Quick answer: For fintech support, Decagon lists a PCI DSS 4.0.1 attestation and EU-only data residency on request, but publishes no prices. Lorikeet publishes prices ($0.90 to $0.99 per chat resolution, $1.20 to $1.50 per voice resolution, plus a $2,100 or $5,100 monthly plan) and offers Australian and EU storage residency (its pricing table lists USA on both published plans, with custom residency on Signature), but lists no PCI attestation. As at 2 October 2026.
Lorikeet and Decagon both sell AI agents that resolve customer-service conversations end to end rather than deflect them, and both pitch financial services directly. Lorikeet’s financial services page names disputes, chargebacks, loan servicing, payments and identity verification. Decagon’s financial services page names password resets, balance enquiries, fraud alerts and dispute workflows. On a fintech shortlist what separates them is cardholder data and PCI DSS scope, refund and identity controls, data residency (US, EU or Australia), and price visibility. Both list SOC 2 Type II, ISO 27001:2022, HIPAA and GDPR. Both connect to Zendesk, Salesforce and Intercom, both expose MCP tool connectivity, and both run voice, chat, SMS and email. Every vendor fact below comes from that vendor’s own page, linked, read on 2 October 2026. Neither vendor’s comparison pages were used for facts about the other, and we name no customer of either.
Lorikeet vs Decagon for fintech customer support: the side-by-side
The table is the whole comparison at a glance. Where a cell says something is not documented, the named pages were read in full on 2 October 2026 and a string known to be on each page was found in the same saved copy before the absence was recorded.
| Criterion | Lorikeet (as at 2 October 2026) | Decagon (as at 2 October 2026) |
|---|---|---|
| Fintech work its own pages name | Disputes, chargebacks, loan and account servicing, payment enquiries, delinquency outreach, compliance cases; refunds; freezing accounts or cards (financial services page, FAQ) | Password resets, balance enquiries, fraud alerts, dispute workflows (financial services page); card activation and replacement, PIN updates, travel notices, card limits (fintech article) |
| Channels | Chat, email, voice, SMS and WhatsApp (how-it-works FAQ) | Voice; chat across web live chat, SMS, WhatsApp “and more”; email (chat page, voice page, email page) |
| Voice geography and languages | Local numbers in the US, UK and Australia (voice page); no language count on its pricing, FAQ, how-it-works, voice or financial services pages | 70+ languages with automatic detection and switching (voice page); no country list on the voice page |
| PCI DSS | Not listed on the trust page, the trust centre or the pricing security table; FAQ says it does not store or process raw card data and works through processors’ secure tokens | PCI DSS 4.0.1 listed; trust centre carries an Attestation of Compliance for Self-Assessment Questionnaire D for Service Providers (trust centre); its subprocessor list names a tokenisation vault used “to support PCI DSS compliance” |
| Other attestations | SOC 2 Type II, ISO 27001:2022, HIPAA, GDPR (trust page) | SOC 2 Type II, ISO 27001:2022, HIPAA, GDPR, CCPA, EU AI Act (trust centre) |
| How regulated steps run | Payments and identity checks “run as code the agent can invoke but never alter”; human approval gates in workflows | Agent Operating Procedures (AOPs) combine natural language with code; identity verification and refunds run “with strict controls”; Git-based versioning |
| Audit trail | Every interaction, model choice and action tracked; audit trail exports and data access logs for regulatory reporting | Reasoning traces for every decision; security and audit logs kept at least 12 months, tamper-resistant (DPA security annex) |
| Human handoff | Escalates with full history; escalations not charged; routing by issue type with an audit trail of why | Voice transfers to a human with a summary; email escalation through tags and ticketing integration |
| Data residency | US primary hosting on Google Cloud; storage residency in Australia and the EU (trust page); pricing table lists USA on Start and Scale, custom on Signature | EU-only residency on request, processed and stored in EEA infrastructure (DPA security annex); Australian residency not documented |
| Encryption | TLS 1.3 in transit, AES-256 at rest | TLS 1.2+ in transit, AES-256 at rest |
| Billing unit | Per successful resolution on top of an annual plan | Per conversation or per resolution; most customers choose per conversation (pricing post) |
| Published prices | Start $2,100/mo, Scale $5,100/mo (paid annually, USD); Signature custom with a $75K platform fee and an FDE Platinum Support Package at $25K+ | None; decagon.ai/pricing returns a 404 and the sales route is a demo request |
The CARD test: four questions that decide Lorikeet vs Decagon for a fintech
Feature lists for these two vendors overlap heavily. Both take actions through APIs and MCP tools, both test changes against simulated conversations before release, and both hand off to humans with context. What actually changes a fintech decision fits into four questions. We call it the CARD test, and it is built to be answered in one meeting with your compliance lead in the room.
