{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "alloy", "name": "Alloy", "vendor": "First Mile Group, Inc. (Alloy)", "vendorUrl": "https://www.alloy.com", "kind": "http-api", "category": "identity-verification", "summary": "Alloy is an identity and fraud decisioning platform for banks and fintechs. Its API runs onboarding journeys and evaluations that orchestrate identity, business, document and watchlist checks across third-party data vendors, with case management and ongoing monitoring.", "url": "https://www.anchorterminal.com/tools/alloy", "markdownUrl": "https://www.anchorterminal.com/tools/alloy.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/alloy.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/alloy.json", "license": "Proprietary service under Alloy's terms of service. The @alloyidentity/web-sdk capture package is MIT", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "@alloyidentity/web-sdk" } ], "auth": "mixed", "authNotes": "Account-level token and secret (older accounts use a workflow token and secret), sent as HTTP basic auth or exchanged at /v1/oauth/bearer for a one-hour Bearer token with client credentials. Up to five active secrets per key, rotated and revoked in the dashboard by users with key permissions. No scopes. The same keys serve sandbox and production, chosen by base URL or the `alloy-sandbox: true` header. Keys come with a customer contract (checked 2026-10-14).", "pricing": "paid", "pricingNotes": "No public prices. www.alloy.com/pricing returns 404 and the site routes buyers to a demo. Production calls invoke third-party data vendors and can incur charges, while sandbox calls don't (https://developer.alloy.com/public/docs/sandbox-vs-production, checked 2026-10-14).", "priceSummary": "Paid", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs index, the API reference or the website (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 20569, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://developer.alloy.com/public/docs/introduction", "mcpTools": { "url": "https://api.alloy.cx/mcp", "checkedAt": "2026-10-02T22:09:59.902886223Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-10-02T22:09:59.902886223Z" }, "llmsTxt": "https://developer.alloy.com/public/llms.txt", "capabilities": [ "kyc.identity", "kyc.business", "kyc.screening", "kyc.documents", "kyc.cases" ], "tags": [ "hosted", "enterprise", "sales-led", "api-key", "oauth", "llms-txt", "webhooks", "sandbox", "status-page", "soc2" ], "lastRelease": "2026-10-05", "graded": true, "anchor": { "graded": true, "score": 52.4, "grade": "D", "agentReady": false, "rank": 782, "ranked": true, "rankOf": 1076, "categoryRank": 16, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 52, "maintenance": 72, "payments": 0, "reliability": 59, "schema": 73, "security": 49, "transparency": 62 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 59, "points": 11.8, "reason": "Read with the hosted lines. status.alloy.com is a Statuspage with Production API, Sandbox API, Webhooks, SDK, Customer Dashboard and Third Party Data Integrations components (20). Nine incidents between 17 July and 9 October 2026, four labelled major. Elevated error rates on the Journeys API on 21 July, resolved within about an hour, hit the Production API. The others marked major were a Socure document verification failure through the SDK on 10 September (about 4.5 hours), a Loqate address formatter outage on 20 August and a 9-minute dashboard login problem on 17 July. We scored 10 because only one major touched the API itself (10). Limits are set per endpoint and account with no published numbers, and responses carry `alloy-ratelimit-limit`, `-remaining` and `-reset` headers (7 of 15). A 429 carries `retry-after`, and the retry guide names retryable codes and asks for exponential backoff with jitter. No idempotency key for writes was found (12 of 15). No SLA found (0). The API is generally available (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 73, "points": 11.86, "reason": "Each reference page embeds an OpenAPI 3.0.0 fragment titled Alloy API 1.0.0. No single downloadable spec file was found (20 of 25). llms.txt with 247 entries and a Markdown copy of each page (10). Descriptions explain each endpoint and flag deprecated ones, but the evaluations endpoint says inputs vary with each workflow's configuration (13 of 20). Typed schemas where the payload is fixed, and dynamic bodies for evaluations and journeys (9 of 15). curl examples, and an error table with an HTTP code and a minor code for each case (13 of 15). A v1 path and dated Web SDK changelog