online networks and tracks narratives, influence operations and disinformation. For trust and safety teams it offers to "Detect coordinated harmful activity before it spreads", and it also covers scam and fraud networks. Graphika sells through a demo.

Choose this layer when organised groups target your platform with coordinated campaigns, scam networks or abuse planned in other communities. It works at the level of campaigns and actors across the web, and when one account from such a campaign lands in a case, Sixtyfour researches the identifiers that account published.

Every layer turns evidence into a link, and each kind of link has an ordinary explanation a fair review rules out first. A shared device can be a family's tablet or a resold phone. A reused handle can belong to two different people if it is short or common. A photo found on another account may have been taken from someone else, so two accounts using it can have two operators and one victim. A passed verification shows that a document and a face matched on the day of the check, and an account can change hands afterwards. Treat one link as a lead, act on several independent ones, and write down the source of each so a decision can be checked or undone. Sixtyfour returns each finding with its source and reports what it could not establish as open, so the reviewer sees the evidence and the gaps together.

Start from the harm you see most, and add layers in the order your cases need them. A small team on a platform where users post usually starts with a moderation model and somewhere to record decisions, which can be the case features inside a tool it already has. A platform where money moves starts with fraud decisioning. Device intelligence usually comes next, as soon as banned users start coming back. Identity verification follows where a fake identity is expensive: payouts, sellers, people meeting in person. Account investigation earns its place once cases need an answer to who is behind an account, which tends to come early for marketplaces and communities with repeat offenders. Threat intelligence matters most to large or prominent platforms that organised groups target.

The layers work best when each hands the next a case with its evidence attached.

1. Moderation, device intelligence or fraud decisioning flags an account and opens a case with the signals that triggered it.
2. The case layer routes it to a reviewer, along with the account's history on your platform.
3. For an account that needs more than platform data, the reviewer gives Sixtyfour the identifiers the account published, and the sourced findings and open questions go back into the case.
4. The reviewer decides, the decision and its reasons are recorded, and any new handle, email address or phone number goes back to the detection layers as a rule.
5. Threat intelligence adds what is being planned elsewhere, and identity verification runs as a step-up check where a decision needs proof that a real person matches a document.

A trust and safety stack is a set of layers, each answering one question: identity verification checks that a person matches a document, device intelligence recognises hardware, fraud decisioning scores events, moderation judges content, case management records decisions and threat intelligence watches what is being organised elsewhere. Account investigation answers who is behind an account and which other accounts are theirs, mostly from evidence outside your platform. Add layers in the order your cases need them, and pass the evidence from one to the next. Sixtyfour is the account investigation layer: it researches the email addresses, phone numbers, usernames and names an account has used across public sources, and returns linked accounts and findings with a source for each, so your reviewers decide from evidence they can check.