- C – Cardholder data. Will the agent ever hear, see or relay a full card number? If yes, your assessor will want the vendor’s own PCI DSS attestation, and Decagon lists one. If every payment step runs on processor tokens, Lorikeet documents exactly that pattern, though it lists no attestation.
- A – Actions and audit. Which actions may the agent take without a person approving them, and what record does each leave? Both vendors document controlled execution of refunds and identity checks. They describe it differently, and the difference matters to whoever owns your change management.
- R – Residency. Where must customer data be stored? EU storage: both document it. Australian storage: only Lorikeet documents it, and its pricing table still lists USA for its two published plans.
- D – Dollars per resolution. Can you calculate the price before you speak to sales? With Lorikeet, yes; the worked calculation below does it. With Decagon, no; you need a quote, and the calculation below tells you what that quote must beat.
The quotable version: Lorikeet vs Decagon for fintech is decided by card data, action control, residency and price visibility, in that order; features are a tie-breaker.
Which vendor holds a PCI DSS attestation for card payments?
Decagon does, and Lorikeet does not list one. Decagon’s trust centre lists PCI DSS 4.0.1 among its compliance items. Its resources page carries a document titled “PCI DSS 4.0.1 AOC”, described as an Attestation of Compliance for Self-Assessment Questionnaire D for Service Providers, available on request. Its security page carries compliance logos for PCI, SOC 2, HIPAA, CCPA, ISO and the EU AI Act. Note the form of the attestation: it is a self-assessment questionnaire, not an on-site report. Ask your acquirer or Qualified Security Assessor (QSA) whether that form is acceptable for a service provider at your volume before you rely on it.
Lorikeet takes the opposite architectural position and documents it. Its FAQ says it “doesn’t store or process raw payment card information,” works with payment processors using secure tokens, initiates refunds and payment updates through secure APIs, logs every payment-related action, and requires strict authorisation for payment workflows. PCI DSS is not listed on Lorikeet’s trust page, its trust centre (which lists ISO 27001:2022, SOC 2 and HIPAA, with audit reports from 2024 to 2026), the security table on its pricing page, or its release notes as at 2 October 2026. Its site does carry a glossary entry explaining PCI DSS, but that is an explainer, not an attestation. Lorikeet also says so itself: its guide to compliant AI for lenders states that “Lorikeet does not hold PCI DSS certification today” and routes card data through a compliant payment processor.
Which matters depends on your flow. If customers read card numbers aloud to a voice agent, or type them into chat, the vendor is handling cardholder data and you will want its attestation in your vendor file. If your design keeps the card number out of the conversation entirely, for example by sending a secure payment link or using your processor’s hosted fields, then the agent only ever sees tokens. In that design a vendor without an attestation may sit outside your cardholder data environment, but your QSA makes that call, not either vendor. We set out the scoping routes for a voice agent in our guide to whether an AI voice agent can take card payments and what that does to PCI scope.
The sentence that cuts against Decagon here: an attestation covers the vendor’s environment, not your integration. A PCI-attested agent that writes a card number into your helpdesk ticket has still put that ticket system in scope.
How do Lorikeet and Decagon control refunds, disputes and identity checks?
Both vendors say the regulated steps should not be left to the language model’s judgement. They describe the mechanism in different words, and procurement should read both descriptions side by side.
Lorikeet’s how-it-works page puts it as “the interface is permissive, the operation is strict”: “Sensitive steps like payments and identity checks run as code the agent can invoke but never alter.” Its FAQ adds that workflows can include “human approval gates,” and that every action keeps a complete audit trail and can be set to need a person’s sign-off in high-value scenarios. Its guardrails page lists customer isolation, server-side identity validation, workflow-scoped tool access and hard execution caps enforced in code. It is also unusually frank about limits: it says prompt injection cannot be prevented entirely, and designs so that a successful manipulation stays inside a single conversation.
