Privacy · P4

Third-party calls in the payment flow

Which third parties see a request during a payment, and can they be swapped out?

Why it matters

Indexers, price oracles, and risk vendors in the critical path each see payer addresses and amounts. They are data processors whether or not anyone calls them that.

A score of 3 needs evidence naming the distributed package (name, version and integrity hash) or a network trace, not only source code in a repository.

The top score rewards the absence of a problem. It is only available when every required component in the request path is public, or a network trace covers the closed parts.

Scoring anchors

3 Strong	Only the configured RPC; no third-party indexer, risk-scoring, or pricing vendor in the critical path.
2 Partial	Third parties present, named in code, swappable by config.
1 Weak	Present, disclosed in docs only.
0 Fails	Undisclosed third parties in the flow.
No evidence	No admissible evidence submitted yet. Counts as 0 in the pillar.

Admissible evidence

SDK source for endpoints at a pinned commit verified
Network trace documented (trace)

Common failures

Wallet-connect relays and RPC providers forgotten in the inventory.

Current ratings

Provider	Score	Finding
Aleo (credits.aleo private transfers)	2 Partial	By default the SDK and CLI query and broadcast through Provable's API, which sees the user's IP, the records they look up and the transactions they submit; the parameter host sees downloads. All are named in code and swappable for a self-run node. Optional delegated proving and record scanning send more (an authorization or a view key) to Provable. Scored 2: third parties present, named in code, swappable by config.
AnomaPay	1 Weak	The proving service, Vast.ai, the indexer and an Envio GraphQL endpoint sit in the payment path; they are named in docs but not shown in public code. Scored 1.
Avalanche Card	1 Weak	Rain entities, Third National, Visa and unnamed verification, analytics and oracle providers see payment data. They are disclosed in docs only and are not swappable. No trace was run, so 1.
Avici Card	1 Weak	Third parties are disclosed by category, and some by name in docs (Sumsub, Third National, Visa, ZeroDev, Relay, Moonpay, Bridge). None can be swapped. No trace was run, so 1.
Aztec (Alpha mainnet private token transfers)	2 Partial	With a local node, only the user's Ethereum endpoints see anything. With a remote node (for example Aztec Labs' hosted RPC), that operator sees the user's IP, the transactions they send and the notes and logs they query. The node URL is named in code and swappable. Scored 2.
Bitget Wallet Card	1 Weak	Third parties in the card flow (Fiat24, Marqeta, Mastercard, the KYC vendor) are disclosed by category in Fiat24's policy, and none can be swapped. No trace was run. Docs only, so 1.
Blanksquare (Shielder)	2 Partial	On the SDK path only the chosen RPC and, if used, the relayer see a request; the relayer sees the withdrawal address and the user's IP. The apps add PostHog and Reown/WalletConnect. Named in code and swappable in the SDK. Scored 2 (3 would need a package or trace).
COCA Card	1 Weak	Third parties are disclosed by category (Privy and Morpho are named in the docs; the card issuer and KYC vendor are not). None can be swapped. No trace was run, so 1.
Coinbase Commerce (Onchain Payment Protocol)	1 Weak	In the SDK path, the only third party besides Coinbase is the RPC provider, and an integrator can replace the RPC. In the hosted path, Sprig, Amplitude, Bugsnag and Google reCAPTCHA see the payer's session, and nobody can swap them out. The policy discloses them only as categories. Judgment call: we score 1 and not 0, because the vendors appear in shipped code and are covered by the category disclosure. They are not named in any document.
Curvy	1 Weak	Curvy's API and broadcaster see every payment, and Global Ledger scores each depositing address. Both are named in a docs repo, but the screening vendor sits in the closed broadcaster and cannot be swapped. LI.FI joins bridged routes. Scored 1: third parties are disclosed in docs and not swappable.
Daimo Pay	1 Weak	In the crypto wallet flow, the client talks only to Daimo's API and the user's wallet. The API receives the payer's address in order to list balances. The fiat and account flows name Privy, Coinbase, and Stripe in code, and Sumsub in the docs. An integrator cannot replace any of them through config. The backend's own vendors, such as indexers, price sources, and log aggregation, are not visible to us, and the policy names them only by category. No trace was run. Judgment call: we score 1 and not 0, because the third parties that are visible are named and disclosed.
Deblock Card	No evidence	No admissible evidence yet.
Ethena Pay	1 Weak	Rain, Third National, Visa, Sumsub and Privy all see payment or identity data; they are disclosed in the Terms only and cannot be swapped by the user. The app is closed, so further third parties (analytics, RPC) cannot be inventoried.
