All Vendors
data_enrichment
Spade

Spade

Fintech transaction enrichment API processing sensitive financial data for Mercury, Ramp, Stripe, and Corpay. SOC2 badge displayed while Google Analytics fires pre-consent and 73+ third-party vendors detected on spade.com. YC-backed with $21.1M funding. Low pre-consent rate but high vendor density.

82 IOCs24 detections4% pre-consent23 sites
85
Vendor Risk Score

How This Briefing Works

This report opens with key findings, then maps the gaps between what Spade discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.

Key Findings

Key Findings

24 detections across 23 sites4% pre-consent activity
MEDIUM

Pre-Consent Activity

Spade was observed loading and executing before user consent was obtained on 4% of sites where it was detected.

GDPRePrivacy
HIGH

Compliance Claim Mismatch

False certification claims

HIGH

Assurance Gap

Gated or missing due diligence docs

Disclosure Gaps

Claims vs. Observed Behavior

3 gaps
1 MED
Classified:BTI-X05BTI-X12

Self-Deployment Contradiction

SOC2 Privacy Principle · GDPR Article 7MEDIUM
They Claim

“SOC2 compliance badge displayed on website”

Observed Behavior

Google Analytics fires pre-consent on spade.com, 73+ third-party vendors detected on their site

Runtime scan: GA4 pre_consent=true. Vendor count from intel_detections.

Transparency Gap

CCPA 1798.130 · GDPR Article 12LOW
They Claim

“Privacy policy exists at /privacy”

Observed Behavior

Privacy policy requires JavaScript rendering - claims not extractable for verification

WebFetch returns only GTM code, noscript message

Subprocessor Transparency

GDPR Article 28LOW
They Claim

“OpenLI lists subprocessors reference”

Observed Behavior

No public subprocessor list accessible. OpenLI page returns 403.

WebFetch to explore.openli.com/privacy/spade/subprocessors returned 403

Customer Impact

What This Means For You

If Spade enriches your transaction data, you are trusting sensitive financial information to a platform whose corporate site runs 73+ third-party vendors. While Spade's pre-consent rate is low, the vendor density creates a large third-party surface area. Under SOC2 Trust Service Criteria, their compliance badge should cover data handling practices — but 73+ vendors on their marketing site suggests inconsistent security posture. Transaction enrichment data reveals spending patterns, merchant relationships, and business activity that is highly sensitive for your customers. Verify that Spade's production infrastructure is isolated from their marketing technology stack.
Recommended Actions

What To Do About It

Role-specific actions based on observed behavior

If You Use Spade

  • →Verify scope of SOC2 report — request the actual document and review controls covering your transaction data processing
  • →Confirm data retention policies for your transaction enrichment data and ensure alignment with your requirements
  • →Audit what third-party vendors Spade uses in their production API infrastructure versus their marketing site
  • →Ensure your DPA covers the specific financial data types being enriched through their platform
  • →Monitor for changes to their subprocessor list that could affect your transaction data processing

If You're Evaluating Spade

  • →Request SOC2 Type II report — verify scope covers transaction enrichment APIs, not just corporate infrastructure
  • →Distinguish between their marketing site (73+ vendors) and production infrastructure — request architecture documentation
  • →Verify data residency and processing locations for financial transaction data
  • →Assess whether their VC-backed growth stage ($21.1M) provides sufficient stability for handling your financial data
  • →Compare security posture against established transaction enrichment alternatives with longer compliance track records

Negotiation Leverage

  • →SOC2 scope verification: Request Spade's SOC2 report and verify scope covers their production transaction enrichment API, not just corporate infrastructure. Confirm controls address the 73+ vendors on their marketing site.
  • →Data isolation: Require contractual guarantee that transaction enrichment data is processed in infrastructure completely isolated from their marketing technology stack with 73+ vendors.
  • →Financial data protections: Transaction data reveals sensitive spending patterns. Require contractual data retention limits, encryption at rest, and deletion upon contract termination with written confirmation.
Runtime Detections

Runtime Detections

5 BTI-C CODES

BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.

BTI-C01Defeat Device

Evasion infrastructure, auditor bypass

BTI-C06Behavioral Biometrics

Keystroke/mouse tracking

BTI-C09Consent Bypass

Ignoring CMP signals

BTI-C10Fingerprinting

Device identification

BTI-C14Identity Resolution

PII deanonymization

IOC Manifest

IOC Manifest

78 INDICATORS

Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.

TRACK
*spade.com/static/js/main.*.js*
Tracking script
TRACK
*spade.com/static/js/409.*.chunk.js*
Tracking script
TRACK
spade.com/static/js/main.16a509f9.js
Auto-extracted from scan
TRACK
spade.com/static/js/409.7b0d4d85.chunk.js
Auto-extracted from scan
Ecosystem

Ecosystem & Supply Chain

Spade operates as a B2B data infrastructure provider in the fintech ecosystem. They are loaded by financial services companies (Mercury, Ramp, Corpay, Unit, Sardine) that need real-time merchant intelligence for transaction authorization, fraud detection, and user experience features. Spade in turn relies on ground-truth merchant data sources and uses Google Tag Manager/Analytics for their own marketing. Their partnership with Stripe indicates deep integration into the card ecosystem. They do not appear to load other surveillance vendors - their role is as an upstream data provider to financial institutions.
Evidence

Evidence Artifacts

Artifacts collected during analysis, available with evidence-tier access.

HAR Capture

Complete network capture with all requests and responses

IOC Manifest

82 detection signatures across scripts, domains, cookies, and network endpoints

Vendor Details