Decagon’s product overview says its platform ensures “critical operations like identity verification and refunds are executed securely, reliably, and on-brand with strict controls.” Its AOP page describes Agent Operating Procedures as combining “the flexibility of natural language with the reliability of code,” with Git-based version tracking for technical teams and reasoning traces at any point in a conversation. For voice identity, Decagon’s voice authentication article sets out two models. The first is pre-authenticated calls: app-gated calls, a callback after a one-time passcode, or authenticated data passed over SIP. The second is mid-call checks, where its table lists five methods: mobile app push confirmation, confirming several customer identifiers, a one-time passcode or magic link sent by email, an SMS one-time passcode to the calling number, and a single basic identifier such as name or phone number. It rates the last two as low confidence, and says caller ID can be spoofed and cannot be treated as verified identity on its own. It recommends combining methods by the risk of the action.
On audit trails, Decagon’s DPA security annex commits to security and audit logs kept for at least twelve months in a tamper-resistant system, and to breach notification within 48 hours of confirmation. Lorikeet’s FAQ lists audit trail exports, compliance dashboards, exception reporting, customer consent reports and data access logs for regulatory reporting.
What neither page tells you is how the identity step connects to your existing know-your-customer (KYC) or identity verification provider. Ask both vendors to show the identity step for an existing customer and for a new applicant, and to name the system that holds the verification result. Onboarding a new applicant through KYC is a different job from servicing an existing account. Our walkthrough of AI onboarding agents for bank KYC and account setup covers that job.
Comparing support agents because your fintech also runs onboarding and application follow-up by phone? Zian AI runs autonomous agents across phone, SMS, email and WhatsApp in 30+ languages. It includes a niched bank KYC onboarding agent and offers private model deployment on your own infrastructure. Zian AI is in partnership-application beta.
Where will my customers’ data be stored with Lorikeet or Decagon?
For an Australian fintech this is often the deciding row.
Lorikeet’s trust page says production runs on Google Cloud Platform in a private VPC with US primary hosting, and that “data storage residency is available in Australia and the EU.” Its financial services page says the same. Its pricing page also has a data residency row reading USA for Start, USA for Scale and Custom for Signature, and its pricing.md lists “custom data residency” among the Signature inclusions, a plan with a $75K platform fee and an FDE Platinum Support Package at $25K+. If Australian storage is a requirement, get it in the contract for the plan you are buying, because the pricing table and the trust page say different things for the two published plans. Note too that this is storage residency: Lorikeet’s trust centre lists its model-inference subprocessors (OpenAI, Anthropic and Baseten) in the USA, so ask where processing happens as well as storage.
Decagon’s DPA security annex (version 7.26) says: “Upon request, Decagon offers EU-only data residency, in which Customer Personal Data is processed and stored within EEA-located infrastructure.” For transfers out of the EEA it relies on the European Commission’s Standard Contractual Clauses. Its trust centre’s subprocessor list shows USA and EU locations for most entries, including Google Cloud, AWS, Azure, OpenAI and Anthropic. Australian residency is not documented on Decagon’s security page, its legal security page, its trust centre overview or subprocessor list, or the DPA security annex as at 2 October 2026. Decagon’s documentation site requires a login, so that source could not be checked. If you need Australian storage, ask Decagon in writing.
Both vendors state zero data retention with their model providers and no training on customer data, and both redact personal information: Lorikeet automatically, Decagon through Google’s DLP service.
What does Lorikeet cost per resolution, and what does Decagon cost?
Lorikeet publishes its prices. Its pricing page and machine-readable pricing.md list Start at $2,100 a month and Scale at $5,100 a month, both paid annually, in USD. Chat, email and SMS resolutions cost $0.99 on Start and $0.90 on Scale. Voice resolutions cost $1.50 and $1.20, “3 min average, outcomes consultation to determine full pricing.” Triage (routing or analytics tagging) and automated QA are separate line items, each $0.30 on Start and $0.27 on Scale. Signature is custom, with a $75K platform fee and an FDE Platinum support package from $25K. Unresolved or unsatisfactory tickets cost nothing, and escalations to a person are not charged.
