Most monitoring stacks are excellent at traffic and terrible at money.
The gateway returns 200 OK, dashboards stay green, and finance still discovers — days later — that settlement failed, a rollup drifted, or postpaid exposure crossed a limit nobody watched.
That gap between delivery and accountability is what we call the billing gap. Finno closes it with revenue assurance: metering, authorization, charging, and accounting in one atomic flow — plus a cold-path layer that watches the books while the hot path stays under 250 µs.
23 guardians on the cold path
Finno runs 23 background detectors (17 deterministic invariants + 6 statistical checks):
- Money integrity — ledger imbalance, settlement failures after a served request, billable calls with zero provider cost, usage-rollup discrepancy with a diagnosed cause
- Billing correctness — margin collapse, invoice total anomalies, billing spikes (statistical, shadow by default)
- Customer risk — overdue invoices, credit exposure, repeated payment failures
- Gateway health — survival mode under host pressure, IP-ban escalation, invoke-meter limits
- Operations — upstream failures, throttle spikes, traffic silence, latency and cache-margin regression
Statistical detectors ship in shadow mode by default: they compute and store findings for calibration before they appear on the live board or trigger alerts.
Ranked by money at risk
An SRE alert sorted by error rate treats a noisy low-value endpoint the same as a revenue-critical one. Finno ranks findings by money at risk — severity follows exposure, not volume alone.
Each item includes auditable evidence, an owner hint (engineering / finance / SRE), and a recommended next step. Sticky findings (ledger imbalance, settlement failure) stay open until a human acknowledges and resolves them.
From anomalies to abuse investigation and alerts
Anomaly detection answers: what looks wrong?
Abuse investigation (shipped today) answers: which actor or pattern should we investigate? Nearline rules and mapped anomaly signals roll into scored cases with an audit trail. Enforcement stays off the request path until you enable it.
Notification channels push anomaly.opened and fraud.opened events to Slack, email, Telegram, WhatsApp, or your webhook — with cooldowns, delivery logs, and message language per channel.
Zero hot-path tax
The gateway records facts; the dashboard API scans Postgres and gateway /stats. Detection never blocks Reserve → Finalize → Ledger.
That separation is why Finno can be finance-grade and sub-250 µs at the same time.
What to ask your team
If your monitoring sees traffic but not money: how much revenue is leaking through your stack right now?
See revenue assurance on the features page or talk to us about a technical evaluation.