Unaudited, unvetted, experimental. Do not use as a reference. AI-researched ratings that may be wrong; not advice or a statement of fact about any provider. Full disclaimer
Pending review. 1150 of 1150 ratings not yet checked by a human. Do not rely on unreviewed ratings.
Incumbent rails have no public chain settlement and no public code. They are scored with the same rubric as every other row. Their low ratings show the verifiability gap between rails whose behaviour can be inspected and rails whose behaviour must be trusted; that gap is the point of the comparison, not a claim that the incumbent is unsafe.
Offered only in the countries listed. Checked 2026-10-09. Not scored.
From the "Available Regions" tab of Avici's card regions page (50 entries, 49 codes). The list has both "Dominica Republica" and "Dominicana"; both names point to the Dominican Republic, so only DO is listed and Dominica (DM) is not, the more restrictive reading. US: only 31 states are supported for personal cards (AL, AK, AR, CA, CO, CT, FL, HI, IL, IN, IA, KS, KY, ME, MA, MI, MN, MT, NE, NH, NJ, NY, NC, OK, PA, SC, TX, UT, VA, WV, WY). The Avici Spend Card terms on avici.money require the holder to attest they are not a US citizen; US cardholders are on separate US card terms. The page also names 17 countries whose residents are prohibited (BY, CN, CU, IN, IR, IQ, IL, MM, NP, NI, KP, RU, SY, TR, UA, VE, VN, none of which are in the allowlist), says the card cannot be used to spend in CU, IR, KP, RU, SY, UA or VE, and says unlisted jurisdictions may still be restricted. The page also says the Avici self-custody smart wallet is available without restriction; this block covers the card only.
Avici docs "Regions and Prohibitions for Avici Card" (GitBook Markdown copy listed in docs.avici.money/llms.txt), with tabs for Available Regions, Prohibited Regions and Supported US States.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Settlement token
What the balance is held in and debited from. Shown as context; it does not change any rating.
Token
Class
Issuer
Contract
USDCDefault
fiat-backed stablecoin
Circle
Conversion. The token is sold for fiat when a payment is authorised.
Fiat-backed stablecoin. An issuer holds the reserves and can freeze balances at the token contract. Value depends on the issuer redeeming at par. Censorship Resistance records whether that freeze power is disclosed.
The user deposits USDC into a Loan Escrow contract, which creates a USD credit balance on the card; each purchase reduces that balance, and Avici liquidates the spent USDC from the contract every one to two days (sometimes weekly) to settle with Visa. Conversion is therefore of the spent amount after authorisation, in batches, rather than one sale per swipe. The docs say the contract is on an EVM chain and accepts deposits from Solana but name neither the chain nor the contract address, so no chain or address is recorded.
Checked 2026-10-12
Evidence (2)2 documented
Documented
The docs say users deposit USDC into a Loan Escrow contract that backs a USD credit balance on the card.
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Censorship Resistance
Who can block valid use, and can users route around them?
0 FailsPillar rating: weakest of 5 0 of 5 Partial or better
What would raise this pillar
Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No settlement contract could be assessed. The terms let Avici and the issuer block an individual's card and account at their discretion, with no notice period. That meets anchor 0.
Evidence (2)2 documented
Documented
Avici's terms let it decline, restrict, suspend or pause any account or service at its discretion, which can stop card spending.
Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer? C2
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
By Avici's own description, settlement needs Avici's spend attestation and its periodic liquidation, plus the issuer and Visa. No contract or ABI is published for a direct path. The provider's admission holds this at 0.
Evidence (2)1 documented · 1 claimed
Documented
The card program is issued by Third National under licence from Visa.
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Claimed
Avici's docs say spends are charged against the escrow using its own "spend attestation", and that Avici periodically liquidates the spent USDC to settle with Visa.
Does the payment flow require a relayer, paymaster, bundler, or API that only the provider runs? C3
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The card flow depends on Avici's closed backend (escrow creation, spending-power API, attestations, liquidation), Sumsub, Third National and Visa. None of these is public or has a fallback.
Evidence (1)1 documented
Documented
Avici's terms describe cards issued via Third National, ZeroDev wallet infrastructure, and onramps through Moonpay and Bridge.
Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Screening is disclosed in the terms but runs in closed services. The settlement contract is undisclosed, so its neutrality cannot be shown. Docs only, so 1.
Evidence (1)1 documented
Documented
Card access requires KYC with sanctions, watchlist and fraud screening.
Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees? C5
0 Fails
Sets the pillar ratingBest evidence: ClaimedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The token (USDC) is named, but the chain holding card collateral is not, and no freeze or sequencer assumptions are stated. Judgment call: without a chain, the dependencies are not enumerated, so 0.
Evidence (1)1 claimed
Claimed
The FAQ says only that the loan contract "is on EVM" and accepts deposits bridged from Solana. It names no chain or contract.
Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Nothing in the card payment path is public. Absence is the finding.
Evidence (1)1 verified
Verified
Avici-Labs has four public repos (v-mcp, redirectAvici, octane, meme50). None is the card, escrow contract, app or backend; octane is a 2024 Solana gasless relayer.
Does every repository needed to run the product carry an OSI-approved license? F1
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Required components are closed, so F1 is 0.
Evidence (1)1 documented
Documented
The required components (Avici backend, escrow contract, ZeroDev wallet stack, Sumsub, Third National, Visa) are third-party or provider services with no published source.
