Neutrality has to be structural, because a promise is not checkable.
Our customers compete with each other, and we ask each of them to hand over the addresses they care most about. That is a large request. It is reasonable only if the constraints protecting them are properties of how the system is built rather than undertakings you take on faith. Each constraint below is stated three ways: what it forbids, how it is implemented, and how a third party could check it without our cooperation.
Updated
2026-08-24
The ask, stated plainly
To tell a desk that an incoming deposit relates to an enforcement action, we have to know which addresses that desk settles into. Those addresses describe its counterparties, its flow and its structure. A competitor would pay for them. So would an attacker.
Everything below follows from treating that as the most valuable asset in the system, above our own uptime. Where confidentiality and availability conflict, confidentiality wins: the correct behaviour is to refuse service, not to degrade it. On your side a refusal resolves to HOLD. No failure path of ours produces a credit.
Six constraints
01
Not affiliated with any issuer
We take no position on whether a freeze is justified, and we play no part in any freeze decision.
Constraint
A separate legal entity, brand and staff, with no employees shared with any exchange, vault, market maker or issuer. The charter prohibits proprietary trading, market making and asset management. We do not initiate, endorse, contest or delay any enforcement action, and we publish no view on whether one is justified.
Implementation
What we publish is derived from public chain data and from records issuers publish themselves. There is no channel from our system into any issuer mechanism, and no arrangement that pays us differently depending on what gets frozen. We are not an agent of any issuer or any authority, and we receive privileged notice from neither.
Independent check
Incorporation documents, the charter clauses and a staff roster attestation go into the data room during procurement. Beyond documents: nothing we publish carries a name, a label or a score capable of shifting an enforcement outcome, so there is no lever here for anyone to buy.
02
We hold no keys
No custody, no signing, no transaction execution. There is no key in the system capable of moving funds. That is an architectural fact, not a policy.
Constraint
No private key anywhere in the system can sign a value-bearing transaction. This is a property of what is built, not a policy that is maintained, so there is nothing to relax later.
Implementation
Collectors authenticate to chain endpoints with read-only credentials. No binary we ship contains a signer, a custody component or a transfer path, and the API exposes no method that constructs, signs or broadcasts a transaction. The product declines a deposit earlier. It never moves one.
Independent check
Run it yourself. In a self-hosted deployment, give the process credentials with no signing rights and restrict egress to read-only endpoints: nothing degrades, because nothing needed them. The client SDK is open source, so the full request surface it can reach is readable.
03
Your address book stays yours
Encrypted under a per-customer key and matched without decryption. Cross-customer queries are not expressible in the data layout, not merely denied by permissions.
Constraint
Your address book is encrypted under a key that is yours alone, matched without ever being decrypted, and cross-customer queries are absent from the data layout rather than blocked by a permission check.
Implementation
Envelope encryption: one data key per customer, wrapped by a customer-specific key held in a KMS. The service stores ciphertext plus an HMAC index and matches against the index, so a match never requires plaintext. Every customer table is partitioned by customer identifier and carries it as the first column of the primary key, injected at the query layer. The public record pipeline is physically separate from the customer pipeline, so an address book has no route into anything we publish.
Independent check Planned
Permission systems are audited by reading policy; layouts are audited by reading schemas. Ask for the schema and the query-layer path in technical review. Every internal access, operational queries included, lands in an append-only audit log you can export for your own rows. A third-party security review has not happened yet; this page will keep saying so until it has.
04
No escape tooling
Nothing we ship moves funds, and nothing we publish helps a target get ahead of an enforcement action. The Bulletin is retrospective for exactly this reason.
Constraint
Nothing we ship moves funds, and nothing we publish helps a target get ahead of an enforcement action.
Implementation
The public record carries only actions that have already executed. Anything still under way reaches institutional customers who have passed KYB and no one else, as a verdict on addresses they control: never the address under action, never the path, never a file. A delay is not a mitigation for publishing that data, so there is no delayed version of it either.
Independent check
Read the responsible-use statement, then read the API contract beside it. There is no endpoint that returns a target address, a list of them, or an export.
05
Reproducible
Every entry carries the references needed to recompute it from public chain data. The verifier that performs that recomputation is open source, released at tag v0.2.0, and each entry names the tag its digest was produced with.
Constraint
Nothing we publish is signed by an individual. Reproducibility is what stands in place of an author and their credentials.
Implementation
Every entry in the public record ships with the transaction reference it was derived from, the version of the verifier, and a digest of the recomputed result. Every research report declares its window, its population and its exclusions before it declares a number.
Independent check Planned
Recompute an entry from public chain data and compare digests. Open source: the verifier, the schemas, the decoding for mechanisms that are already public, and the client SDK. Not open source: the scheduling and discovery logic of the collectors, and the contents of the authority registry. That boundary is stated rather than blurred, and it is drawn so that you can recompute everything we publish without learning what we watch.
06
You can leave
Self-hosted deployment is the default for institutional customers, with full data export on request. We do not build lock-in and we do not sell your data, including to ourselves.
Constraint
Self-hosted deployment is the default for institutional customers, not the last line on a price list. Your address book stays inside your environment.
Implementation
A single process, PostgreSQL, object storage. Evidence is content-addressed, so exported records stay verifiable after they leave us. Export covers every record we hold about you, in the format we store it in, on request and at exit.
Independent check
Run the export on day one rather than at the end. If it does not round-trip, the commitment is not real, and you find that out before you depend on it.
Limits
What we are not.
These are the four or five things a buyer usually discovers in month three. Discovering them now costs us a conversation and saves you a procurement cycle.
We do not produce attribution or entity labels
We normalise which enforcement actions are visible, across issuers and chains. We do not tell you who anyone is. Attribution needs subpoena data and years of accumulated intelligence; it is not an engineering problem, and we do not claim to have solved it.
We do not give compliance advice
We deliver data, a verdict on your own addresses, and an evidence trail. The judgement, and the responsibility for it, stay with you. Our service level covers availability and latency. It never covers whether a judgement was right.
Coverage is not complete and will not become complete
Some enforcement mechanisms leave a readable trace before they take effect, some leave one only afterwards, and some leave none at all. That is a property of how issuers are governed. It is not something we can engineer away, and it is why lead time is not a capability we offer.
Silence from us is not evidence of safety
Every response carries a coverage health field, so that "we saw nothing" and "we cannot see" arrive as different answers. A stale list or a disconnected collector is a blind condition, and a blind condition is not a clean one.
There is no synthetic score
Where sources disagree we return them side by side, unmerged and unweighted, with references to the raw responses we snapshotted. Vendors score on scales that are not comparable; collapsing them into one number would hide that. We would rather hand you the disagreement.