Privacy · P5
Configurable endpoints and self-hostable data layer
Can RPC and indexer URLs be changed, and is the indexer code public?
Why it matters
A hardcoded endpoint is both a privacy leak and a censorship point. Configurable endpoints plus public indexer code let an institution keep payment data inside its own perimeter.
Scoring anchors
| RPC and indexer URLs configurable in the UI or SDK, and indexer code public. | |
| Configurable via code or env only. | |
| Documented workaround. | |
| Hardcoded. | |
| No admissible evidence submitted yet. Counts as 0 in the pillar. |
Admissible evidence
- Config surface at a pinned commit verified
Common failures
- RPC configurable but indexer hardcoded.
Current ratings
| Provider | Score | Finding |
|---|---|---|
| Aleo (credits.aleo private transfers) | The RPC and data endpoint is configurable in the SDK and CLI, and the node that provides it is public. Scored 3. | |
| AnomaPay | The SDK docs show endpoint URLs passed as constructor arguments, but the clients are not in the public SDK source at our commit, the web app is closed, and the indexer cannot be self-hosted. Scored 1. | |
| Avalanche Card | No admissible evidence yet. | |
| Avici Card | No admissible evidence yet. | |
| Aztec (Alpha mainnet private token transfers) | The data endpoint is configurable in the client, and the node that serves it is public. Scored 3. | |
| Bitget Wallet Card | No admissible evidence yet. | |
| Blanksquare (Shielder) | Endpoints are configurable in SDK code; the public UI fixes them at build time and offers no setting. No indexer is needed. Scored 2. | |
| COCA Card | No admissible evidence yet. | |
| Coinbase Commerce (Onchain Payment Protocol) | The SDK's endpoints can be changed in code, but not in a UI. The charge methods only work against Coinbase, and no indexer code is public, so payment data cannot stay inside the integrator's own perimeter. The hosted checkout has no endpoint setting at all. | |
| Curvy | Endpoints, including the indexer, can be configured in code. The indexer code is not public, so the 3 anchor's public-indexer condition fails. Scored 2. | |
| Daimo Pay | An integrator can change the API and hosted-flow endpoints in code, so traffic can go through the integrator's own proxy. The UI offers no endpoint setting. The indexer and API code are not public, so the integrator can reroute data but cannot keep it inside their own perimeter. | |
| Deblock Card | No admissible evidence yet. | |
| Ethena Pay | No admissible evidence yet. | |
| ether.fi Cash | No admissible evidence yet. | |
| Exa Card | The RPC endpoint is fixed to Alchemy; only the key can be overridden at build time. The indexer (substreams) is public, but users cannot point the app at their own endpoints. Judgment call: changing the key is not changing the endpoint, so this is "hardcoded" (0). | |
| Fluidkey | The app is closed, so we could not check whether RPC or indexer endpoints are configurable. The SARA recovery UI accepts a custom RPC URL, but it is not the payment path. | |
| Fuse Card | No admissible evidence yet. | |
| Gnosis Pay | The RPC and API endpoints are configurable through build-time env only, not in the UI. Onchain history uses the configured RPC directly. The card-transaction indexer is closed, so 2. | |
| HesabPay | No admissible evidence yet. | |
| Hinkal | The RPC comes from the user's wallet provider. Hinkal's snapshot, indexer and data endpoints are hardcoded per build, with no config option, and the indexer code is not public. Scored 0, matching the common failure where the RPC is configurable but the indexer is hardcoded. | |
| Holyheld Card | RPC follows the integrator's wallet client, but the Holyheld API, which serves balances, quotes and configuration, is hardcoded and its code is closed. Hardcoded, so 0. | |
| Houdini Swap | No admissible evidence yet. | |
| Hyperbeat Card | No admissible evidence yet. | |
| Jupiter Card | No admissible evidence yet. | |
| M-Pesa | No admissible evidence yet. | |
| MetaMask Card | The card module's RPC endpoints are hardcoded constants. Card data comes from Baanx's closed API, which is fixed at build time and has no public indexer. A user cannot point the card at their own endpoints. | |
| Opera MiniPay | No admissible evidence yet. | |
| Monero | The node endpoint, which is both RPC and indexer for a Monero wallet, is configurable in the GUI and CLI, and the node code is public. | |
| Nullmask | No admissible evidence yet. | |
| Oobit Card | No admissible evidence yet. | |
| Payy Card | No admissible evidence yet. | |
| Phantom Cash | No admissible evidence yet. | |
| Plasma One | No admissible evidence yet. | |
| Privacy Pools (0xbow) | The RPC is configurable in the UI and SDK. The indexer (ASP API) is configurable only via env, and its code is not public. Scored 2. | |
| Railgun | RPC is configurable in the UI and SDK; the indexer is configurable only in code, though its code is public and the engine can fall back to RPC scanning. Scored 2. | |
| Request Network | RPC, indexer, and Request Node URLs can all be set through SDK options, and the code for the indexer and the node is public. An integrator can keep payment detection and request storage inside their own infrastructure. The reference template exposes these settings only as env vars, and no UI offers them. | |
| Rizon Card | No admissible evidence yet. | |
| SafePal Card | No admissible evidence yet. | |
| Solayer Card (Emerald Card / Solayer Pay) | No admissible evidence yet. | |
| Tongo (confidential ERC-20 on Starknet) | The RPC is configurable in the SDK, and there is no indexer to host. The only official UI (the demo) is closed, so we could not check whether a UI setting exists. Scored 2: configurable via code. | |
| Tornado Cash (Classic pools) | The RPC can be set in the UI, and with --rpc in the CLI. The indexer URL can be changed only in code, though the UI falls back to RPC reads. Scored 2: the indexer is configurable via code only. | |
| Tria | No admissible evidence yet. | |
| Tuyo Card | No admissible evidence yet. | |
| Umbra Cash | RPC and indexer are configurable in the SDK, and the subgraph code is public. Judgment call: the production indexer is a Ponder deployment whose code we did not find, and the app has no UI setting, so 2. | |
| Wirex One | Endpoints are hardcoded in the app and the indexer is closed. Hardcoded, so 0. | |
| Wise | No admissible evidence yet. | |
| WORM (BETH proof-of-burn) | Both official clients hardcode their RPC endpoints: the CLI uses dRPC, and the frontend uses a fixed list. No indexer is involved. Scored 0: hardcoded. | |
| XPlace Card | No admissible evidence yet. | |
| Zcash (shielded transfers) | The wallet's data endpoint (lightwalletd, which is both RPC and indexer for a light client) is configurable in the UI, and both server implementations are public. Full-node users set their own node. | |
| zERC20 (zBNB on BNB Chain) | In the SDK, endpoints are configurable in code. The app hardcodes them. The indexer code is not officially public. Judgment call: the SDK would support 2, but the evidence is a compiled npm package (documented tier), so 1. |