Unaudited, unvetted, experimental. Do not use as a reference. AI-researched ratings that may be wrong; not advice or a statement of fact about any provider. Full disclaimer
Pending review. 1150 of 1150 ratings not yet checked by a human. Do not rely on unreviewed ratings.
Incumbent rails have no public chain settlement and no public code. They are scored with the same rubric as every other row. Their low ratings show the verifiability gap between rails whose behaviour can be inspected and rails whose behaviour must be trusted; that gap is the point of the comparison, not a claim that the incumbent is unsafe.
Offered everywhere except the countries listed. Checked 2026-10-09. Not scored.
The site FAQ names 18 countries whose residents cannot be issued a card, and these are listed. The same answer says the card "is currently available in many U.S. states, Latin America, and the Caribbean" without enumerating those regions, so availability outside the Americas is not affirmed by any document; the blocklist records only what is named. In the US, residents of 16 states cannot be issued a card: Arizona, Delaware, Georgia, Idaho, Louisiana, Maryland, Nevada, New Mexico, North Dakota, Ohio, Oregon, Rhode Island, South Dakota, Vermont, Washington and Wisconsin. US residents use the separate US card agreement; under the international card agreement the holder attests they are not a US citizen. Both agreements bar persons blocked or sanctioned by the US (OFAC), and the app terms require that the user is not located in a US-embargoed or "terrorist supporting" country (not listed).
Avalanche Card site FAQ "What countries are supported?", which also lists the 16 excluded US states and says the card is available in many US states, Latin America and the Caribbean.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
Avalanche Card international card agreement (Rain Liquidity / issuer), section 1 representations; also requires the holder not be blocked or sanctioned by the US (OFAC).
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Settlement token
What the balance is held in and debited from. Shown as context; it does not change any rating.
Token
Class
Issuer
Contract
USDC
fiat-backed stablecoin
Circle
USDT
fiat-backed stablecoin
Tether
AVAX
native token
WAVAX
other token
Conversion. When the token is converted to fiat is not documented.
Fiat-backed stablecoin. An issuer holds the reserves and can freeze balances at the token contract. Value depends on the issuer redeeming at par. Censorship Resistance records whether that freeze power is disclosed.
Native token. No issuer can freeze it, but its price moves between top-up, authorisation and settlement, so the amount debited is not known in advance.
Other token. A wrapped, liquid-staking or yield token. It carries the risks of the underlying asset plus those of the wrapper or protocol; see the note.
The card is a Rain collateralised card: the user posts digital assets as collateral from a linked wallet, card charges create a USD balance owed to Rain Liquidity and the issuer, and the collateral secures that balance. The card agreement says the user repays Rain and that collateral is liquidated to cover charges on a Liquidation Event (unpaid obligations or collateral value falling below charges); it does not say whether collateral is sold at each authorisation or swept later, so conversion is recorded as unknown. The homepage lists USDC, USDT, AVAX and WAVAX (WAVAX is wrapped AVAX); the FAQ names only USDC and AVAX as collateral. No default is stated. Chains and contract addresses are not given: marketing implies Avalanche C-Chain, while the card agreement's Supported Blockchains (Ethereum, Polygon, Optimism, Arbitrum) omit Avalanche (see C5), so no chain is recorded.
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Documented
The card agreement (s3) makes the posted digital assets collateral securing USD charges, which Rain satisfies and the user repays; collateral is liquidated only to cover outstanding obligations.
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Censorship Resistance
Who can block valid use, and can users route around them?
0 FailsPillar rating: weakest of 5 0 of 5 Partial or better
What would raise this pillar
Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
There are no assessable settlement contracts. The card agreement lets the provider and issuer suspend an individual card or account with or without notice, which meets anchor 0 ("can target individual addresses with no notice").
Evidence (1)1 documented
Documented
The card agreement lets Rain Liquidity and the issuer suspend the card or account with or without notice, and deny any purchase for any reason.
Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer? C2
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Card settlement runs through Rain Liquidity, the issuer and Visa. No published contract or ABI lets a payer or payee settle directly.
Evidence (1)1 documented
Documented
The app terms say an outside oracle and Rain Liquidity set the cardholder's spending power against collateral. Merchants are paid through Visa by the issuer.
Does the payment flow require a relayer, paymaster, bundler, or API that only the provider runs? C3
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Every step of a card payment (app, collateral accounting, authorisation, issuing, settlement) runs on closed Rain-group services with no public code and no fallback.
