How we handle your data

• The assessment and the API classify your file or text in memory, for the length of one request.
• Our code does not write it to disk, to a database, or to logs.
• Nothing leaves the request except the response: the report, the classified ledger, or the classification.
• The classifier runs inside our own server function. Your data is not sent to a third party, a model provider, or a blockchain analytics service.
• The rate limiter keeps your IP address and request times in server memory for 60 seconds, then drops them.
• The site and the API are served over HTTPS only.

The site uses Vercel Web Analytics for page views. It sees which pages are visited. It does not see the files you upload, the text you classify, or the results. We send no custom analytics events.

The site also uses PostHog (US cloud) for product analytics, with page text masked and session recording off.

• Every name in the registry comes from a public record: regulator lists, SEC filings, FinCEN and state registers, court records, and company legal pages.
• Every name carries its provenance: the source URL, the date it was checked, how it was obtained, and a review status. Each match in a report shows that provenance.
• The registry page publishes the counts, the source mix, and the admission rules.

Confidence comes from a calibration table (version 0.4.1+2026-10-10) fitted on synthetic payment descriptors, not on labeled bank data, because no institution has labeled a real set with us yet. Every report and every API response says so. The full table is public at GET /api/v1/calibration.

A no_match verdict is not a statement that a counterparty is unrelated to crypto. The registry does not claim complete coverage.

Monitoring has to remember the counterparties you ask it to watch. The full service stores that watched book, its verdict history, and webhook delivery records in its own database, scoped to your API key. It is not publicly hosted; we set it up for each design partner.

• We do not have a SOC 2 report.
• The calibration is not yet fitted on labeled bank data.

If your review needs something not on this page, ask and we will answer in writing.

Email contact@cryptoornot.com with what you saw. For an API problem, include the X-Request-ID response header. For a wrong verdict, include the payment text and the rail, and we will check the registry record behind it.