Trustpair Review
Trustpair checks that a supplier's bank account belongs to that supplier, at onboarding, on every change and before payment runs, inside SAP, Coupa, Kyriba and other enterprise tools. Basware signed a binding agreement to buy it on 26 August 2026; completion is expected later in 2026.
Independently scored, one dimension at a time. Every dimension is sourced, and we say whether a claim is published, reported, or estimated.
Trustpair checks bank-account ownership at onboarding, on every bank-detail change and against the payment file before release, and adds IRS TIN matching and screening against 80+ sanctions lists (product pages, checked 27 September 2026). Case management records investigations and overrides with an audit trail, reachable by API since April 2026. SOC 2 Type 2 and ISO 27001 appear on the homepage, the pricing page and the 26 August 2026 release. SOC 1 is unsettled: the homepage badge reads SOC 1 Type 2, but Trustpair's only SOC 1 announcement, dated 26 November 2025, is for Type 1, and the trust center returned 403, so ask for the current report. Nacha named Trustpair a Preferred Partner on 24 November 2025. Approvals, PO matching, 1099 filing and e-invoicing sit outside its scope.
Trustpair says it validates accounts in 190 countries for 600+ enterprise customers (homepage; 26 August 2026 release), and its case studies cover vendor files of 32,000 (Societe Generale) and 75,000 (Danone). The Imports API is recommended for loads of 50 or more records, and SFTP handles daily files. What breaks first: confirmation depends on local data sources, so thinner markets fall back to human review, Danone reported 82 percent of controls done within 72 hours, and the API is capped at 100 requests per 10 seconds.
Trustpair promises platform access within 24 hours of signing, and says its Kyriba connector is switched on inside Kyriba's fraud module in a day. Full rollouts take longer: EDF Renewables went live on the SAP S/4HANA connector in under 3 months and Decathlon cleaned its vendor master in 4 months (Trustpair case studies). SFTP setup runs through the CSM with IP allow-listing, and production API access needs UAT sign-off (docs, checked 27 September 2026).
Deployment comes with a solution consultant and a project manager, then a named Customer Success Manager for workshops and business reviews (pricing page FAQ, checked 27 September 2026). Live chat, which opens with an AI assistant, and email run Monday to Friday, 9:00 to 18:00 CET, which ends at noon US Eastern, and most help-center articles need a login. G2, Capterra and Gartner Peer Insights returned 403, so review scores could not be read.
Trustpair-built connectors cover SAP ECC6 and S/4HANA (checks on new business partners, audits that return corrected data, and checks on F110 payment proposals), SAP Ariba and Sage X3; partners built Kyriba, Sage XRT, Ivalua and others, and Coupa lists it as a certified app (docs; release of 28 April 2026). NetSuite and Workday connect only through the API or SFTP, and no connector is listed for QuickBooks Online, Xero, Sage Intacct or Business Central. GL coding is outside its job.
Inside the product, users can trigger an AI analysis of uploaded documents and each check returns risk insights; the engine combines official data, pooled client data and a human anti-fraud team (docs, updated 21 September 2026), and claims of adaptive machine learning are the vendor's. The API suits an agent: an OpenAPI 3.0 file with 53 read and write operations, per-module tokens, webhooks, a mock server and a sandbox. There is no MCP server: the official registry returns nothing, the trustpair GitHub organization has no public repositories and the docs portal MCP is disabled (checked 27 September 2026).
Trustpair publishes two packages, Platform Access and Custom Access, with no prices; both carry a fixed number of vendor evaluations a year (pricing page, checked 27 September 2026). The docs say the SAP, SAP Ariba and Sage X3 connectors are sold as add-ons, partner-built connectors are priced by the partner, and sandbox checks beyond 500 may be billed. Vendr and SpendHound have no Trustpair page, so there is no public benchmark.
Trustpair executes no supplier payments: there are no payment rails, cards or reimbursements, and the only money it touches is the 1 euro a vendor sends in a micro-payment check, which Trustpair refunds (penny-drop page, checked 27 September 2026). What it hands off is a verdict: payment files in ISO 20022 pain.001 or CSV are checked against validated vendors before release, and SSI routes can be verified through the API. Blocking happens in the ERP or TMS: in SAP the treasury team blocks a flagged F110 proposal, and the Sage X3 connector stops the payment file automatically (docs, updated 23 September 2025). Liability cover of up to $1M comes only with Custom Access.