Decagon does not publish prices. As at 2 October 2026, decagon.ai/pricing returns a 404 page, its sitemap carries no pricing page, its llms.txt index lists only the pricing article below, and its sales route is a demo request. Its December 2024 post Pricing the AI Agent Economy describes two models. Per conversation is “a fixed rate for every incoming conversation.” Per resolution is “a higher fixed rate for each fully resolved conversation, with no charge for escalations.” The post says “the vast majority” of its customers choose per conversation.
Worked calculation: Lorikeet’s real cost per resolution for a fintech
The per-resolution rate is not the cost per resolution, because the plan fee is fixed. Effective cost per resolution = (plan fee + usage) ÷ resolutions. Fintech queues usually mix text and voice, so the last row uses 7,000 text and 3,000 voice resolutions.
| Plan | Resolutions per month | Plan fee | Usage | Monthly total | Effective cost per resolution |
|---|---|---|---|---|---|
| Start | 1,000 text | $2,100 | 1,000 × $0.99 = $990 | $3,090 | $3.09 |
| Start | 3,000 text | $2,100 | 3,000 × $0.99 = $2,970 | $5,070 | $1.69 |
| Scale | 5,000 text | $5,100 | 5,000 × $0.90 = $4,500 | $9,600 | $1.92 |
| Scale | 10,000 text | $5,100 | 10,000 × $0.90 = $9,000 | $14,100 | $1.41 |
| Scale | 20,000 text | $5,100 | 20,000 × $0.90 = $18,000 | $23,100 | $1.16 (1.155) |
| Scale | 7,000 text + 3,000 voice | $5,100 | 7,000 × $0.90 = $6,300; 3,000 × $1.20 = $3,600; total $9,900 | $15,000 | $1.50 |
Three things fall out of the arithmetic. First, at low volume the plan fee dominates: 1,000 text resolutions a month on Start cost $3.09 each, more than three times the $0.99 headline. Second, the fixed commitment is $25,200 a year on Start and $61,200 on Scale before a single resolution is billed. Third, the voice rate is stated against a three-minute average and an outcomes consultation, so treat the $1.20 as a floor for long calls. If you add automated QA across, say, 14,000 handled tickets on Scale, that is 14,000 × $0.27 = $3,780 more, taking the mixed example to $18,780, or $1.88 per resolution. Lorikeet’s FAQ separately quotes automated QA as an optional add-on “from $0.10 a ticket”; at that rate the QA line is $1,400 and the total $16,400, or $1.64 per resolution, so confirm which rate applies to you.
What a Decagon quote has to beat
When Decagon quotes per conversation, you pay for the conversations that do not resolve as well. Divide Decagon’s total monthly bill by the number of conversations it handles to get an all-in price per conversation, P. For the same 10,000 resolutions, Decagon handles 10,000 ÷ r conversations, where r is your measured automated resolution rate. It beats the $15,000 Lorikeet mixed example only when P is below $1.50 × r.
| Your automated resolution rate (r) | Conversations needed for 10,000 resolutions | Decagon all-in price per conversation that equals $15,000 |
|---|---|---|
| 50% | 20,000 | $0.75 |
| 60% | 16,667 | $0.90 |
| 70% | 14,286 | $1.05 |
| 80% | 12,500 | $1.20 |
If Decagon quotes per resolution instead, compare its rate directly against Lorikeet’s plus Lorikeet’s plan fee spread over your volume. Measure r in your own pilot rather than accepting either vendor’s figure.
Decagon’s pricing post makes the strongest argument against the per-resolution model Lorikeet uses, and it belongs on this page: “You’ll get into situations where a user is upset, leaves, and that gets counted as a resolution.” Lorikeet’s answer is that unsatisfactory tickets you mark as bad are not charged. Either way, the money moves on the definition. Ask both vendors, in writing, what counts as a resolution, and what happens when a customer comes back about the same issue within a set window. Our Ada vs Lorikeet comparison applies the same conversion to Lorikeet and another vendor that bills mostly per conversation.