entries, with product updates on the marketing site. No API changelog was found (8 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 52, "points": 8.45, "reason": "No field selection, and evaluation and journey responses return the full decision payload (10 of 25). Paginated lists for batches, cases and investigations, with filters on cases (14 of 20). Errors carry `status_code`, `minor_code`, `type`, `message`, `details` and an `error_token`, with a documented table (18 of 20). No idempotency key. Journey application reruns are explicit endpoints, and the webhook guide asks receivers to handle duplicates (6 of 20). No server-side SDK. The npm and Android packages are capture SDKs for the end-user document step (4 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 49, "points": 8.57, "reason": "An account-level token and secret sent as HTTP basic auth, or exchanged for a one-hour OAuth bearer token through client credentials. Up to five active secrets per key, with rotation and revocation in the dashboard. No scopes were found, and the bearer token has the same access as the key (20 of 30). An IP allowlist exists (error 4016) and dashboard roles govern who manages keys. No read-only key (7 of 20). Responses carry data returned by third-party vendors and AI analysis summaries, with no injection guidance (3 of 15). Webhook logs and dashboard records, with no API audit log found (7 of 15). The security page says Alloy is SOC 2 Type 2 certified, runs yearly penetration tests and takes vulnerability reports by email. security.txt returns 404 and no bug bounty was found (12 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 0, "points": 0, "reason": "Read with the hosted rubric. No x402, MPP or L402 (0). No public prices. www.alloy.com/pricing returns 404 and the site asks visitors to schedule a demo (0). No trial or free tier found. Sandbox mode exists for customers (0). Access is through sales (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 72, "points": 6.3, "reason": "Web SDK 2.16.0 on npm on 5 October 2026, and a product update posted on 23 September 2026 (30). Web SDK 2.12.0, 2.13.0 and 2.14.0 in September plus 2.16.0 in October (20). A closed service with a help centre, a product updates page and an AI support chat added in September. GitHub issue handling not applicable (10 of 15). The only official packages are capture SDKs, current (7 of 15). @alloyidentity/web-sdk is MIT and current. CI wasn't checked (5 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 62, "points": 5.43, "note": "editorial 38, provenance 86", "reason": "Closed service under published Terms of Service, which forbid robots, crawlers and scraping of the site or services, including to train AI systems (15 of 30). The privacy policy, dated 29 August 2025, names First Mile Group, Inc. d/b/a Alloy and gives retention criteria without periods. No public DPA was found (10 of 30). Endpoints are marked deprecated in favour of the Events API and Investigations, with no dates (8 of 20). The security page says the data centre is in the United States. No sub-processor list was found (5 of 20)." } ], "assessment": { "date": "2026-10-14", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "No field selection, and evaluation and journey responses return the full decision payload (10 of 25). Paginated lists for batches, cases and investigations, with filters on cases (14 of 20). Errors carry `status_code`, `minor_code`, `type`, `message`, `details` and an `error_token`, with a documented table (18 of 20). No idempotency key. Journey application reruns are explicit endpoints, and the webhook guide asks receivers to handle duplicates (6 of 20). No server-side SDK. The npm and Android packages are capture SDKs for the end-user document step (4 of 15).", "maintenance": "Web SDK 2.16.0 on npm on 5 October 2026, and a product update posted on 23 September 2026 (30). Web SDK 2.12.0, 2.13.0 and 2.14.0 in September plus 2.16.0 in October (20). A closed service with a help centre, a product updates page and an AI support chat added in September. GitHub issue handling not applicable (10 of 15). The only official packages are capture SDKs, current (7 of 15). @alloyidentity/web-sdk is MIT and current. CI wasn't checked (5 of 10).", "payments": "Read with the hosted rubric. No x402, MPP or L402 (0). No public prices. www.alloy.com/pricing returns 404 and the site asks visitors to schedule a demo (0). No trial or free tier found. Sandbox mode exists for customers (0). Access is through sales (0).", "reliability": "Read with the hosted lines. status.alloy.com is a