Evidence (1)1 documented
Documented
The privacy policy assigns the app, card services and collateral functionality to Rain Liquidity LLC, and Visa card issuance and settlement to Third National. Both are Rain entities.
Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Sanctions screening is disclosed in the card agreement and privacy policy. The settlement layer cannot be inspected, so its neutrality cannot be shown. Disclosed in docs only, so 1.
Evidence (2)2 documented
Documented
The cardholder must not be blocked or sanctioned by the US Government (OFAC).
Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees? C5
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The binding card agreement lists supported blockchains that omit Avalanche, while marketing names Avalanche-native collateral (AVAX, WAVAX). No issuer freeze or sequencer assumptions are stated. Judgment call: the chain enumeration in the terms is wrong for this product, which meets "misstated" (0).
Evidence (2)1 documented · 1 claimed
Documented
The card agreement's "Supported Blockchains" are Ethereum, Polygon, Optimism and Arbitrum, plus others at the issuer's discretion. Avalanche is not listed.
Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Nothing in the Avalanche Card payment path is public. Rain's open SDKs serve other integrators and are not shown to run this product. Judgment call: 0 rather than 1, because no public SDK or contract is evidenced as part of this card.
Evidence (2)1 verified · 1 documented
Verified
Rain (Signify Holdings, GitHub SignifyHQ) publishes integrator SDKs, such as this Android SDK for Rain collateral on EVM chains and Solana. No Avalanche Card app, backend or collateral contract repository exists, and nothing ties these SDKs to the Avalanche Card app.
Do the SDK, widget, or frontend ship analytics, telemetry, error reporting, or fingerprinting? P1
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Analytics and advertising SDKs are disclosed in the policy. The app is closed and no trace was run, so their presence and default state are not confirmed. Judgment call: disclosed in policy, so 1 (the documented cap).
Evidence (1)1 documented
Documented
The privacy policy discloses SDKs, analytics tools and advertising technologies, and says third parties may process the data under their own notices.
Which third parties see a request during a payment, and can they be swapped out? P4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Rain entities, Third National, Visa and unnamed verification, analytics and oracle providers see payment data. They are disclosed in docs only and are not swappable. No trace was run, so 1.
Evidence (1)1 documented
Documented
The policy lists data sharing among Rain entities and partners for identity verification, card issuing, transaction processing, settlement and sanctions screening.
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6
? No evidence
Sets the pillar rating
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No checkable evidence settles this yet, so it counts as 0.
Security audits 1
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
Shared component: Rain EVM collateral contracts v2 (Beacon, Collateral, Coordinator, Factory), private best-efforts contest at 6f578d5b9c Logged because Rain Liquidity runs this card and its collateral. Rain v1 contracts (RainCollateralController 0x753Fb325...) are live on Avalanche but were not tied to this card, and this contest covered v2. The Rain repo is private; contest ran 2-8 December 2024 on b432939a, 6f578d5 is the fix commit.
Compiled from: avalanchecard.com and legal.avalanchecard.com (no audit mentioned), Rain's security page (audits under NDA, Sherlock named; SOC 2, PCI DSS and pentest summary only on request, not code audits), Rain's GitHub org SignifyHQ (SDKs and integration examples, no audits folder) and the Sherlock report repo (one Rain report). No audit of Rain's v1 RainCollateral contracts live on Avalanche C-Chain, or of the card app, is published. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.
Operational and procurement
Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.
Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 12 evidenced, 3 attested, 0 absent, 0 not applicable, 30 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.
Group A: operational facts
Fees
Evidenced
Component
Paid by
Amount
Basis
card
none
Monthly account fee, virtual card, physical card and shipping: $0
Site FAQ; card agreements allow fees to change.
fx
payer
1% FX fee (site FAQ)
Site FAQ. The same FAQ also says no conversion fees are charged; contradiction recorded in note.
fx
payer
International card: FX fee up to 3% plus cross-border fee up to 3% (non-USD)
International card agreement Important Disclosures, effective 12 February 2025.
fx
payer
US card: international transaction fee 2% of each transaction
US card agreement account opening disclosures (last updated 5 February 2025).
card
payer
International: late payment up to $40, returned payment up to $29; US: late payment up to 2% of the outstanding balance
Card agreements, penalty fees; balances are settled from collateral and can trigger liquidation.
network
payer
Network gas may be paid by the user; Avalanche Card charges no gas fee itself
Site FAQ footnote.
