How This Briefing Works
This report opens with key findings, then maps the gaps between what Sardine.ai discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Claims vs. Observed Behavior
pending
“Unknown”
Requires claims extraction via CDT
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Sardine.ai
- →Audit false positive rates for privacy tool users - verify fraud detection is not systematically rejecting legitimate privacy-conscious customers
- →Request fraud model training opt-out - your transaction data should not optimize competitor fraud prevention
- →Verify PCI-DSS scope - session recording at checkout may expand compliance requirements
- →Implement explicit consent for behavioral biometrics or accept GDPR Article 9 violations
If You're Evaluating Sardine.ai
- →First-party fraud scoring without cross-merchant data sharing
- →Rule-based fraud prevention without behavioral biometrics
- →On-premise fraud detection with complete data isolation
Negotiation Leverage
- →Perfect CAC subsidization (100) means your fraud intelligence trains competitor models - demand data segregation or pricing discount
- →Behavioral biometrics require GDPR Article 9 consent - audit consent mechanism for lawful basis
- →Cross-merchant fraud network creates privacy violations - DPA must address regulatory liability
- →False positives from privacy tool users create revenue rejection - demand transparency on blocking rates
- →Fraud prevention value derives from shared intelligence - pricing should reflect your data contribution
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Impact: Mouse dynamics and typing patterns are biometric identifiers under GDPR Article 9, requiring explicit consent and heightened security controls.
Full session replay
Impact: Recording checkout sessions may capture payment credentials, creating PCI-DSS scope expansion and GDPR Article 32 violations.
Identity stitching
Impact: Fraud scoring across merchant sites creates cross-site tracking without user knowledge, violating ePrivacy Directive and GDPR Article 21.
Device identification
IOC Manifest
Indicators of compromise across 5 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
10 detection signatures across scripts, domains, cookies, and network endpoints