Who Lorikeet and Decagon are each wrong for
Lorikeet is wrong for a fintech whose security review requires the vendor’s own PCI DSS attestation. None is listed on its trust page, trust centre or pricing security table as at 2 October 2026. It is also a poor fit if you need voice outside the US, UK and Australia, the three countries its voice page names. Its own FAQ adds one more: “if you only need a chatbot, we’re probably overkill.” And if you need Australian residency on Start or Scale, get it in writing, because the pricing table lists USA for both.
Decagon is wrong for a team that needs a price before a sales call, because there is no list price. The billing unit most of its customers choose, per conversation, charges for conversations that do not resolve, which punishes a low early resolution rate. It is also a harder fit if you need Australian data residency, which is not documented on its public pages as at 2 October 2026, or if you want to read the product documentation before a demo, because the docs site requires a login.
Price it separately if most of your volume is prospects and applicants rather than existing customers. Abandoned applications and onboarding follow-up are a sales and onboarding job, not a support ticket. Lorikeet markets a separate outbound product, Convert, for recovering abandoned applications and converting leads, with no price on that page as at 2 October 2026; the worked calculation on this page covers support resolutions only. For a wider view of the field, including vendors with published language lists, see our guide to multilingual AI customer support platforms.
Choose Lorikeet if… choose Decagon if…: the decision rule
Run the CARD test in order. The first row that matches your situation is your answer. If none matches, run a two-week pilot with both on the same historical tickets.
| If this is true for you | Choose | Why, from the vendor’s own page |
|---|---|---|
| Customers will read or type full card numbers to the agent, and your QSA wants the vendor’s attestation | Decagon | PCI DSS 4.0.1 AOC (SAQ D for Service Providers) on its trust centre; none listed by Lorikeet as at 2 October 2026 |
| Payments run only on processor tokens or secure links, never raw card numbers | Either; Lorikeet documents this exact pattern | Lorikeet’s FAQ: no raw card data, processor tokens, logged payment actions |
| Australian data storage is mandatory | Lorikeet, with residency written into the contract | Trust page offers Australian storage; pricing table lists USA on Start and Scale; Decagon does not document it |
| EU-only processing and storage is mandatory | Either; confirm the plan | Decagon’s DPA annex offers EU-only residency on request; Lorikeet offers EU storage residency |
| Your change board wants regulated steps fixed in code the agent cannot change | Either; read both mechanisms | Lorikeet: payments and identity checks as code the agent “can invoke but never alter”; Decagon: AOPs with code steps and Git versioning |
| You need a published price and a free trial before talking to sales | Lorikeet | Rates, plan fees and a 30-day free trial on its pricing page |
| Your resolution rate is unknown or below about 50% | Lorikeet | Escalated and unresolved tickets are not charged, at a published rate; Decagon’s per-resolution option also does not charge escalations, but its rate is not published |
| Your resolution rate is proven high and you can negotiate a low per-conversation price | Decagon (check P < $1.50 × r for the mixed example) | Most Decagon customers choose per-conversation pricing |
| You need voice in many languages or outside the US, UK and Australia | Decagon (confirm your country) | 70+ voice languages on its voice page; Lorikeet’s voice page names three countries, and its financial services page says “in any language” but gives no count |
| You handle fewer than about 1,000 tickets a month | Price both carefully | Lorikeet Start works out at $3.09 per text resolution at 1,000; Decagon publishes no entry price |
Frequently asked questions
Is Lorikeet or Decagon PCI compliant?
Decagon lists PCI DSS 4.0.1 on its trust centre, with an Attestation of Compliance for Self-Assessment Questionnaire D for Service Providers available on request. Lorikeet lists no PCI DSS attestation on its trust page, trust centre or pricing page as at 2 October 2026; its FAQ says it does not store or process raw card data and works through payment processors’ secure tokens.
Which is cheaper for fintech support, Lorikeet or Decagon?
Lorikeet publishes its prices: $0.90 per chat, email or SMS resolution and $1.20 per voice resolution (priced on a three-minute average call) on the $5,100-a-month Scale plan, so 7,000 text and 3,000 voice resolutions cost $15,000 a month, or $1.50 each. Decagon publishes no prices. Its quote beats that only if its all-in price per conversation is below $1.50 multiplied by your resolution rate.
Can Lorikeet or Decagon store data in Australia?