ether.fi Cash	1 Weak	A card payment is seen by ether.fi's backend, Rain or Reap, Third National and Visa. Signing goes through Turnkey, and the KYC vendor is not named. These parties are disclosed in docs or code, but none can be swapped by the user. No trace was run. Present and disclosed, not swappable = 1.
Exa Card	1 Weak	A payment is seen by Rain, Third National, Visa, Sardine and Segment, plus Alchemy on the app side. All of them are named in public code or docs, but none can be swapped without code changes. No trace was run. Judgment call: named in code (2) but not swappable by config (1); I took the lower anchor.
Fluidkey	1 Weak	Fluidkey's backend sees every payment, and Privy, risk-screening providers and feature partners are disclosed only in docs and the policy; the app code is closed. Scored 1.
Fuse Card	1 Weak	Bridge, Lead Bank, Visa, and Turnkey if used, see card activity. They are disclosed in docs, not swappable, and the app is closed. 1.
Gnosis Pay	1 Weak	A card payment is seen by Visa, Monavate and Gnosis Pay's backend, which are disclosed in docs and not swappable. In the web app, WalletConnect and Pylon are named in code but hardcoded; only the RPC and API base URL are configurable. No trace was run. Third parties are present and disclosed but not swappable by config, so 1.
HesabPay	1 Weak	Third parties see transaction data and are disclosed only in the policy. Most are named by category, a few by name. Nothing shows whether they can be swapped.
Hinkal	1 Weak	In the default SDK flow, Hinkal's backend sees each request: Merkle siblings, risk checks and deposit reports. Chainalysis screens the depositing address. Swap and bridge flows add CoinGecko, LI.FI and OKX. These parties are named in the policy or visible in the npm build, but the endpoints are fixed by build mode and cannot be swapped by config. Scored 1.
Holyheld Card	1 Weak	KYC vendors, screening vendors and the card issuer and network all see payment or identity data. They are disclosed in the privacy policy (some only by category) and cannot be swapped. Disclosed in docs only, so 1.
Houdini Swap	1 Weak	Each private swap exposes the deposit, amounts and payout address to two exchange partners and their screening vendors, plus Houdini itself. The partners are named in docs, while the screening vendors are named only by example. Houdini's engine picks the partners; the docs describe no user-side configuration that removes them. Disclosed in docs only, so 1.
Hyperbeat Card	1 Weak	Third parties (Turnkey, KYC provider, card issuer, Visa, analytics) are in the flow and disclosed only partly, in documents. Judgment call: 1, because the main ones are disclosed by name or category; the unnamed issuer keeps it from anything higher.
Jupiter Card	1 Weak	The third parties that see a card payment (issuer, Visa, SumSub, Noah for withdrawals) are named in docs and are not swappable; each user gets one issuer by country. No trace was run. Present, disclosed in docs only, so 1.
M-Pesa	No evidence	No admissible evidence yet.
MetaMask Card	1 Weak	A card payment is seen by Baanx/Crypto Life, Monavate and Mastercard; the app also reads through Infura. These parties are named in docs and code but cannot be swapped. The KYC vendor behind Crypto Life is not named. No trace was run. Present and disclosed, not swappable, so 1.
Opera MiniPay	1 Weak	Third parties in and around the payment flow are disclosed by category in the privacy statement. The ramp providers and the RPC provider are not named, and none of this can be checked or swapped in code because the app is closed.
Monero	2 Partial	With a local node, only the user's DNS resolver (for MoneroPulse lookups) and P2P peers see anything. With a remote or bootstrap node, that node sees the user's IP, the transactions they submit and the outputs they request. Both are named in code and can be swapped or disabled by setting. Scored 2: third parties present, named in code, swappable.
Nullmask	0 Fails	The operator's proxy sees every request, and an unnamed analytics vendor receives depositor and connected addresses. Judgment call: 0 rather than 1, because the vendor's identity is not disclosed.
Oobit Card	0 Fails	The KYC, fraud-prevention and blockchain-intelligence vendors in the payment flow are not named anywhere I found. Judgment call: disclosure by category only is closer to "undisclosed third parties" than to named ones, so 0.
Payy Card	1 Weak	Each card payment is seen by Visa, the issuer, Rain and Payy's backend. Vendors are named in code and the Terms, but nothing is swappable by user config, and no trace was run. 1.
Phantom Cash	Under review	Third parties in the card flow are named in docs and not swappable. No trace was run. 1.
Plasma One	1 Weak	Rain, Visa, Privy, Sumsub and Google see payment or identity data; they are disclosed in documents only and cannot be swapped. 1.
Privacy Pools (0xbow)	2 Partial	In the website flow, 0xbow's ASP API, Envio, Alchemy (RPC and prices), a third-party relayer and Google Analytics see requests. All are named in code; the RPC is user-configurable, the ASP and HyperSync endpoints are env-configurable, and relayers are a choice. On the SDK path only the user's RPC and an IPFS gateway are needed. Scored 2.
Railgun	2 Partial	Beyond the RPC, the SDK's default path touches a hosted Subsquid indexer and an IPFS gateway, and Railway adds price, config and POI services. All are named in code. The indexer and gateway can be replaced only in code (engine init functions, artifact store); the RPC and POI node URLs are configurable. Scored 2.
Request Network	2 Partial	Third parties see payer and payee data during a payment. They are the indexer host (The Graph Studio in the SDK, Alchemy Subgraphs in the template), the RPC provider (Base's public RPC, or Infura on other chains), Request's hosted Request Node, and WalletConnect. Each is named in code, and all except WalletConnect can be swapped through SDK options or env vars. The template's always-on GTM tag is counted under P1. The hosted API path adds Pimlico, Li.Fi, and KYT vendors, but it is optional. No trace was run.
Rizon Card	1 Weak	Rain, Privy, the issuer and an unnamed KYC partner all see user and payment data. They are disclosed in docs and cannot be swapped, so 1.
SafePal Card	1 Weak	Third parties in the card flow (Fiat24, Marqeta, Mastercard, the KYC vendor) are disclosed by category in Fiat24's policy, and none can be swapped. No trace was run. Docs only, so 1.
Solayer Card (Emerald Card / Solayer Pay)	1 Weak	The issuer, Visa and Sumsub are named in docs and are not swappable. No Solayer privacy policy was found (solayer.org/privacy returns 404). Disclosed in docs only, so 1.
Tongo (confidential ERC-20 on Starknet)	2 Partial	On the direct path only the chosen RPC sees requests. The optional relayed path adds the AVNU paymaster, which is named and set by the caller. Judgment call: 3 would need a package or trace, and the demo frontend was not inspected, so 2.
Tornado Cash (Classic pools)	2 Partial	On the minimal required path (core client plus RPC), only the RPC the user chooses sees the request. The optional UI adds The Graph (hardcoded) and default Infura and Alchemy RPCs (swappable in Settings). An optional relayer, when used, sees the recipient and the user's IP unless Tor is used. tornado-cli adds an IP-echo call. All of these are named in code. Judgment call: we score 2 because the hardcoded Graph endpoint cannot be swapped by config, although a user avoids it by not using the UI.
Tria	1 Weak	Third parties in the flow are disclosed in documents only and cannot be swapped. 1.
Tuyo Card	0 Fails	The card provider, issuer, KYC vendor and analytics vendors that see each payment are not named in any Tuyo document I found. Card Map names Rain, but that is a third-party claim. Undisclosed third parties in the flow, so 0.
Umbra Cash	2 Partial	Beyond the RPC, the app sends requests to ScopeLift's API and indexer and to Etherscan, TxPrice and POAP; the Chainalysis check is an RPC read. All are named in code. The Umbra API URL is hardcoded; the RPC and subgraph URLs come from env or SDK config. Judgment call: 2, as the hardcoded API is avoidable by using the SDK.
Wirex One	1 Weak	Privy, the issuer, the card network, Crossmint, KYC and analytics vendors all see user or payment data. They are disclosed in the Terms and privacy policy (some only by category) and cannot be swapped. Disclosed in docs only, so 1.
Wise	1 Weak	Third parties that see payment data are disclosed by category in the privacy notice, but none is named (a list is available on request to privacy@wise.com). They cannot be swapped by the user.
WORM (BETH proof-of-burn)	1 Weak	Third parties see the payment in both official clients. The frontend sends the burn address's proof request to a fixed list of public RPCs, and its send flow sends the burn key to the WORM prover. The CLI uses dRPC. All of these are named in public code, but none can be swapped by configuration. Judgment call: anchor 2 needs them to be swappable by config, which they are not; 1.
XPlace Card	0 Fails	Rain, Sumsub and Kamino are named; the infrastructure, monitoring and analytics vendors that see app traffic are not. None is swappable. Judgment call: between 1 (disclosed in docs) and 0 (undisclosed third parties) I take the lower, because some processors are named only by category.
Zcash (shielded transfers)	2 Partial	On the full-node path only the user's own node and its peers see the transaction. On the light-wallet path the chosen lightwalletd server sees the user's IP (unless Tor is on), the transactions they submit and the transactions they fetch; it is named in code and swappable. Optional features add CoinMarketCap (over Tor only), Flexa and NEAR intents. Scored 2: third parties present, named in code, swappable.
zERC20 (zBNB on BNB Chain)	1 Weak	In the app flow, the provider's indexer, Alchemy (or thirdweb) RPCs and ICP boundary nodes see payment requests, and WalletConnect relays see wallet sessions. The SDK leaves every endpoint to the integrator, but the indexer it needs is the provider's unless you build your own. Disclosed in docs; the app's choices are not swappable. Scored 1.