Global bank-account checks with a real API, but quote-only pricing, no payments and a sale still pending.
Written by the Audit Friendly research team. No vendor edits, no sponsored placement.
What you are buying is a control that confirms a supplier's bank account belongs to that supplier before money leaves. Trustpair checks new vendors, re-checks bank-detail changes, audits the whole vendor master and screens payment files before they go to the bank. It draws on bank data sources such as SEPAmail Diamond in France, UniCredit's IBAN Check in Italy and GIACT in the US, on pooled client data, and on an in-house anti-fraud team for exceptions. It runs inside SAP, Coupa, Kyriba and other tools among the 20+ connectors Trustpair lists, or through a documented REST API and SFTP. Basware signed a binding agreement to buy it on 26 August 2026, with completion expected later in 2026.
The catch is scope, price opacity and a pending owner. Trustpair approves no invoices and executes no supplier payments, so it sits beside an AP suite and a payment tool. Every package is quote only and sized by a yearly allowance of vendor evaluations; Trustpair's docs (updated 23 September 2025) say the SAP, Ariba and Sage X3 connectors are sold as add-ons, though the pricing page lists 20+ native connectors in both packages, and liability cover of up to $1M comes only with the Custom Access package. The 190-country reach is a vendor figure: Trustpair publishes coverage rates only for France and Italy, names GIACT for the US and J.P. Morgan's Confirm for 15 unnamed markets, and elsewhere a check can wait on human review. Live support keeps Paris business hours. Basware and Trustpair say the product stays standalone and open to other systems, but that is a stated plan for a deal that had not closed as of 27 September 2026.
Before signing, get in writing: the annual evaluation allowance and the overage rate, which connectors are add-ons and at what price, the liability cover terms and exclusions, confirmation rates by country on a sample of your own vendor file, support hours for your time zone, the dates and types of the current SOC 1 and SOC 2 reports, and a change-of-control clause that holds pricing and support for non-Basware systems such as Coupa, Ivalua and Kyriba after the deal closes.
- A multinational paying suppliers in many countries that still confirms bank-detail changes by phone callback.
- An SAP ECC or S/4HANA shop that wants bank checks on new business partners and on F110 payment proposals inside SAP.
- A treasury team on Kyriba or Sage XRT that wants each payment batch checked against validated vendor data before release.
- A small or mid-market team on QuickBooks Online, Xero, Sage Intacct or Business Central: no native connector is listed for any of them.
- A team that wants one tool to approve invoices and pay suppliers: Trustpair runs no approvals and executes no supplier payments.
- A buyer who wants Claude or another agent to work the vendor queue through an MCP server today.
The jobs a finance team actually hires Trustpair for
Jobs, mapped to how finance teams actually buy.
Validate a new supplier's bank account before it reaches the ERP
A check runs when a vendor is created or its bank details change, directly in SAP S/4HANA through the native connector. EDF Renewables, with 15,000+ vendors, says the team saved about 60 workdays of manual checks. Most checks clear automatically; the rest go to human review.
Audit and clean the vendor master
The Company Account Audit module re-evaluates every vendor, updates evaluations automatically when a supplier closes or changes bank, and suggests corrections. Societe Generale then connected Trustpair to Oracle through the API so new vendors are checked there.
Clean vendor data before an S/4HANA migration
Danone's global business services team audited vendor data country by country and now checks new or changed vendors automatically. Trustpair reports 82 percent of controls done within 72 hours, so some checks take days.
Check the payment run before it goes to the bank
Treasury uploads or sends the payment file, and Trustpair matches each payee against evaluations from the vendor master audit. In SAP the check runs on F110 payment proposals, and the Sage X3 connector can block a payment file with unfavorable suppliers.
Meet Nacha's 2026 ACH fraud-monitoring rules
Per Nacha, non-consumer ACH originators must run risk-based processes to identify payments sent under false pretenses, such as business email compromise and vendor impersonation; both phases were in force as of 27 September 2026. Trustpair, a Nacha Preferred Partner since 24 November 2025, pairs account validation with IRS TIN matching and sanctions screening and keeps an audit trail of each check; confirm with your bank how that maps to the rule.
Watch the same task in each tool
Forget the 40-row feature grid. Pick a finance workflow and see how this tool and its closest peers actually do it, with our verdict on who wins for whom.
