Executive Summary
AI-generated analysis for Dwolla
Dwolla (dwolla.com) is a payment infrastructure API provider offering ACH and real-time bank payment capabilities, assessed at Risk Tier 3 (Moderate Risk) with a 96% confidence score. The vendor reports processing 126M+ annual transactions and has maintained an established online presence since 2008. Dwolla exhibits several meaningful positive signals:
Key Findings
- The domain has a clean Malware detection service status with zero malware or phishing detections.
- IP reputation is clean with a 0% abuse confidence score and no abuse reports in the past 90 days.
- The domain is 17+ years old, registered through 2027, with full DNSSEC and TLS 1.3 with AES-256-GCM encryption via Google Trust Services.
- No sanctions matches were found across OFAC, EU, and UN watchlists.
- No recent adverse media was identified in the past 12 months.
- The vendor publicly claims SOC 2 Type II (Security principle) on its trust page at dwolla.com/security, and references the EU AI Act in its AI governance documentation.
- Infrastructure is fully behind Cloudflare CDN, and no known CVEs were detected against exposed services. Several areas warrant attention prior to approval:
- The vendor's marketing site (dwolla.com) received a D+ grade (40/100) from HTTP security header analysis. While this scan targeted the marketing site rather than the application endpoint (dashboard.dwolla.com), the result should be reviewed.
- 21 open threat intelligence community pulses reference the domain, with pulse context suggesting the domain appears in impersonation and spyware-related tracking campaigns rather than as a direct threat actor — consistent with a high-profile payment platform being monitored or cloned by adversaries.
- The vendor's AI data usage policy, found at dwolla.com/resources/ai-in-banking, discloses use of three third-party AI providers (OpenAI, Anthropic, and Google) but does not clearly state whether customer data is used for AI model training — a gap that warrants direct clarification given the medium data access level.
- The subprocessor page at trust.dwolla.com/subprocessors appears to contain placeholder content rather than an active list, limiting supply chain visibility.
- A historical FTC enforcement action from March 2016, in which Dwolla was fined $100,000 for misrepresenting its data security practices, was identified. This event is over 9 years old and has been severity-adjusted accordingly;
Area Requiring Attention
however, it provides relevant historical context for security governance expectations. Overall, Dwolla presents a moderate risk profile consistent with its Tier 3 rating. The vendor has a credible payment infrastructure track record, clean real-time threat indicators, and vendor-attested SOC 2 Type II compliance. Conditional approval is appropriate pending resolution of the AI data usage transparency gap and receipt of the current SOC 2 Type II report.
Independence Statement
All evidence in this report was independently sourced from external data providers, public registries, and open-source intelligence without vendor participation or input.