Trust & Security

Every screen is deterministic and auditable. We don't return an opaque score — each verdict carries the evidence behind it (which list matched, which entity was attributed, which fund-flow path was traced), and every check is recorded with its timestamp and the sanctions list state in force.

How a verdict is produced

1. 1
   Sanctions & scam matching. The address is checked directly against OFAC sanctioned digital-currency addresses and open abuse/scam databases. A direct sanctions hit is decisive.
2. 2
   Entity attribution. Known addresses are labelled with a neutral entity type (exchange, mixer, bridge, gambling). These labels are kept separate from risk, so a legitimate exchange hot wallet is identified without inflating its score.
3. 3
   Fund-flow analysis. For unattributed addresses we trace fund flow on Bitcoin and cluster outflows on Ethereum, and detect structuring patterns — deposit clustering, peel chains, layering, and exposure to mixers or bridges.
4. 4
   Indirect counterparty exposure. Downstream exposure to sanctioned, darknet, or scam counterparties raises the score — but indirect signal alone is capped so it forces a REVIEW, never an automatic rejection.
5. 5
   Score → policy → verdict. The result is a 0–100 risk score, which your own policy thresholds turn into a verdict.

Each result also names the specific risk typologies it found — e.g. MIXER_EXPOSURE, SANCTIONS_EXPOSURE, PEEL_CHAIN, EXCHANGE_DEPOSIT — so an analyst can see why, not just what.

Limitations. On-chain attribution is probabilistic — we cite the source behind every flag rather than asserting certainty, stay deliberately conservative on indirect exposure, and you set the thresholds. The REVIEW band exists precisely so a human makes the call on ambiguous cases.

What we store: the address and chain you submit, the screening result and its evidence, audit logs (timestamp, user, request ID), and your account and billing data. We never take custody of funds or private keys.

Encryption: data is encrypted in transit (TLS) and at rest. API keys are stored only as salted hashes (SHA-256); other secrets are encrypted with AES-256-GCM. Plaintext keys are shown once, at creation, and never again.

Retention & your rights: screening results and audit logs are retained so they remain available for your own compliance and audit obligations. You can export or delete your organisation's data on request; consumer investigation data is anonymised and soft-deleted under our retention policy, in line with GDPR data-subject rights.

Residency: servers, databases and backups are in the Netherlands (EU).

Every third party that receives data you submit, grouped by the service that sends it. For each external service we name the country where the provider is based. Each lookup service receives only the value being looked up. List as of 5 October 2026.

Organisation accounts: third-party lookups are off by default. With them off, an organisation's data goes only to the recipients under “All services”. Screening runs against our own sanctions lists and attribution database, and each result in the portal and the API lists the checks that did not run. An organisation owner or admin can turn the lookups on in the portal settings. The address lookups and the investigation lookups below then apply.

Sanctions screening runs on our own servers against our copy of the OFAC list. Nothing is sent to a third party for it.

Our Data Processing Agreement (DPA) is available on request.

• Token-authenticated APIs with per-key scoping and rate limiting.
• Least-privilege internal access; secrets encrypted at rest; service isolation.
• Append-only audit trail for review decisions, configuration and access changes; every screening is recorded with timestamp, result and the sanctions list state in force.
• Continuous dependency and vulnerability scanning on our build pipeline.
• Responsible disclosure welcome at security@chainevidence.net.

Every evidence report we issue is digitally signed with an Ed25519 key over a canonical record of its contents. Anyone holding a report can confirm it is genuine and unaltered — independently, without trusting us — by checking that signature against the public key below.

Paste the hash printed in a report's verification panel at chainevidence.net/verify, or verify offline with the key here. This replaces the older “email support to confirm a checksum” step — verification is now self-service and cryptographic.

Keys may rotate; each signature names the key that produced it, and previously published keys remain valid for reports signed under them.

• GDPR-aligned. Data minimisation, servers, databases and backups in the Netherlands (EU), a published list of every recipient, and data-subject export/erasure on request.
• Built for the EU Travel Rule (TFR). Designed around the screening and originator/beneficiary obligations CASPs carry under Regulation (EU) 2023/1113.
• DPA. Available on request for any paying customer.