The site FAQ (1% FX) and the agreements (up to 3% + 3% international; 2% US) disagree; the agreements are maxima and binding, the FAQ states current charges. The FAQ's "no conversion fees" line contradicts its own 1% FX line. No ATM fee is listed because no ATM access is documented (see cashout).
Documented
Avalanche Card site FAQ "Are there any fees when using my card?"; the "What is the Avalanche Card" answer says no gas or conversion fees are charged by Avalanche Card.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
International card agreement (Rain Liquidity / Third National), Important Disclosures; penalty fees late payment up to $40, returned payment up to $29.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
US card agreement account opening disclosures: no annual fee, cash advance none, international transaction 2%, late payment up to 2% of the outstanding balance.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Custody model
Unknown
CROPS S1 is unknown for this provider: no collateral contract can be tied to the card. The card agreement says Rain Liquidity and the issuer never hold custody of collateral, but they can liquidate it; the site says assets are owned and custodied by the user. These claims are unverified, so no custody model is recorded.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Licensed lender and money transmitter; Visa-authorized card issuer (as stated by Rain) Card issuance, payment and settlement for the Avalanche Card (issuer named in both card agreements).
Attested only: Rain describes Third National as Nimbus LLC, a licensed lender and money transmitter, but no register entry was found. FDIC BankFind lists no institution named Third National or Nimbus, so it is not an FDIC-insured bank; the card agreements are governed by Puerto Rico law, but the OCIF licence check could not be reached; NMLS Consumer Access blocked scripted access. The site footer says only that the card is "issued by partners licensed in their respective jurisdictions". Rain Liquidity LLC states it is not a bank; no licence is claimed for it.
Documented
Avalanche Card privacy policy (the consolidated Rain policy, last updated 16 July 2026), Entity Roles and Data Flows; the change log adds "licensed money transmission" to Third National's scope on 11 July 2026. No regulator, state or licence number is given.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
FDIC BankFind institutions API, run 2026-10-09: the closest matches for "Third National" are other banks (Fifth Third Bank, N.A. and inactive banks); a search for NAME:Nimbus with ACTIVE:1 returns 0 institutions. NMLS Consumer Access returned HTTP 403 to a scripted request and was not bypassed; the Puerto Rico OCIF licence check (concesionarios.ocif.pr.gov) failed the TLS handshake.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Cash-out options
Evidenced
Where
Method
Partner
Fee
Limits
everywhere offered
card spend
Third National (Nimbus LLC, Rain affiliate) as issuer, Rain Liquidity, Visa
1% FX per site FAQ; agreements allow up to 3% + 3% (international) or 2% (US) on non-USD
Spending power set by Rain Liquidity against collateral (USDC, USDT, AVAX, WAVAX per site); limits can be changed at any time.
No ATM row: the international agreement excludes cash advances, and the US agreement allows ATM cash only "if enabled", with no ATM fee in its disclosures and no statement that it is enabled. No bank off-ramp is documented on avalanchecard.com or in the legal hub; the wallet holds crypto that can be withdrawn onchain, which is not a cash-out.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Operating entity
Evidenced
Rain Liquidity LLC, US
State of formation is not stated in any document and no company register entry was found (Montana and Delaware business searches are interactive web apps), so only the country is recorded and there is no register_url. Rain Liquidity LLC is a subsidiary or affiliate of Signify Holdings, Inc. (Rain) per the privacy policy.
Documented
Avalanche App Terms & Conditions; governing law Montana; card services mailing address in Billings, Montana (US card agreement).
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Security incidents
Evidenced
2026-09-28: Rain platform: unexpected card declines and API issues for some partners, 18:53 to 19:35 UTC; root cause still under investigation. Rain-wide; which programmes were affected is not stated. funds lost: unknownsource
2026-06-25: Rain platform: elevated API error rates for 3h32m, caused by an expired encryption certificate. funds lost: unknownsource
2026-06-03: Rain platform: partial outage affecting card authorizations for 9 minutes, attributed to operating-system patching at a partner. funds lost: unknownsource
2026-05-05: Rain platform: elevated card declines for 3h10m from a partial outage at its payment processor. funds lost: unknownsource
2026-01-02: Rain platform: elevated card declines for 1h15m from an incident in the processor rules engine; Rain stated funds were safe. funds lost: nosource
Absence of a found incident is not evidence that none occurred.