Statuspage with Production API, Sandbox API, Webhooks, SDK, Customer Dashboard and Third Party Data Integrations components (20). Nine incidents between 17 July and 9 October 2026, four labelled major. Elevated error rates on the Journeys API on 21 July, resolved within about an hour, hit the Production API. The others marked major were a Socure document verification failure through the SDK on 10 September (about 4.5 hours), a Loqate address formatter outage on 20 August and a 9-minute dashboard login problem on 17 July. We scored 10 because only one major touched the API itself (10). Limits are set per endpoint and account with no published numbers, and responses carry `alloy-ratelimit-limit`, `-remaining` and `-reset` headers (7 of 15). A 429 carries `retry-after`, and the retry guide names retryable codes and asks for exponential backoff with jitter. No idempotency key for writes was found (12 of 15). No SLA found (0). The API is generally available (10).", "schema": "Each reference page embeds an OpenAPI 3.0.0 fragment titled Alloy API 1.0.0. No single downloadable spec file was found (20 of 25). llms.txt with 247 entries and a Markdown copy of each page (10). Descriptions explain each endpoint and flag deprecated ones, but the evaluations endpoint says inputs vary with each workflow's configuration (13 of 20). Typed schemas where the payload is fixed, and dynamic bodies for evaluations and journeys (9 of 15). curl examples, and an error table with an HTTP code and a minor code for each case (13 of 15). A v1 path and dated Web SDK changelog entries, with product updates on the marketing site. No API changelog was found (8 of 15).", "security": "An account-level token and secret sent as HTTP basic auth, or exchanged for a one-hour OAuth bearer token through client credentials. Up to five active secrets per key, with rotation and revocation in the dashboard. No scopes were found, and the bearer token has the same access as the key (20 of 30). An IP allowlist exists (error 4016) and dashboard roles govern who manages keys. No read-only key (7 of 20). Responses carry data returned by third-party vendors and AI analysis summaries, with no injection guidance (3 of 15). Webhook logs and dashboard records, with no API audit log found (7 of 15). The security page says Alloy is SOC 2 Type 2 certified, runs yearly penetration tests and takes vulnerability reports by email. security.txt returns 404 and no bug bounty was found (12 of 20).", "transparency": "Closed service under published Terms of Service, which forbid robots, crawlers and scraping of the site or services, including to train AI systems (15 of 30). The privacy policy, dated 29 August 2025, names First Mile Group, Inc. d/b/a Alloy and gives retention criteria without periods. No public DPA was found (10 of 30). Endpoints are marked deprecated in favour of the Events API and Investigations, with no dates (8 of 20). The security page says the data centre is in the United States. No sub-processor list was found (5 of 20)." }, "sources": [ { "what": "developer docs index for agents", "url": "https://developer.alloy.com/public/llms.txt", "seen": "2026-10-14" }, { "what": "introduction", "url": "https://developer.alloy.com/public/docs/introduction.md", "seen": "2026-10-14" }, { "what": "authentication guide", "url": "https://developer.alloy.com/public/docs/authentication-guide.md", "seen": "2026-10-14" }, { "what": "account-level API keys", "url": "https://developer.alloy.com/public/docs/account-level-api-keys.md", "seen": "2026-10-14" }, { "what": "sandbox vs production", "url": "https://developer.alloy.com/public/docs/sandbox-vs-production.md", "seen": "2026-10-14" }, { "what": "error codes", "url": "https://developer.alloy.com/public/docs/_errors.md", "seen": "2026-10-14" }, { "what": "request handling and retries", "url": "https://developer.alloy.com/public/docs/request-handling-retry.md", "seen": "2026-10-14" }, { "what": "webhook best practices", "url": "https://developer.alloy.com/public/docs/best-practices.md", "seen": "2026-10-14" }, { "what": "webhook retry logic", "url": "https://developer.alloy.com/public/docs/retry-logic-and-webhook-logs.md", "seen": "2026-10-14" }, { "what": "run an evaluation reference with OpenAPI fragment", "url": "https://developer.alloy.com/public/reference/post_evaluations.md", "seen": "2026-10-14" }, { "what": "Web SDK changelog", "url": "https://developer.alloy.com/public/docs/web-sdk-changelog.md", "seen": "2026-10-14" }, { "what": "understanding API rate limits", "url": "https://help.alloy.com/en/articles/16764579-understanding-api-rate-limits", "seen": "2026-10-14" }, { "what": "status