IdentityTwin — Continuous Behavioral Identity & Trust-Gated Payments

IdentityTwin is an AI-powered continuous identity verification and payment security platform designed to protect digital financial transactions against account takeover, credential compromise, session hijacking, and unauthorized payouts.

Traditional authentication verifies a user's identity primarily at login. But a successful login does not guarantee that every subsequent action is legitimate. An attacker who gains access to an authenticated session may be able to perform sensitive operations without triggering conventional authentication controls.

IdentityTwin addresses this gap by introducing a continuous trust layer between user intent and financial execution. Rather than treating authentication as a one-time event, it continuously evaluates behavioral and transactional signals to determine whether a session and its requested actions remain trustworthy.

How It Works

IdentityTwin evaluates eight deterministic behavioral and transactional risk signals:

New Device: Detects access from an unfamiliar device.
New Location: Identifies unexpected geographic access patterns.
Unusual Time: Flags activity outside established usage patterns.
New Payee: Detects payments to previously unseen recipients.
Large Payout: Identifies transactions exceeding configured thresholds.
New Payee + Large Payout: Recognizes higher-risk combinations of transaction signals.
Payee Addition Followed by Payout: Detects potentially suspicious sequences of account activity.
Canary Interaction: Identifies interaction with deliberately placed decoy elements.

These signals feed into a centralized Trust Gateway, which calculates a weighted risk score and determines the appropriate security response before sensitive financial operations are executed.

The risk engine uses a weighted scoring model:

[ R = \sum_{i=1}^{8} S_i x_i ]

where (x_i) represents whether a risk signal has been detected and (S_i) represents its configured weight.

Based on the resulting risk assessment, IdentityTwin assigns one of four trust states:

NORMAL: Standard account access and transaction processing.
RESTRICTED: Sensitive actions are limited while additional verification or review is required.
DECOY: Suspicious sessions are diverted into isolated honey workspaces designed to simulate an environment without exposing real financial operations.
ISOLATED: High-risk sessions are blocked from sensitive operations.

This allows the platform to apply different levels of enforcement rather than relying on a simple approve-or-reject fraud decision.

AI-Powered Incident Investigation

IdentityTwin integrates an LLM-powered investigation capability to help security analysts understand suspicious activity.

When an analyst initiates an investigation, the AI component analyzes structured incident evidence, relevant risk signals, transaction context, and available behavioral information. It generates a contextual investigation narrative explaining why an event was flagged, which indicators contributed to the risk assessment, and what actions may warrant further review.

The investigation capability uses Groq's LLM inference API through an OpenAI-compatible interface, with structured output validation and a deterministic fallback when the external AI service is unavailable.

Importantly, the AI investigation layer is read-only and advisory. It cannot authorize payments, modify risk scores, approve transactions, or execute financial operations. All enforcement decisions remain within the deterministic Trust Gateway and policy engine.

This separation allows AI to improve the explainability and usability of security investigations without placing an LLM in control of the payment execution path.

PayPal Integration and Transaction Safety

IdentityTwin integrates with the PayPal Developer Platform through a payment-provider abstraction that supports three execution modes:

Mock Payment Adapter: Supports local development and repeatable testing without external financial operations.
PayPal Sandbox Adapter: Integrates with PayPal Sandbox for payment-related workflows, including OAuth 2.0 authentication, payout creation, batch retrieval, webhook signature verification, and request-level idempotency through PayPal request identifiers.
Decoy Payment Adapter: Handles simulated financial interactions within isolated decoy environments without contacting PayPal or moving real funds.

The Trust Gateway evaluates session and transaction risk before payment execution is permitted. This connects behavioral identity assessment directly to financial operations rather than treating fraud detection as a separate monitoring process.

The platform also incorporates database-backed idempotency, transaction reconciliation, and session isolation mechanisms to improve reliability across payment workflows. A reconciliation worker uses PostgreSQL locking mechanisms to coordinate pending transaction processing and reduce the possibility of concurrent workers processing the same records.

Architecture and Technology

IdentityTwin is implemented as a modular full-stack application:

Backend: Python, FastAPI, SQLAlchemy 2.0, and PostgreSQL.
AI Investigation: Groq LLM inference API, structured output validation, and deterministic fallback.
Frontend: React 19, TypeScript, and Vite.
Database: 27 SQLAlchemy models and 19 Alembic migrations.
Testing: Pytest, Vitest, and Playwright.
Infrastructure: Docker Compose, Nginx, and a controlled outbound egress proxy.

The application includes a security analyst console for reviewing incidents, inspecting risk signals, initiating AI-assisted investigations, and monitoring transaction activity.

Security-First Design

A central architectural principle of IdentityTwin is the separation of intelligence, policy enforcement, and financial execution.

The AI investigation service interprets evidence and generates explanations, but it cannot directly authorize payouts or control the payment provider. Decoy environments are isolated from real payment execution, while transaction processing relies on deterministic policy enforcement and database-backed safeguards.

This architecture establishes clear boundaries between behavioral intelligence, security decisions, and financial operations.

What Makes IdentityTwin Different?

IdentityTwin shifts the security question from:

“Was this user authenticated?”

to:

“Does this session continue to demonstrate trustworthy behavior, and should this particular financial action be allowed?”

By combining continuous behavioral risk assessment, deterministic trust enforcement, AI-assisted incident investigation, isolated decoy environments, and PayPal payment integration, IdentityTwin transforms identity verification from a login-time checkpoint into an ongoing security layer across the payment lifecycle.

Identity should be verified continuously. Trust should be earned with every transaction.