Eight production detectors — every transaction, before reimbursement.
Every VeraStream tier ships the same eight detectors against every AP row — the same logic the /audit page already runs in your browser. Below: the detector name, the spend or AP signal it catches, and the persona who cares. Want the full walkthrough? — read /how-it-works to see the GL-upload → detector-scoring → workpaper-JSON flow end to end.
The eight, by name
The eight VeraStream detectors, named with the signal and persona
Each card surfaces the detector name (the function name in @/lib/business/detectors), the spend or AP signal it catches, the persona who cares (controller, AP, compliance lead), the short blurb, a worked example finding, and a CTA into /pricing or a relevant case study. One row per detector so a buyer can match the production rule to the buyer they represent.
Policy / SOD enforcement
Signal: Invoices that bypass the required approver chain
Every payment is tested against the approver chain it was supposed to travel, not just the one that cleared it.
Example finding
A six-figure invoice posted without a three-way match — held before the payment batch cleared.
Duplicate invoice detection
Signal: Same vendor paid twice under typosquatted invoice IDs
Catches near-duplicate disbursements that legacy sampling missed by never looking (Levenshtein < 3, amount tolerance, 30-day window).
Example finding
"Acme Logistics LLC" and "ACME Logistix LLC" both paid in the same week.
Expense anomaly scoring
Signal: One cardholder, two closenames, same weekend
Population-level view flags the cluster of corporate-card charges that a per-employee review never sees.
Example finding
Three corporate-card charges at the same merchant on the same evening, close-name vendors.
Vendor risk + shell-vendor heuristic
Signal: New vendor names that are a near-miss of an approved master-data vendor
Catches the typosquat, the unapproved payee, the shell-vendor heuristic — held before reimbursement.
Example finding
"Beacon Strategy LLC" vs. the approved "Beacon Strategies LLP" — typosquat ring.
Review-threshold gaming
Signal: Invoices structured just below an approval ceiling
Two payments to the same vendor inside hours, each a hair below the next approval tier — the deliberate-structure pattern.
Example finding
Two $18,400 wires to a single vendor inside three hours, both just under the $25k approver ceiling.
Round-dollar disbursement flag
Signal: Wire with no cents, same memo template as the prior batch
Catches fabricated-invoice / kickback indicators — payments divisible by a clean magnitude band and well above the vendor's normal cents-precise spend.
Example finding
$125,000 exact $25,000 multiple to a vendor with ten years of varied-amount history.
Duplicate payment prevention
Signal: Same vendor paid twice in a short window with same-or-near amount
HIGH on exact duplicates inside 14 days, ±1% near-duplicate clusters inside 30 days; MED on same-day twins and round-cent twins. Recurring SaaS, rent, refund reversals auto-suppressed.
Example finding
Two identical $42,000 wires to "Stellaris Cloud" 7 days apart under different invoice refs.
Ghost employee / SOD break
Signal: New payee + new approver granted rights in the same week
Catches the master-data change and the rights change that together point at a ghost employee.
Example finding
"Beacon Strategy LLC" onboarded the same day approver "J. Park" was granted sign-off on the new vendor.
Why eight, not six
The coverage shift from sample review to population-level continuous audit
Eight is one more than six — and that extra pair closes exactly the failure modes a quarterly review cannot see. Lightly condensed from the announcement post, focused on the population-vs-sample shift each detector enables.
Before
A 25-to-60-line quarterly sample — a single reviewer's queue, weeks after disbursement.
After
95% of every transaction, every business day, before the money moves.
Before
A black-box anomaly score — no rule, no receipt, no override trail.
After
Eight named detectors, each shipping a workpaper (receipt, rule, override).
Before
A flag surfaces after the wire clears — recovery is contested, deadlines missed.
After
A flag surfaces before the wire clears — payment is held, not recovered.
Frequently asked
Detector FAQ — what they do, what they ship, and what changes when you add one
The six questions buyers and AP leads ask when they first open a detector catalog — plain HTML answers, no JavaScript required to read.
What does a detector actually do?
Each detector is a named rule that runs against every transaction in your AP feed. If the rule fires, it ships a workpaper: the receipt (the original transaction, the duplicate, or the anomaly), the rule that tripped (the detector name and threshold that fired), and any override applied. Eight detectors — evaluatePolicy, findDuplicateInvoices, detectExpenseAnomalies, detectVendorRisk, detectThresholdGaming, detectRoundDollar, detectDuplicatePayment, detectGhostEmployee — together cover policy / SOD, duplicate, anomaly, vendor risk, threshold gaming, round-dollar, and ghost employee.
Are these the same eight detectors that run on /audit?
Yes — the production agent and the in-browser /audit tool run the same eight functions (evaluatePolicy, findDuplicateInvoices, detectExpenseAnomalies, detectVendorRisk, detectThresholdGaming, detectRoundDollar, detectDuplicatePayment, detectGhostEmployee). Drop a CSV at /audit and you see the same detector names with the same workpaper shape on every flag — the only difference is where the input comes from (your browser tab vs. your live ERP connector).
Does adding a 9th detector change pricing?
No. Every tier ships the full eight — custom detectors are an Enterprise tier capability written against your specific policy, not an expansion of the production eight. Adding a new production detector is a product-release event with its own changelog entry, not a price event.
Can I see these detectors running on my own ledger?
Yes — two paths with no signup. Drop a CSV of AP rows at /audit and the eight detectors run in your browser in under ninety seconds. Self-serve a /pilot against one connector for a continuous preview against your live spend. The /pricing page lists the per-tier column where each detector fires.
Which audit framework do the eight detectors fit?
Any framework that requires population-level assurance over enterprise spend: SOX 404(b) ICFR testing, FCPA, EU/UK VAT, Sunshine Act. Every flag ships a workpaper sized to PCAOB AS 2315 — the evidence package an external auditor demands — produced continuously rather than assembled at quarter-close under pressure.
Where can I read the detector source?
The eight production functions live in @/lib/business/detectors/ — each one a pure-TS function with explicit thresholds. Re-export through @/lib/business/detectors/index.ts. The catalog on this page (@/lib/business/detector-catalog) is the single source of truth for the marketing metadata so naming and ordering stay aligned with the announcement blog post and the /pricing feature matrix.
Run them on your own ledger
Drop a CSV at /audit — or launch the eight continuously at /pricing.
The same eight detectors run on your AP ledger at /audit — no signup, no sales call required to see first findings. Pick Continuous or Enterprise to launch them continuously against your live ERP. For SOC 2 readiness, encryption posture, and the audit-trail integrity on every workpaper export, see /security.