Technical Reference

Ancile Feature & Risk Engine Reference

Factual documentation of Ancile's 21 risk rules, alerting pipelines, storefront scanners, permissions architecture, and plan limits. Acts as the official documentation URL for the Shopify App Store listing.

1. Risk Scoring Engine (21 Rules)

Ancile evaluates transactions, checkout bursts, and storefront activity against 21 discrete rules. Each rule is assigned an operational weight and provides evidence explaining why it triggered. Merchants can toggle any rule on or off per store. The Risk Rules page shows how often each rule has fired in the last 30 days.

Network Reputation Rules (6 rules)

Tor Exit Node Traffic

Detects requests originating from confirmed Tor exit points masking user identities.

Datacenter / Hosting ASN

Flags traffic hosted in commercial cloud providers (AWS, GCP, DigitalOcean, Hetzner) rather than consumer ISPs.

Commercial VPNs & Proxies

Identifies connections routed through public proxies and commercial VPN tunnels.

High Abuse Confidence IP

Cross-references client IPs with threat intelligence (AbuseIPDB) indicating high abuse confidence.

High-Risk Country Origin

Weights orders originating from jurisdictions with elevated baseline fraud ratios.

Historical Country Mismatch

Flags transactions where the current session country diverges sharply from previous account activity.

Velocity Rules (4 rules)

Carding Burst

Triggers when multiple cart and checkout events occur from a single IP within minutes.

Store-Wide Event Spike

Identifies anomalous surges in aggregate checkout velocity across the entire store.

Repeated High-Value Carts

Detects rapid, repeated creation of unusually high-value carts from a single network source.

Immediate New Account Activity

Flags newly created customer accounts that immediately initiate high-value purchases without browsing intervals.

Payment Behaviour Rules (4 rules)

Failed Payment Transactions

Monitors repeated payment declines, authorization failures, and CVV/zip code rejections.

Voided Transactions

Detects orders where payment authorizations are voided shortly following initial authorization.

Refund Velocity Spike

Highlights unusual frequencies or amounts of refund requests from a specific source.

Disputes & Chargebacks by Reason Code

Ingests chargebacks and ranks fraud-related reason codes with higher severity than delivery inquiries.

Shopify-Native Signals (3 rules)

Shopify Order Risk Assessment

Ingests Shopify's native machine-learning risk evaluation (low, medium, high) for each order.

Shopify Protect Eligibility

Verifies whether an order qualifies for Shopify Protect fraud coverage and flags unprotected orders.

Chargeback Notifications

Webhook-driven detection and ingestion of newly opened payment disputes.

Customer Account Health (3 rules)

Disabled Account Interaction

Alerts when disabled customer accounts attempt transactions.

Customer Account Merge Webhook

Listens to customer_merge webhooks as a key account-takeover indicator.

Breached-Email Match

Matches customer email addresses against public credential breach databases.

Storefront Integrity (1 rule)

Theme File Write Detection

Listens to theme asset modification webhooks. Any write to Liquid, asset, or template files triggers an immediate threat evaluation and theme rescan.

2. Alerts and Incident Response

Scores above a configurable threshold become incident alerts with severity, matched factors, and evidentiary telemetry:

• Severity Levels: Critical, High, Medium, and Low. Active plans limit which severities are surfaced in the merchant dashboard.
• Alert Actions: Mark as read, mark as resolved, or configure automated auto-resolve timeframes.
• IP Blocklist: Block IPs manually, set auto-expiry schedules, or bulk block repeat offenders (addresses with multiple high-risk events over the previous 7 days).

3. Storefront and Infrastructure Checks

• Theme Scanner: Analyzes active theme code for injected scripts, obfuscated base64 payloads, and unauthorized third-party tags characteristic of payment skimmers.
• Immediate Rescan: Theme change webhooks trigger an instant scan instead of waiting for nightly runs.
• SSL Certificate Monitoring: Validates certificate expiration dates and issuing authorities.
• Email DNS Integrity: Monitors SPF, DKIM, DMARC, and MX records to prevent domain spoofing and email forgery.

4. Operational Visibility & Management

• Security Overview: Composite 0–100 security score, active alerts count, and traffic geography map.
• Live Threats & Event Stream: Real-time ledger displaying IP, country, device class, and triggered risk factors.
• Weekly Reports: Executive digests delivered weekly to merchant contact emails.
• Multi-Store: Single dashboard managing up to 999 stores with isolated rules per store.
• Team & Webhooks: Role-based team invites, API tokens, and outbound webhook dispatch.

5. Scopes, Permissions & Data Handling

Ancile requests read-only scopes exclusively and declares no write scopes. It never creates, edits, or deletes merchant data:

Requested Scope	Access Type	Operational Purpose
read_orders	Read Only	Order, cart, checkout, and payment activity evaluated by risk rules.
read_customers	Read Only	Customer event correlation and mandatory GDPR webhook compliance.
read_customer_merge	Read Only	Account consolidation detection for account-takeover monitoring.
read_shopify_payments_disputes	Read Only	Ingestion of chargebacks, payment disputes, and reason codes.
read_themes	Read Only	Reading active theme files for the payment skimmer scanner.

Staff monitoring notice: The read_users scope is not requested. Ancile does not monitor staff account logins or staff actions.

6. Plan Specifications

Plan	Price	Stores	History	Blocked IPs	Alert Severities
Free	$0	1	7 days	10	Critical only
Plus	$19.99/mo or $199.90/yr	3	30 days	100	Critical, high, medium
Pro	$49.99/mo or $499.90/yr	10	90 days	1,000	All (Critical, High, Medium, Low)
Max	$99.00/mo or $990.00/yr	999	365 days	10,000	All (Critical, High, Medium, Low)