incidents (JSON)", "url": "https://status.alloy.com/api/v2/incidents.json", "seen": "2026-10-14" }, { "what": "security page", "url": "https://www.alloy.com/security", "seen": "2026-10-14" }, { "what": "privacy policy", "url": "https://www.alloy.com/privacy-policy", "seen": "2026-10-14" }, { "what": "terms of service", "url": "https://www.alloy.com/tos", "seen": "2026-10-14" }, { "what": "product updates", "url": "https://www.alloy.com/product-updates", "seen": "2026-10-14" }, { "what": "npm @alloyidentity/web-sdk", "url": "https://registry.npmjs.org/@alloyidentity/web-sdk", "seen": "2026-10-14" } ], "openQuestions": [ "Alloy's Terms of Service forbid robots, crawlers and scraping of the site or services, including for training AI. We read public pages, as the brief says, and record the clause here", "Whether any sandbox or trial is open without a contract. None was found on public pages", "Whether an SLA, DPA or sub-processor list exists for customers. None was found on public pages", "No official MCP server. The registry's alloy entries belong to unrelated companies", "The security page's SOC 2 Type 2 statement carries no report date" ] }, "negative": 0, "verdict": "Alloy's public docs cover journeys, evaluations, entities, documents, cases and investigations, with llms.txt, Markdown pages, OpenAPI fragments and rate-limit headers with retry-after. Access is sales-led with no public price or trial, credentials have no scopes, there is no idempotency key or server SDK, and inputs vary by each customer's workflow.", "bestFor": "Banks and fintechs that already run onboarding through Alloy and want an agent to submit journey applications, read decisions and work investigations.", "strengths": [ "Public developer docs with llms.txt (247 entries), Markdown pages and an OpenAPI fragment on each reference page", "Rate-limit headers and `retry-after` on 429, with a written guide to which codes to retry", "One API orchestrates identity, business, document and watchlist checks across many data vendors", "Up to five active secrets per key, OAuth client credentials and an IP allowlist", "Status page with separate Production API, Sandbox API, Webhooks and third-party components" ], "weaknesses": [ "No public prices, trial or self-serve sign-up. Access starts with a demo request", "Rate limits vary by account and endpoint with no published numbers", "No idempotency key and no server-side SDK", "Evaluation inputs and outputs depend on each customer's workflow, so the contract is loosely typed", "Sandbox and Production are request modes over one data store, so test and live records can collide" ], "agentNotes": [ "Get the account's base URL from the customer. Defaults are api.alloy.co and sandbox.alloy.co, and some accounts have their own hosts", "Use unique, prefixed external IDs in sandbox. Sandbox and Production share one data store", "Read `alloy-ratelimit-remaining`, and on 429 or 5xx wait for `retry-after` with exponential backoff and jitter", "Expect `running` after about 25 seconds on journey applications and wait for the webhook instead of resubmitting", "Send the workflow header with account-level keys, since inputs depend on the workflow configured" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 52.4 } ], "editorialScores": { "ergonomics": 52, "maintenance": 72, "payments": 0, "reliability": 59, "schema": 73, "security": 49, "transparency": 38 }, "provenanceScore": 86 }, "connect": { "http": "curl -X POST https://sandbox.alloy.co/v1/oauth/bearer \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Basic \u003cbasic_token\u003e\" \\\n -d '{\n \"grant_type\": \"client_credentials\"\n }'" }, "letme": { "capability": "https://letme.dev/kyc.identity", "tool": "https://letme.dev/alloy" }, "notable": [ "Sandbox and Production are per-request modes over one shared data store, so external identifiers collide across them unless prefixed (https://developer.alloy.com/public/docs/sandbox-vs-production)", "Rate limits vary by endpoint and account, with `alloy-ratelimit-*` and `retry-after` headers (https://help.alloy.com/en/articles/16764579-understanding-api-rate-limits)", "Journey application calls return within about 25 seconds and may come back `running`, with the result sent by webhook (https://developer.alloy.com/public/docs/request-handling-retry)", "Webhooks retry ten times over 24 hours and are disabled after 100 consecutive failures in 72 hours (https://developer.alloy.com/public/docs/retry-logic-and-webhook-logs)", "status.alloy.com lists elevated Journeys API errors on 21 July 