How This Briefing Works
This dossier opens with key findings, then maps the gap between what Spade discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 1 sites
vendor fires before consent
Briefing
Spade is a Y Combinator-backed fintech infrastructure company providing real-time transaction enrichment APIs to card issuers and financial institutions. Founded in 2021 in New York with $21.1M in funding from Flourish Ventures, a16z, and Gradient Ventures, they serve major customers including Mercury, Ramp, Stripe, and Corpay. While Spade processes sensitive financial transaction data and displays SOC2 compliance badges, their own website runs Google Analytics pre-consent (before user interaction) and deploys 73+ third-party vendors. This creates a gap between their security posture claims and their own digital hygiene practices.
What This Means For You
If Spade enriches your transaction data, you are trusting sensitive financial information to a platform whose corporate site runs 73+ third-party vendors. While Spade's pre-consent rate is low, the vendor density creates a large third-party surface area. Under SOC2 Trust Service Criteria, their compliance badge should cover data handling practices — but 73+ vendors on their marketing site suggests inconsistent security posture. Transaction enrichment data reveals spending patterns, merchant relationships, and business activity that is highly sensitive for your customers. Verify that Spade's production infrastructure is isolated from their marketing technology stack.
Risk Channel Breakdown
Spade processes transaction data to enrich merchant identity and categorization. If their enrichment data is compromised or inaccurate, downstream customers (banks, fintechs) make authorization and fraud decisions on corrupted intelligence. Their position as a data intermediary means errors propagate across the financial ecosystem.
As a transaction enrichment provider, Spade has visibility into spending patterns across their customer base. Aggregated transaction intelligence could reveal competitive insights about fintech customer acquisition, merchant performance, and market trends to investors or partners.
Spade's API processes real-time transaction data with <50ms response times, creating a high-value attack surface. Compromise of their systems could enable transaction manipulation, merchant impersonation, or authorization fraud across all connected card issuers.
Spade displays SOC2 compliance badges but runs pre-consent tracking (Google Analytics) on their own website. This self-deployment contradiction undermines their compliance posture. Their JS-rendered privacy policy makes it difficult to assess data handling claims, and no public subprocessor list exists despite processing financial data.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Ignoring CMP signals
Device identification
PII deanonymization
Claims-vs-Reality (BTI-X)
False certification claims
Gated or missing due diligence docs
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed Spade's public claims against observed runtime behavior and identified 3 contradictions.
"SOC2 compliance badge displayed on website"
Google Analytics fires pre-consent on spade.com, 73+ third-party vendors detected on their site
2 more gaps — with regulatory citations and evidence pointers — available with subscription.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
5 for current users · 5 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →