Tamperlens and Ocrolus

How to read this page

Side by side

One engine, two contracts

On 1 October 2026 Ocrolus announced that Detect now embeds Resistant AI's Documents forensic engine, "now live across Ocrolus' customer base". Their documentation describes two layers: Resistant AI "operates at the file and pixel level, detecting metadata anomalies, digital modifications, suspicious PDF structure, and tampering indicators", and Ocrolus's own checks "operate at the content level", evaluating extracted values against IRS rules and arithmetic. The result is one Authenticity Status.

What this means for a buyer: the file-level layer of Detect and the product at /alternatives/resistant-ai are one engine sold under two contracts. Detect is Resistant AI plus Ocrolus's own content layer, for three document types, so it does not add a second, independent forensic opinion. The content layer is the part that is distinctly Ocrolus's, and it is real: it needs the numbers read off the page, which is the extraction product. Tamperlens is a different, smaller structural engine and does not claim to match either layer.

The two tools answer different questions

Two numbers that are not a fraud rate

Two figures dominate their marketing, and a reader comparing fraud products should know what each one measures:

• "over 99+% accuracy" is an extraction claim: how faithfully the data on the page is read out, with humans resolving the edge cases (their site, read 2026-08-13). It says nothing about how often tampering is caught or a genuine file is flagged.
• "20% more fraud identified": a delta from customer trials (read 2026-08-13): more than what the customer caught before, which is not a rate, a baseline or a methodology.
• "12% of loan applications processed through Ocrolus contain suspicious activity" (press release, 2026-10-01, read 2026-10-12): how common flagged activity is in their book, not how often a flag is right.

Neither figure is dishonest: each measures what it measures. But no fraud-catch rate and no false-positive rate is published, and to their credit the extraction number is never dressed up as one. We publish no detection rate either; our published number is a false-positive rate, at /evidence.

Where Ocrolus is the better answer

• You need the data out of the documents. Extraction is their core product and we simply do not do it, not badly, not at all. If the job is "read every transaction off ten thousand bank statements", they are the platform and we are not a candidate.
• You want humans behind the hard cases. Their staffed clean-room review resolves what the machines cannot. Nobody reviews a Tamperlens report but you.
• You are a lender at scale. Mortgage, SMB funding, auto and consumer workflows are what the platform is shaped around, and PayPal, Square, SoFi and Zillow on the logo wall (read 2026-08-13) is a vetting bar a solo-operated product cannot match.
• Content checks on their three document types. Because they extract the fields, Detect can test them: balances that reconcile, payroll-tax withholding against the rules, pay dates that fall on a weekend or bank holiday (their docs, read 2026-10-12). Tamperlens has a running-balance check on bank statements but no tax-rule checks, and it reads no field values for pay stubs or W-2s. The forensic layer comes with it, from Resistant AI, on top of the extraction pipeline you are already paying for.

Where Tamperlens is the better answer

• Your document is not a bank statement, pay stub or W-2. Their own docs limit Detect to those three types (read 2026-10-12). A contract, an invoice, a boleto, a medical report, a laudo (any PDF, image or Office file) goes through our one endpoint.
• You want a price you can read and a key today. Plans and per-document arithmetic are at /pricing, in USD and in reais; the free checker takes a file with no signup.
• No person may see the file. Documents are uploaded directly and parsed in memory, and written to disk only if your account opts in to keeping them. There is no human layer, which is a weakness for extraction and a guarantee for privacy.
• You need the check inside CI. The engine is deterministic, the same bytes produce the same report, so results can be regression-tested like any other build artifact.
• You want thresholds you control. We emit signals and your policy computes accept/review/reject; there is no 0, 100 score whose cut-offs you have to take on faith.
• You want the error rate before you buy. Our false-positive rate is at /evidence, and the engine's release log is public at /changelog.
• Brazil. CPF, CNPJ and boleto identifiers checked by arithmetic on the check digits, with prices quoted in BRL.

What we cannot do

• No extraction and no OCR. If you need the numbers off the statement, we do not read them out. That is their job, not ours.
• No human review service. There are no data professionals behind our reports.
• No bank-data connections and no identity verification.
• No SOC 2 or ISO 27001, disclosed at /security, and no on-premise deployment.
• Recall is measured only on forgeries we built. At /evidence: 1,006 forged files made from 160 genuine documents, caught 100% when the edit was an incremental update, a spliced image or a metadata strip, and 65.5% to 71.1% after the whole file was rewritten by Ghostscript or qpdf. We have no true-positive rate against real fraud.
• One region. Hosting is EU-only, and this is a solo-operated product.

The number a buyer actually needs

For a fraud check, the number that sets your review workload is how often a genuine document gets flagged. Ocrolus does not publish one for Detect (read 2026-10-12), and Resistant AI, whose engine now sits inside it, publishes none that we found.

Ours is at /evidence, with the population it was measured on, the date, and the engine version that produced it. The other comparisons are at /alternatives.