No Avalanche Card-specific incident report was found on avalanchecard.com or its legal hub. The entries are Rain platform incidents from Rain's status page (Rain Liquidity, the operator, is a Rain entity); the pages do not say which card programmes were affected. Planned maintenance and earlier incidents (Google Cloud outages 2025-06-12 and 2025-10-20, webhook latency) are not listed.
2026-07-11: Privacy policy revised: biometric retention cut from 5 to 3 years; licensed money transmission added to Third National's scope; EU representative identified. source
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Volume transacted (verified only)
Not verifiable
Incumbent: the provider file lists no contracts, so there is nothing a volume spec could be computed over; card settlement runs offchain through the issuer and Visa.
UnreviewedAssessed by AI research agent (operational), 2026-10-09
Group B: institutional due diligence
Control
State
What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?
Unknown
No ISO 27001 statement found. Rain's security page lists SOC 2 Type II and PCI DSS only; avalanchecard.com has no security page. Rain Liquidity LLC, which offers the card and runs the app, is itself a Rain entity (Avalanche Card privacy policy), so Rain's security page is the operator's own position.
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?
Unknown
No ISO 27001 statement for the hosting or support organisation. Rain's status page attributes two outages (2025-06-12, 2025-10-20) to Google Cloud, which suggests but does not establish the host.
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?
Attested
Rain (Signify Holdings, Inc. and affiliates, including Rain Liquidity LLC) states it holds SOC 2 Type II and PCI DSS; the SOC 2 report is available to partners and prospective partners on request through its trust center. A cardholder cannot obtain it; not read. source 1 · source 2
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?
Attested
Rain states its smart contracts are reviewed by independent auditors before launch and for each new chain; no report is linked, and the Avalanche Card collateral contract is not identified (CROPS S6 unknown). No statement covers the app or backend. source 1
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?
Attested
Rain says a penetration test summary is available to partners through its trust center; no date or tester is stated. source 1
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?
Evidenced
Code is peer-reviewed and automatically scanned before production; the privacy policy mentions internal security testing and regular security assessments. No cadence or tool for platform scanning is stated. source 1
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?
Unknown implied from the component list
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?
Unknown
No patch timelines found in the Rain security page, the Avalanche Card legal hub or the privacy policy.
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?
Unknown implied from the component list
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?
Evidenced
Rain states a documented incident response plan that includes keeping partners informed; no notification time is committed, and nothing addresses cardholders directly beyond the GLBA notice. source 1
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?
Unknown
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?
Unknown
Rain mentions an incident response plan (B3.1) but no recovery or continuity plan was found.
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?
Evidenced
Rain runs a public status page (status.rain.xyz) with component status and incident history covering card authorizations and collateral; incident notes state a one-line cause at most and no post-mortem was found. source 1 · source 2
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?
Unknown
The site describes wallet-based authentication with iCloud backup or PIN-based recovery; no multi-factor login for cardholders is described.
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?
Unknown
Rain states signing keys are held in managed key storage with tightly controlled access; nothing on MFA or separate accounts for privileged staff.
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?
Unknown
Access reviews may be covered by Rain's SOC 2 Type II report, available to partners only (B1.3); not read.
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?
Unknown
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?
Unknown
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?
Unknown
No cardholder-facing API. Rain's API documentation (docs.rain.xyz) redirects to a login page.
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?
Unknown
Rain's status page lists API keys under its Core API; the API reference is behind a login.
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?
Unknown
B5.4 Export controls If an API exports data, does it limit volumes and log exports?
Unknown
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?
Evidenced
Encryption of sensitive data in transit and at rest, access controls, MFA and tokenization of card data, with PCI DSS for card data (privacy policy, "may include"). Observed: avalanchecard.com refuses TLS 1.1 and accepts TLS 1.2. No data classification stated. source 1 · source 2
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?
Unknown
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?
Evidenced
Kept as long as necessary; customer identification and transaction records five years or longer after account closure where law requires; biometric data destroyed within three years of last interaction where biometric law applies; blockchain data cannot be deleted. See CROPS P2 for what is collected. source 1 CROPS P2
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?
Evidenced
Rain Liquidity LLC is controller for Avalanche Card services; Nimbus LLC (Third National) is controller for card issuance; Rain entities may act as independent or joint controllers or processors between themselves. No DPIA statement; an EU data protection contact is named. source 1 · source 2
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?