2026 among nine incidents since 17 July (https://status.alloy.com)", "The terms of service forbid robots, crawlers and scraping of the site or services (https://www.alloy.com/tos)" ], "area": "domain-data", "details": [ { "label": "Surface graded", "value": "Alloy API v1 as documented on developer.alloy.com/public. No official MCP server found" }, { "label": "Base URLs", "value": "https://api.alloy.co and https://sandbox.alloy.co, or https://{account_slug}.api.alloy.com and .sandbox.alloy.com. Some accounts outside the US have their own hosts" }, { "label": "Resources", "value": "Journeys and journey applications, evaluations, entities and entity groups, documents, bank accounts, events, batches, custom lists, cases (deprecated) and investigations, AI analysis summaries, diagnostics" }, { "label": "Credentials", "value": "Token and secret as basic auth, or OAuth client credentials for a one-hour bearer token. Up to five secrets per key. IP allowlist" }, { "label": "Rate limits", "value": "Per endpoint, method, environment and account, no published figures. `alloy-ratelimit-limit`, `-remaining`, `-reset` and `retry-after` headers" }, { "label": "Errors", "value": "`status_code`, `error.minor_code`, `type`, `message`, `details`, `error_token`. 206 partial response resumable by PATCH. 429 minor code 4033" }, { "label": "Webhooks", "value": "10-second timeout, ten retries over 24 hours, unordered and possibly duplicated, disabled after 100 failures in 72 hours" }, { "label": "SDKs", "value": "Web SDK @alloyidentity/web-sdk 2.16.0 and an Android web SDK for document capture. No server-side client" }, { "label": "Status", "value": "status.alloy.com on Statuspage with Production API, Sandbox API, Webhooks, SDK, Customer Dashboard and Third Party Data Integrations" }, { "label": "Certifications", "value": "SOC 2 Type 2 per the security page. Yearly third-party penetration tests. Disclosure by email" } ], "provenance": { "legalEntity": "First Mile Group, Inc.", "domain": "alloy.com", "domainRegistered": "1999-02-25", "endpointOnVendorDomain": true, "terms": "https://www.alloy.com/tos", "privacy": "https://www.alloy.com/privacy-policy", "statusPage": "https://status.alloy.com", "changelog": "https://www.alloy.com/product-updates", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The privacy policy (29 August 2025) names First Mile Group, Inc. d/b/a/ Alloy.", "The default API hosts are on alloy.co (api.alloy.co, sandbox.alloy.co), and account-specific hosts on alloy.com. status.alloy.co redirects to status.alloy.com.", "www.alloy.com/.well-known/security.txt and alloy.co/.well-known/security.txt return 404.", "RDAP for alloy.com gives a registration date of 1999-02-25, before Alloy was founded in 2015." ], "score": 86, "checks": [ { "check": "Legal entity named", "value": "First Mile Group, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "alloy.com, registered 1999-02-25 (27 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "alloy.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects, and has 1 clause that costs points", "points": 7.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 7 of the 8 things a reader expects", "points": 9.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.alloy.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://www.alloy.com/tos", "state": "read", "readAt": "2026-10-14", "statedDate": "2026-03-12", "words": 4679, "points": 7.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated Date: March 12, 2026", "says": "Last updated 2026-03-12" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "The terms of this Agreement are governed by and shall be construed in accordance with the laws of the United States (including federal arbitration law) and the State of New York, U.S.A., without regard to its principles of conflicts of law, and regardless of your location.", "says": "The law of the United States" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "and (d) the maximum aggregate liability of Alloy for all damages, losses and causes of action, whether in contract, tort (including negligence) or otherwise, shall be the greater of the total amount, if any, paid by you to Alloy to use the Site or fifty U.S." }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "Sections 2–8 and 10–21 shall survive any expiration or termination of this Agreement." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "We may change this Agreement from time to time without prior notice or by notifying you of such changes by any reasonable means, including by posting a revised Agreement through the Site.", "says": "Says it gives notice of a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "You may not use our trade names, trademarks, service marks or logos in connection with any product or service that is not ours, or in any manner that is likely to cause confusion." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "Use any robot, spider, crawler, site search/retrieval application or other manual or automatic data gathering or extraction tools to access, acquire, copy, monitor, aggregate, retrieve, index, “scrape,” “data mine” or otherwise gather any Site content or any portion of the Site or the Services", "costsPoints": true }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "…tort, statute, fraud, misrepresentation or any other legal theory, will be resolved through final and binding arbitration before a neutral arbitrator instead of in a court by a judge or jury, and you agree that Alloy and you are each waiving the right to trial by a jury." } ], "notes": [ { "date": "2026-10-14", "text": "Users grant Alloy a perpetual, irrevocable, sublicensable licence to use and exploit their submissions for any purpose, including promotional purposes such as testimonials.", "quote": "create derivative works of, adapt, modify and otherwise use, analyze and exploit such Submission, in any format or media now known or hereafter developed, and for any purpose (including promotional purposes, such as testimonials)." }, { "date": "2026-10-14", "text": "Gathering site or Services content to develop, train, test or improve any machine learning or AI system is prohibited.", "quote": "including to (a) directly or indirectly, develop, train, test or improve any software tool, service, machine learning algorithm or artificial intelligence system or platform, including any architecture, models or weights" }, { "date": "2026-10-14", "text": "Alloy reports, insights and scores may not be used as a factor in deciding eligibility for credit, insurance or employment.", "quote": "No reporting, insights, analysis, or proprietary evaluation scores generated by Alloy may be used in whole or in part as a factor in determining eligibility for credit, insurance, employment or another purpose in connection with which a consumer report may be used under the FCRA" } ] }, { "kind": "privacy", "url": "https://www.alloy.com/privacy-policy", "state": "read", "readAt": "2026-10-14", "words": 5477, "points": 9.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "Information We Collect About Visitors and Client Representatives From Other Sources" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We may store information about you for as long as we have a legitimate business need for it." }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Service providers: We engage vendors to perform specific business functions on our behalf, and they may receive information about you from us or collect it directly." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "To exercise this right, please visit our Do Not Sell or Share My Personal Information webpage or contact us.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "Your rights under the GDPR for data we process as a controller: If you are located in the European Economic Area (“EEA”), U.K., or Switzerland, you have the right to lodge a complaint about our data collection and processing actions with the supervisory authority concerned." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "Should you have any questions regarding our security procedures or wish to report any potential system failures or breaches, please contact us at [email protected].", "says": "Gives an email address, hidden from our reader by the page" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "Transfers: Obtain information about and a copy of the safeguards, including the standard contractual clauses, we use to transfer personal data across borders.", "says": "Relies on standard contractual clauses" } ], "toKnow": [ { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "We may share your information with business partners, online advertising partners, and social media platforms for this purpose." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/alloy.json", "live": { "slug": "alloy", "vendorStatus": { "page": "https://status.alloy.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-14T09:38:51.209484803Z" }, "mcpTools": { "url": "https://api.alloy.cx/mcp", "checkedAt": "2026-10-02T22:09:59.902886223Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-10-02T22:09:59.902886223Z" }, "updatedAt": "2026-10-14T09:38:51.209484803Z" } } }