Compare on what matters
What it actually costs
Here's what it really costs: published rates where a vendor lists them, aggregated quote data where they don't, plus a path to your own number.
Web app, a fixed number of vendor evaluations a year, validations in 190 countries, API and SFTP, SSO, dashboards, native connectors, monitoring and payment file checks.
Adds a dedicated solution consultant and customer manager, unlimited environments and liability cover of up to $1M.
Built by Trustpair; the docs (updated 23 September 2025) say sold as an add-on, though the pricing page lists 20+ native connectors in both packages.
Kyriba, Sage XRT, Ivalua, CGI, Exalog and others are priced in each partner's own plans.
Sandbox checks beyond 500 return an unevaluated status and may be billed; the mock server has no usage limit.
What it actually takes to go live
Basware and Trustpair's shareholders signed a binding agreement on 26 August 2026, subject to customary closing conditions, with completion expected later in 2026 and terms undisclosed (Basware release; The Paypers, 27 August 2026); no completion had been announced as of 27 September 2026. Trustpair's help center (article updated 24 September 2026) says current contracts, platform access and support arrangements remain unchanged, and that the announced plan is for Trustpair to stay a standalone platform that keeps supporting the systems customers already use; the homepage banner already reads that Trustpair joins Basware. Basware sells a rival AP suite, so buyers on Coupa, Ivalua or other suites should ask for a change-of-control clause that holds price, connectors and support after closing.
Trustpair cites 90 to 95 percent vendor coverage in France with SEPAmail Diamond and 90 percent in Italy with UniCredit's IBAN Check, plus GIACT in the US and J.P. Morgan's Confirm in 15 markets (Trustpair pages, 2024). Elsewhere it leans on pooled client data and its anti-fraud team, whose review can include a supplier callback (docs, updated 21 September 2026). Danone reported 82 percent of controls within 72 hours. Ask for confirmation rates by country on a sample of your own vendor file.
Both packages carry a fixed number of vendor evaluations a year and no public price (pricing page, checked 27 September 2026). Trustpair's docs (updated 23 September 2025) say the SAP, SAP Ariba and Sage X3 connectors are add-ons, while the pricing page lists 20+ native connectors in both packages, so ask which connectors the quote includes. Partner connectors are priced by the partner, sandbox checks beyond 500 may be billed, and liability cover of up to $1M comes only with Custom Access. With no Vendr or SpendHound benchmark, negotiate overage rates and a renewal cap up front.
Per Trustpair's help center (checked 27 September 2026), chat and email support run Monday to Friday, 9:00 to 18:00 CET, and the chat opens with an AI assistant. Most help articles need a Trustpair login. US teams working a pay run in the afternoon should ask for a named escalation path and US-hours coverage in the contract.
The docs portal MCP is disabled and no first-party or community MCP server was found (checked 27 September 2026). Tokens are created only by workspace admins in the web app, cannot be edited, and production API access comes after UAT sign-off. The published spec targets the sandbox, so integrators must switch base URLs.
Trustpair returns statuses such as favorable, unfavorable, pending, anomaly or unevaluated. In SAP the treasury team can block a flagged F110 payment proposal, and the Sage X3 connector blocks the payment file automatically, but Trustpair executes no payments, captures no invoices and runs no approval workflow. Per the modules doc (updated September 2025), its payment check relies on evaluations from the vendor master audit, so payees not audited there get no verdict unless the payment file carries a registration number.
Scored on what an outside agent can actually reach: the documented API, how it authenticates, and whether the vendor ships an MCP server.
Inside the product, the Trustpair evaluation engine checks company and bank data against official sources, adds proprietary data such as previously validated accounts, client payment history and known fraud patterns, and escalates incomplete or risky cases to an in-house anti-fraud team that can call the supplier on an independently verified channel (docs, updated 21 September 2026). Users can trigger an AI analysis of an uploaded document, and each check returns risk insights. Claims such as instant results on 90 percent of validations and a zero-fraud track record are the vendor's own.
Exists: no. The official MCP registry returns no Trustpair server, the trustpair GitHub organization has no public repositories, and a GitHub search for Trustpair MCP code returns nothing. The ReadMe docs portal at docs.trustpair.com answers /mcp with 401 Authorization required, and its page configuration marks MCP as disabled (checked 27 September 2026). No community server was found.
