Trust & Sub-Processors
Last updated: October 2026
This page lists the third-party services ChainHint relies on to operate the platform. Per GDPR Article 28, customers are notified of these sub-processors and any future additions. We commit to publishing changes to this list at least 30 days before they take effect for production data. Companion pages: /security for the controls in place, /privacy for the data we collect.
Tier 1 — Sub-processors that handle Personal Data
These services process data that may include EU Personal Data (email, IP address, account metadata).
| Provider | Purpose | Data processed | Region |
|---|---|---|---|
| Supabase Inc. (USA) | Database, auth, Edge Functions, file storage | Account email, OAuth profile, auth tokens, IP (in audit logs), incident records, payment metadata | AWS eu-west-1 (Ireland) |
| Lovable AB (Sweden) | Frontend hosting (React app) | Request IPs, user-agents, performance telemetry | EU |
| Functional Software, Inc. dba Sentry (USA) | Error tracking, performance monitoring | Error stack traces (may include user IDs / emails in error context), browser metadata | EU (Germany) — Sentry EU data region |
| Google LLC (USA) | Web analytics (Google Analytics 4) — loaded only after cookie consent | Pseudonymous client ID, pages viewed, referrer, coarse location derived from IP (IP itself is not stored), browser metadata | US / EU (EU–US DPF) |
| Cloudflare, Inc. (USA) | Cookieless web analytics beacon (Cloudflare Web Analytics) | Page URL, referrer, user agent, country derived from IP, page-timing metrics — no cookies, no identifiers, no fingerprinting per Cloudflare's policy | Global edge (EU–US DPF) |
| Resend, Inc. (USA) | Transactional email | Recipient email address, email content | AWS eu-west-1 (Ireland) |
| NOWPayments OÜ (Estonia) | Crypto payment processing | Customer email (invoice metadata), payment amount, blockchain tx metadata | EU |
| Google LLC (USA) | OAuth identity provider | Google account: name, email, picture URL (scope: openid email profile) | Global |
| GitHub, Inc. / Microsoft (USA) | OAuth identity provider, source code hosting | OAuth: name, email; Source: codebase | Global |
| Anthropic PBC (USA) | AI report generation (Claude API) | Incident summary text (no PII intentionally — only addresses + on-chain data); used via "no training" API tier | USA |
Tier 2 — Blockchain data providers (no PII)
These services receive blockchain addresses and transaction hashes (which are public on-chain data, not PII) and return on-chain data. We do not transmit user identity, email, IP, or account information to these providers. Listed for transparency.
| Provider | Purpose | Region |
|---|---|---|
| Moralis Web3 Technology AB | EVM wallet history, tokens, DeFi positions (tier 1 cascade) | EU (Sweden) |
| Alchemy Insights, Inc. | EVM tx/transfers (tier 2 cascade); Solana RPC transaction history | USA |
| Ankr Network | EVM tx/transfers (tier 3 cascade — BSC/AVAX/Gnosis) | Global RPC |
| NodeReal (MegaNode) | EVM tx/transfers (BNB Chain fallback after Ankr) — from 13 Nov 2026 | Global RPC |
| Etherscan | Entity labels, contract source, internal txs (60+ EVM chains) | USA |
| GoPlus Labs | Token security flags, address risk scoring | Asia |
| Chainalysis Inc. | OFAC sanctions screening | USA |
| DeFiLlama | Protocol TVL, hacks database, historical token prices | Global CDN |
| 1inch Network | Token enrichment, swap-event detection, spot prices | Global |
| TON Foundation | TON chain account info + event-based tracer (TonAPI) | EU/Asia |
| Blockstream / mempool.space | Bitcoin tx + address data | Global |
| TronGrid | Tron chain tx/transfers + TRC-20 metadata (Tron tracing) | Global |
| TronScan | Tron public account tags (exchange/scam entity labels) | Global |
| U.S. Treasury — OFAC | Specially Designated Nationals (SDN) list, incl. listed digital currency addresses (public domain, U.S. Government work) — synced to our DB, not a runtime call | USA |
| OpenSanctions | Sanctions and law-enforcement list data not yet taken from a primary source (Israel NBCTF seizure orders, FBI Lazarus attributions, some other government lists; CC BY-NC 4.0) — synced to our DB, not a runtime call | EU (Germany) |
| DG Trésor (French Treasury) | Registre national des gels — EU, UN and French asset-freeze list data (Licence Ouverte v2.0) — synced to our DB, not a runtime call | EU (France) |
Tier 3 — Operational tools (do not process customer data)
| Provider | Purpose |
|---|---|
| Cloudflare | DNS resolution for chainhint.com — sees domain queries only |
| ipinfo.io (lite tier) | Anonymous geo-IP for visitor analytics; no PII sent beyond the visitor IP the provider already sees from the request |
Cross-border transfers
ChainHint is operated from the EU. Some sub-processors are US-based. For US transfers we rely on:
- EU–US Data Privacy Framework (DPF) for participating providers (Google, Cloudflare, GitHub/Microsoft).
- Standard Contractual Clauses (SCCs) for non-DPF providers (Sentry, Resend, Anthropic, NOWPayments, Supabase) — incorporated by reference into each provider's DPA.
For customers with strict EU data-residency requirements, contact us via the contact form to discuss EU-only deployment options.
What ChainHint never sends to sub-processors
- Plaintext passwords (handled by Supabase Auth, hashed before storage)
- Payment card data (NOWPayments crypto-only — no card data exists in our system)
- Government IDs, biometrics, health data
- The contents of investigations beyond what is strictly needed for AI report generation (incident summary text → Anthropic)
- Anything at all from our funnel step counters — they stay first-party, hold only "step name + date + number", and no sub-processor sees them (see /privacy §2)
How to be notified of changes
We publish updates to this page whenever the sub-processor list changes. For B2B customers, we commit to 30 days written notice via email before adding a new sub-processor that will process customer data. To object to a new sub-processor, use the contact form.