Product

Three readouts, one record.

Radar tells you what is moving against addresses you hold. Screening tells you what every authoritative list says about an address. Gate turns both into a single answer before you credit a deposit. Evidence keeps what each of them saw, in a form you can check without us.

Readouts: 3
Record: append-only
Deployment: self-hosted

What each one answers

Four questions a custodial desk asks in a different order every day. Each has its own page.

Radar

Institutional

Live enforcement signal, matched against your own address book. You upload the addresses you control; we return a verdict on those addresses — whether anything in flight reaches them, and how serious it is. Alongside it: continuous verification of who can freeze your assets right now, and an alert the moment that authority changes.

Match-only by design. The API returns a verdict on your addresses. It never returns the target address, never returns path detail, and offers no bulk export of anything in flight.

Who it is for: Treasury, and whoever signs off on listing an asset

Radar

Screening

Institutional

One call returns what every authoritative list currently says about an address. Each answer — hit or no hit — carries the source, the list version, and a reference to the exact response we stored, rather than a boolean we computed.

Results from different sources are returned side by side and never merged into one number. Where they disagree, you are told they disagree.

Who it is for: The engineers currently maintaining one integration per list

Screening

Gate

Institutional

The deposit decision itself. One call before you credit: CREDIT, HOLD or REJECT, with the reason, the pool it belongs in, and an immutable evidence snapshot of everything the decision rested on.

Never fails open. Vendor timeout, exhausted budget, a stale list and our own downtime all resolve to HOLD — never to CREDIT.

Who it is for: The deposit crediting path itself

Gate

Evidence

Institutional

Every decision, the data it rested on, and the rule version that produced it — written once, never updated, never deleted. Content-addressed snapshots, an audit bundle on one request, and integrity you can check without asking us.

Derived conclusions can be recomputed at any time. Raw snapshots cannot be rewritten, including by us.

Who it is for: Compliance, audit and counsel

Evidence

Who it is for

One trait defines the customer: you credit assets you did not originate to your own ledger — OTC desks, payment channels, bridges, perpetual-DEX margin vaults, custodial wallets. If you do not know a deposit’s enforcement status before you credit it, a freeze that lands afterwards is your loss to absorb.

See who this is for

One deposit, in order

Radar runs whether or not a deposit arrives. The other three sit on the crediting path.

01

Standing

Radar verifies which party currently holds freeze authority over every asset you hold, and alerts you when that changes. This runs continuously and is not tied to any deposit.
02

Arrival

A deposit lands. Your integration calls Gate once, before the balance becomes withdrawable.
03

Lookup

Gate reads Screening for list state and Radar for any live enforcement signal touching your address book. Paid sources are consulted only when the gating order you configured says to.
04

Verdict

Gate returns CREDIT, HOLD or REJECT with a reason class, the pool the funds belong in, what would clear a HOLD, and a reference to the evidence.
05

Record

Evidence writes the decision and every raw response behind it. Nothing in that record can be edited afterwards, by you or by us.

Constraints that apply to all four

These are design properties rather than policy promises. Where the two differ, prefer the one you can check.

Never fails open: Every degraded path resolves to HOLD. A timeout, an exhausted budget, a stale list, a blind spot, our own outage — none of them can produce CREDIT, and no configuration flag changes that.
No synthetic score, in any mode: No combined risk number reaches a customer response, including in debug output. Sources are returned side by side, in their own terms, and the judgement stays with you.
Match-only: The API answers questions about addresses you already control. It never returns a target address, never returns path detail, and offers no bulk export of anything still in flight.
Blind spots are reported: Every response carries coverage health, so that silence is never ambiguous: you can always tell "we looked and found nothing" from "we could not look".
No keys that can move funds: Collectors run on read-only credentials. There is no private key anywhere in the system capable of signing a transfer. That is an architectural fact, not a policy we could quietly revise.
Your address book stays yours: Stored encrypted under a key bound to you, and matched through an index that does not require decrypting it. Cross-customer queries are not expressible in the data layout, rather than refused by a permission check.
Self-hosted is the default shape: For an institution with custodial flow, private deployment is the normal delivery form, not a last-resort option. Your address book does not have to leave your environment for any of this to work.

The public layer

The Foreshock Bulletin is free and needs no account: a reviewed record of freezes that have already executed, with each interval measured after the fact. It is deliberately retrospective, and it never carries a live event at any delay.

Read the Bulletin