Scope: the public REST API is what an agent can use. Trustpair's OpenAPI 3.0 file lists 53 operations across vendor checks, vendor master audits, payment checks, payment history, cases and overrides, documents and AI document analysis, risk insights, micro-payment validation, tags, users and bulk imports, with webhooks for changes. Each token is set per module to read-only or read and write, and the API allows 100 requests per 10 seconds.
Turnkey: no. Only workspace admins can create tokens, and only in the web app. Production access follows UAT sign-off, and the published spec points at the sandbox (app-sandbox.trustpair.com), which allows 500 real checks; a mock server returns forced or random results for testing. Any agent connection is custom code against the production base URL, app.trustpair.com.
Process a vendor invoice
Who wins for whom: Treasury and AP teams that want bank ownership checked at onboarding, on each change and against the payment file, with screening on 80+ sanctions lists: Trustpair. US payers that want digitally signed W-9s, IRS TIN matching and SAM.gov screening on every vendor record: PaymentWorks. Enterprises paying a recovery audit firm that want duplicates risk-rated before the ERP pay run: Xelix.
Trustpair
Validates the payee behind the invoice. Trustpair checks bank-account ownership at onboarding, on every bank-detail change and against the payment file before release, adds IRS TIN matching and screening against 80+ sanctions lists, and logs investigations and overrides in an audit trail.
Where it loses: Approvals, PO matching, 1099 filing and e-invoicing sit outside its scope, and the SOC 1 badge reads Type 2 while Trustpair's only SOC 1 announcement, from November 2025, is Type 1.
- Compliance depth: 83/100
- Time to live: 24 hours to 3 months (vendor)
Source: AF score rationale: Compliance depth 83; Trustpair watch-outs.
Watch: Trustpair - Global Bank Account Ownership Verification Platform 1:50 · Official demo · Trustpair on YouTube (official)
PaymentWorks
Vendor record checks, no invoice workflow. PaymentWorks matches every TIN against IRS records, screens payees against OFAC, SAM.gov and up to 1,400 lists, re-authenticates any bank change before it applies, generates digitally signed W-9s, and lists SOC 1, SOC 2 and TX-RAMP.
Where it loses: The invoice itself is outside its scope: there is no invoice capture, bill approval, PO matching, GL coding, 1099 filing or e-invoicing, so another AP tool processes the bill.
- Compliance depth: 81/100
- Time to live: About 2 months (vendor)
Source: AF score rationale: Compliance depth 81; PaymentWorks not-for list.
Watch: PaymentWorks Demo 35:41 · Independent walkthrough · UC Davis Supply Chain on YouTube (customer training)
Xelix
Duplicate checks before the pay run. Transactions runs every invoice through rules and machine learning over 500+ datapoints, rating duplicate pairs High, Medium or Low risk before the pay run, while Vendors alerts on bank-detail changes and new vendors.
Where it loses: Approvals, PO matching, 1099, e-invoicing and sanctions screening sit outside the product, no SOC 1 report is mentioned, and dashboards refresh nightly as each data file lands.
- Compliance depth: 79/100
- Time to live: 4 to 10 weeks (vendor)
Source: AF score rationale: Compliance depth 79; Xelix watch-outs.
Watch: How to prevent duplicate payments with Xelix | Transactions module 1:47 · Official demo · Xelix on YouTube (official)
Pay a vendor
Who wins for whom: SAP or Sage X3 teams that want flagged payees blocked in the F110 proposal or payment file before release: Trustpair. US payers sending domestic ACH that want each payment checked against verified accounts and up to $2M indemnification: PaymentWorks. Enterprises that keep paying from the ERP and want duplicates and overpayments flagged before the pay run: Xelix.
Trustpair
Checks payment files before release. Trustpair executes no supplier payments: it checks ISO 20022 pain.001 or CSV payment files against validated vendors before release, and in SAP the treasury team blocks a flagged F110 proposal while the Sage X3 connector stops the file automatically.
Where it loses: There are no payment rails, cards or reimbursements, payees not audited in the vendor master get no verdict unless the file carries a registration number, and liability cover of up to $1M needs Custom Access.
- Payments & money movement: 31/100
- Time to live: 24 hours to 3 months (vendor)
Source: AF score rationale: Payments & money movement 31; Trustpair watch-outs.