Unknown
No published data processing agreement; Rain's trust center (partner access) may hold one.
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?
Unknown
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?
Evidenced
Rain states security events are monitored centrally and onchain activity is monitored in real time by an in-house team; no SIEM product or endpoint detection is named. source 1
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?
Unknown
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?
Unknown implied from the component list
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?
Unknown implied from the component list
B9.2 CI runs on pull requests Does every pull request trigger automated checks?
Unknown implied from the component list
B9.3 Tests run in CI Do the CI workflows run the test suite?
Unknown implied from the component list
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?
Unknown implied from the component list
B9.5 Versioned releases Are releases tagged with immutable semantic versions?
Unknown implied from the component list
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?
Unknown implied from the component list
B9.7 Changelog Is a changelog maintained with the code?
Unknown implied from the component list
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?
Unknown implied from the component list
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?
Unknown
No architecture document. The app terms and card agreements describe the collateral, oracle and liquidation flow in prose only; Rain's developer docs are behind a login.
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?
Evidenced
Rain Liquidity LLC (app and services; Montana governing law; mailing address in Billings, Montana) and, for the card, the issuer Third National (Nimbus LLC, a Rain affiliate) under Puerto Rico law. The card agreements are three-party between the cardholder, Rain Liquidity and the issuer. source 1 · source 2
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?
Evidenced
Only fee revenue is documented (FX fee on non-USD spend; penalty fees in the agreements). No statement of how Rain Liquidity or the Avalanche Card programme is funded and no financial statements were found. source 1
B11.3 Termination terms What happens to customer funds and data on termination by either side?
Evidenced
Rain Liquidity and the issuer may suspend, revoke or cancel the card or deny any transaction at any time, with or without cause or notice; Rain Liquidity may terminate app access or delete the account without warning. The app terms say a suspended user can still export the wallet or withdraw via a block explorer; collateral can be liquidated for unpaid charges. Records are kept five years or longer after closure (B6.3). source 1 · source 2
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?
Evidenced
Yes: Rain uses automated systems for fraud detection, sanctions screening, transaction monitoring, identity verification, biometric matching, eligibility and risk management. Whether these include machine learning is not stated. source 1
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?
Evidenced
Only an override path: where law grants it, users may request information, human review and contest a decision. Rain's AI and Data Use Exhibit sets standards for vendors' AI use, not for Rain's own systems. No monitoring, validation, decommissioning or bias documentation found. source 1
Scope of assessment
Components in the payment path
Component
Role
Public
Licence
Operator
Required
Avalanche Card app (mobile)
frontend
No
proprietary
Rain Liquidity LLC
Yes
Rain card platform, collateral and authorisation backend
backend
No
proprietary
Rain (Signify Holdings, Inc.)
Yes
Collateral contract (chain and address not disclosed)
contracts
No
proprietary
Rain Liquidity / Issuer
Yes
Third-party non-custodial smart wallet (provider not named)
wallet
No
proprietary
Not disclosed
Yes
Price oracle for collateral value (not named)
oracle
No
proprietary
Not disclosed
Yes
Third National (card issuer; Nimbus LLC, a Rain affiliate)
card-issuer
No
proprietary
Nimbus LLC d/b/a Third National
Yes
Visa (card network)
card-network
No
proprietary
Visa
Yes
Identity verification and sanctions screening (vendor not named)
kyc
No
proprietary
Rain
Yes
Repositories
None found. Absence of public code is itself a finding.
Contracts
None listed.
Assessor notes
Classified as incumbent: I found no verified contract or public repository shown to be needed to run this card. Searched: avalanchecard.com and legal.avalanchecard.com (terms, card agreements, privacy policy); GitHub for Rain orgs, where SignifyHQ (Signify Holdings, i.e. Rain) publishes integrator SDKs and a collateral-examples repo; GitHub code search for RainCollateral; Avalanche C-Chain via cast and Routescan. Rain's v1 RainCollateralController 0x753Fb325... and RainCollateral 0xD71Fd741... are live on Avalanche and verified on Routescan. Their controllerAdmin can liquidate any collateral, and user withdrawals need a Rain signature. But 1000 recent Withdrawal events show only USDe, USDC and USDT, with no AVAX or WAVAX, and the card agreement does not list Avalanche as a supported chain, so I could not tie them to this card. Re-assess as type card if Rain discloses the card's collateral contract.
