Built to decline a deposit earlier, not to move one faster.

The position

The value we sell is on the receiving side. A custodial institution is almost never the direct target of an enforcement action; what reaches it is money that moved while an action against somebody else was already under way. Everything we build serves the decision to hold or refuse that deposit before it is credited. Nothing we build serves the decision to move it.

That is not a mission statement. It is the reason for a set of concrete restrictions on what our product can do at all, listed below. Each one costs us either revenue or reach, which is what makes it a constraint rather than a preference.

Design decisions that make misuse hard

Policies are enforced by whoever is on duty. These are enforced by the absence of a capability, which is a stronger guarantee and a cheaper one to audit.

1. 01

   The public record is retrospective, with no delayed edition

   It carries actions that have already executed, and marks the interval each one turned out to have, afterwards. Publishing an action that has not executed yet is rejected by the content schema at build time, so a well-meaning editor cannot ship one by mistake.

   Nobody can read anything from us that is still under way, at any delay. Delaying such a feed by minutes would not mitigate anything, which is why there is no delayed tier rather than a slow one.

2. 02

   Live matching returns a verdict, never a target

   For a verified institutional customer the API answers one question: does this deposit relate to enforcement activity, and how healthy is the path it arrived on. It returns a verdict and a coverage health field. It does not return the address under action, the path, the counterparty, or anything the customer did not already put in.

   A customer account cannot be used to discover a target. The most it can reveal is something about the addresses the customer already controls.

3. 03

   No bulk export of anything under way

   There is no endpoint, report, file or console screen that enumerates enforcement activity in progress. Verdicts are per-deposit and per-customer. Rate limits and logging apply to every one of them.

   Compromising a customer account yields a slow trickle of answers about that customer, not a map of anything.

4. 04

   Nothing we ship can move funds

   No signer, no custody, no transfer endpoint, no private key capable of a value-bearing transaction. Collectors hold read-only credentials.

   Even a fully compromised deployment cannot be used to move anyone's assets, ours or a customer's.

5. 05

   Judgements are never automated on our side

   We return a verdict and the evidence behind it. Applying it is the customer's decision, logged on their side. Every failure path in the decision gate resolves to hold, never to credit, so an outage cannot be used to wave a deposit through.

   The system cannot be made permissive by breaking it. Breaking it makes it stricter.

Why this is published before anyone asks

A comparable compliance vendor was pushed into publishing a responsible-use statement after being accused of building a tool that helps the people it claims to detect. Written under that pressure, the same words read as a defence. Written now, they read as a specification, and they are one: everything on this page is either already true of the product or a constraint the product is being built against. If we ever have to change one of them, the change will appear in the newsroom with the reason attached.

Reporting suspected misuse

If you believe our product or our published record is being used to evade enforcement, tell us. Reports from competitors, researchers, journalists, issuers and supervisors are all in scope, and you do not need to be a customer.

abuse@4shock.xyz

What to include

What you observed, when, and which of our surfaces was involved. Do not send us private keys, credentials, or personal data about a third party. We do not need them and we would rather not hold them.

What happens next

We aim to acknowledge within three business days. Where a credible report involves an account, we can suspend access immediately, revoke verification, and preserve the audit record. Findings that change a policy or a product constraint are published in the newsroom.

What we will not do

Confirm or deny whether a named organisation is a customer, to you or to anyone else, without legal compulsion. That protection is the same one our customers rely on, and it does not have an exception for good causes.

Posture toward issuers and supervisors

• We notify major issuers and the relevant supervisors of our positioning before a production deployment goes live, rather than after a first story about it.
• We act for neither. We are not an agent, a delegate or a reporting channel for any issuer or authority, and we receive no privileged notice from any of them. Everything we observe is public data that anyone else could observe.
• We respond to lawful requests through counsel, and we will say publicly that a request category exists wherever the law allows us to.
• If an issuer changes how it executes so that nothing is observable in advance, we will report the change in the public record and we will not attempt to work around it. Advance visibility is a by-product of how an issuer chooses to be governed. It was never ours to protect.