Watch: Trustpair and Kyriba Native Connector Explained 1:26 · Official demo · Trustpair on YouTube (official)
PaymentWorks
Relays ACH files, adds a warranty. PaymentWorks relays domestic ACH files an ERP builds to the customer's bank, checking each payment against verified accounts with up to $2M indemnification on qualifying ACH, while EarlyPay pays vendors on approval for a vendor-paid 0 to 3 percent fee.
Where it loses: Wires, checks, cards and cross-border payments go straight to the bank, it runs no payables ledger, and the $2M warranty covers only domestic ACH to accounts marked Review Complete.
- Payments & money movement: 48/100
- Time to live: About 2 months (vendor)
Source: AF score rationale: Payments & money movement 48; PaymentWorks pricing tiers and watch-outs.
Watch: How EarlyPay Works 2:13 · Official demo · PaymentWorks on YouTube (official)
Xelix
Pre-payment flags, ERP pays. Xelix moves no money: it flags duplicates and overpayments before the pay run, alerts on vendor bank-account changes and, in full Helpdesk, maps bank-change emails to ERP data.
Where it loses: There are no payment rails, cards or reimbursements, blocking a flagged payment still happens in the ERP, and with no public API a payment block cannot run system to system.
- Payments & money movement: 24/100
- Time to live: 4 to 10 weeks (vendor)
Source: AF score rationale: Payments & money movement 24; Xelix watch-outs.
Watch: How to manage master vendor data with Xelix | Vendors Module 1:15 · Official demo · Xelix on YouTube (official)
Trustpair, kept current
Basware and Trustpair's shareholders signed a binding agreement, with completion expected later in 2026. Trustpair is to keep operating and selling independently as a Basware company.
Certa customers can run Trustpair's bank-account ownership verification and vendor evaluations inside Certa's third-party risk workflows.
Trustpair and Coupa expanded their 2024 partnership, making Trustpair a certified solution in the Coupa App Marketplace for supplier onboarding checks.
Teams can open a case on an unfavorable result, add comments and documents, and record a manual override from the ERP, TMS or a custom integration.
Imports of vendors, checks, payment checks and payment history can now run through the API, recommended for 50 or more records, with per-row results.
Trustpair announced expanded US banking data ahead of Nacha's 2026 rules, strengthened validation in 13 existing markets including Canada, Mexico and the UAE, and fraud liability cover up to $1M.
Trustpair FAQ
Trustpair publishes no prices. Its pricing page, checked 27 September 2026, lists two quote-only packages, Platform Access and Custom Access, each with a fixed number of vendor evaluations a year. Custom Access adds a dedicated consultant, unlimited environments and liability cover of up to $1M.
Vendr and SpendHound have no Trustpair page, so there is no public benchmark. Expect the quote to scale with your evaluation allowance and connectors: the SAP, SAP Ariba and Sage X3 connectors are sold as add-ons, per the docs.
Trustpair's contract terms are not published on its site. Its privacy policy says personal data is deleted or archived for the statutory limitation period when the terms end. Ask for the notice period, the renewal cap and a change-of-control clause, given the pending Basware acquisition.
Data can leave through CSV exports from the web app, an optional SFTP export of evaluation results and the REST API, which returns checks, audits, cases, documents and payment history. Trustpair's docs advise parsing exports by column header, since columns change over time.
Trustpair says platform access arrives within 24 hours of signing, and its Kyriba connector switches on in a day. Connector rollouts take longer: EDF Renewables went live on SAP S/4HANA in under 3 months, and Decathlon cleaned its vendor master in 4 months (Trustpair case studies).
A Trustpair solution consultant and project manager lead deployment, then a Customer Success Manager takes over. Your IT team handles the connector, SFTP (set up through the CSM with IP allow-listing) and SSO, and production API access needs UAT sign-off.
Not out of the box. There is no Trustpair MCP server, and the MCP on its ReadMe docs portal is disabled (checked 27 September 2026).
The public REST API is well documented: 53 read and write operations covering vendor checks, audits, payment checks, cases and overrides, documents, tags and imports, with a sandbox and a mock server. A workspace admin must create a scoped token in the web app, and a developer must write the connection.
Trustpair alternatives
Ask us anything
Answered only from our own published research on this tool, never from general internet noise. If we cannot answer it well, our research agents will dig in and publish a sourced answer.