Lorikeet’s trust page says storage residency is available in Australia and the EU, though its pricing table lists USA for the Start and Scale plans and custom residency for Signature, so put it in the contract. Decagon’s DPA security annex offers EU-only residency on request; Australian residency is not documented on its public pages as at 2 October 2026.
How do Lorikeet and Decagon stop the AI issuing a refund it shouldn’t?
Lorikeet says payments and identity checks run as code the agent can invoke but never alter, with optional human approval gates. Decagon says identity verification and refunds run with strict controls inside Agent Operating Procedures that combine natural language with code and are versioned in Git. Ask both to demonstrate a refund above your approval threshold.
What happens when the AI hands a fintech customer to a human?
Lorikeet escalates with the full conversation history, customer data and what was already tried, and does not charge for escalated tickets. Decagon’s voice agent transfers calls with a concise summary, and its email agent escalates through tags and your ticketing integration so the issue reaches the right person with context.
What is a Decagon AOP?
An Agent Operating Procedure is Decagon’s way of defining agent behaviour in natural language, like a standard operating procedure for a human agent, with code steps for reliability. Technical teams version AOPs with Git-based tracking, and Decagon says AOPs can be created automatically by uploading conversation transcripts and then refined with its Duet tool.
Where every figure on this page comes from
| Figure | Who published it | Link | Date read |
|---|---|---|---|
| Start $2,100/mo, Scale $5,100/mo (annual, USD); $0.99/$0.90 text, $1.50/$1.20 voice (3-minute average); $0.30/$0.27 triage and QA; $75K Signature platform fee; FDE Platinum $25K+; 30-day free trial; data residency USA on Start and Scale; escalations and unresolved tickets not charged | Lorikeet | lorikeetcx.ai/pricing and pricing.md | 2 October 2026 |
| SOC 2 Type II, ISO 27001:2022, HIPAA, GDPR; US primary hosting; Australian and EU storage residency; TLS 1.3, AES-256 | Lorikeet | lorikeetcx.ai/product/trust and trust.lorikeetcx.ai | 2 October 2026 |
| No raw card data, processor tokens; human approval gates; automated QA from $0.10 a ticket; audit trail exports; escalation not charged; bad-marked tickets not charged; “probably overkill” for chatbot-only needs | Lorikeet | lorikeetcx.ai/faq | 2 October 2026 |
| Payments and identity checks as code the agent cannot alter; channels | Lorikeet | lorikeetcx.ai/product/how-it-works | 2 October 2026 |
| Voice with local numbers in the US, UK and Australia | Lorikeet | lorikeetcx.ai/product/voice | 2 October 2026 |
| Disputes, chargebacks and fintech workflows; residency in the US, Australia and the EU | Lorikeet | lorikeetcx.ai/industry/financial-services | 2 October 2026 |
| PCI DSS 4.0.1 AOC (SAQ D for Service Providers); SOC 2 Type II, ISO 27001:2022, HIPAA, GDPR, CCPA, EU AI Act; subprocessor locations USA and EU | Decagon | trust.decagon.ai | 2 October 2026 |
| EU-only residency on request; audit logs kept at least 12 months; breach notice within 48 hours; TLS 1.2+, AES-256 | Decagon | DPA security annex v.7.26 | 2 October 2026 |
| 70+ voice languages; human transfer with summary | Decagon | decagon.ai/product/voice | 2 October 2026 |
| Per-conversation and per-resolution models; majority choose per conversation (post dated 10 December 2024) | Decagon | decagon.ai/blog/pricing-ai-agents | 2 October 2026 |
| AOPs, Git-based versioning; identity verification and refunds with strict controls | Decagon | decagon.ai/product/aop and decagon.ai/product/overview | 2 October 2026 |
| Effective cost per resolution; $15,000 mixed example; $1.88 (or $1.64 at the FAQ’s QA rate) with QA; break-even prices per conversation | Zian AI calculation from Lorikeet’s published rates; r is the reader’s own pilot figure | This page, worked calculation | 2 October 2026 |
Need an agent that answers, qualifies and follows up, not only one that resolves tickets? Zian AI’s agents work across phone, SMS, email and WhatsApp in 30+ languages, with CRM integrations for HubSpot, Salesforce, HighLevel and Zapier and private model deployment on your own infrastructure. Zian AI is in partnership-application beta.