Do the SDK, widget, or frontend ship analytics, telemetry, error reporting, or fingerprinting? P1
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Analytics and error reporting are disclosed in the policy. The app is closed and no trace was run, so presence and default state are unconfirmed. Documented cap, so 1.
Evidence (1)1 documented
Documented
The privacy policy lists analytics and error reporting among the third parties it shares personal information with.
Does the flow collect anything beyond addresses, amounts, token, and chain? P2
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Full KYC, including biometrics, is required for the card and disclosed in policy only. The wallet alone needs none. Collection goes beyond settlement needs. Disclosed in policy, so 1.
Evidence (1)1 documented
Documented
For cards, the verification provider collects ID documents, personal details, address, tax identifiers, a selfie and liveness check, and biometric facial data.
Which third parties see a request during a payment, and can they be swapped out? P4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Third parties are disclosed by category, and some by name in docs (Sumsub, Third National, Visa, ZeroDev, Relay, Moonpay, Bridge). None can be swapped. No trace was run, so 1.
Evidence (1)1 documented
Documented
The policy lists sharing with identity verification, card issuing and payment networks, onramps, wallet infrastructure, hosting, analytics and AI model providers.
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6
? No evidence
Sets the pillar rating
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No checkable evidence settles this yet, so it counts as 0.
Security audits 4
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
Shared component: Rain EVM collateral contracts v2 (Beacon, Collateral, Coordinator, Factory), private best-efforts contest at 6f578d5b9c Logged because the card is issued by Third National (a Rain affiliate) under Rain-template card terms with an EVM collateral contract. Avici does not name Rain or say whether its Loan Escrow is Rain's collateral contract, so this may not apply. The Rain repo is private; contest ran 2-8 December 2024.
Shared component: ZeroDev Kernel v3.0-to-3.x changes (incremental, the v3.1 release) plus WebAuthn, MultiChain WebAuthn and Weighted validators and the SpendingLimit hook Audit period 27 May-9 June 2024; reviews only the diff from v3.0. Avici's docs say its EVM wallet is built on ZeroDev but give no wallet address or Kernel version.
Shared component: ZeroDev Kernel v3 KernelFactory and FactoryStaker at 85617952ec The file is named kalos_v3_plugins but its scope is the factory contracts.
Shared component: ZeroDev Kernel v3.0 (ERC-7579 smart account) core and validation modules at 8646f2c25f Audit started 11 March 2024 on kernel_v3 commits 5f086737 and 8646f2c2.
Unknown
2 high, 2 medium, 3 low, 5 informational
Compiled from: avici.money (terms, card terms, privacy) and docs.avici.money (all pages; no audit mentioned), the Avici-Labs GitHub org (no card or escrow code), ZeroDev's audits page and the audits/ folder of github.com/zerodevapp/kernel, Rain's security page and the Sherlock report repo. No audit of Avici's Loan Escrow contract, app or relayer is published. Logged are the Kernel v3 reports; the older Kernel v1/v2, recovery and WebAuthn plugin reports by KALOS in the same folder are not, since Avici does not publish which Kernel version its wallets run. Sumsub, Third National and Visa publish no code audits. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.
Operational and procurement
Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.
Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 15 evidenced, 2 attested, 0 absent, 0 not applicable, 28 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.
Group A: operational facts
Fees
Evidenced
Component
Paid by
Amount
Basis
card
payer
Virtual Platinum $15 first card, $10 each further card; virtual Signature $30 first year then $20/year
Docs Fees and Limits; card orders paid in-app.
card
payer
Physical Platinum $50 one-time; physical Signature $75 plus $20/year from year two
Docs Fees and Limits; priority delivery adds $50 international or $15 US.
fx
payer
FX up to 3% (currently 1%, by Visa); cross-border up to 3% (currently 0%); no Avici markup
Avici Spend Card Terms Important Disclosures (maxima); the docs say Visa may charge 0.4-1% on non-USD.
Dispute fee $35, non-refundable, disputes only above $30
Docs card FAQ.
card
payer
Late payment up to $40, returned payment up to $29 (card terms maxima)
Avici Spend Card Terms Important Disclosures; the docs FAQ says there are no late penalties because spends auto-deduct.
cashout
payer
Virtual account payout: ACH $0, wire $15, SEPA EUR 0, SWIFT $25; minimum transfer $2
Docs Virtual Accounts Fees and Limits.
Gas for card top-ups is covered by Avici's relayer per the docs (CROPS components) and is not listed as a user fee. Swap and bridging fees for auto-top-up through Relay are not stated.
Documented
Avici docs, Secured Credit Cards, Fees and Limits (card purchase fees, transaction and forex fees, ATM table).
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
Avici Spend Card Terms (last updated 20 June 2025), Important Disclosures effective 5 December 2024: maxima, cross-border up to 3% currently 0%, late payment up to $40, returned payment up to $29.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Custody model
Unknown
CROPS S1 is unknown: the loan-escrow contract's chain and address are not disclosed. The docs claim the escrow is self-custodial and only the user's wallet can withdraw, while Avici can charge it via spend attestations and liquidate spent USDC; the card terms say Avici and the issuer never hold custody. Unverified, so no custody model is recorded.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Licences and registrations
Attested
Entity
Country
Regulator
Licence
Register
Third National (Nimbus LLC d/b/a Third National, per Rain) partner
Licensed lender and money transmitter; Visa-authorized card issuer (as stated by Rain) Card issuance and BIN sponsorship for the Avici card.
Attested only, and only by Rain: Avici's documents name Third National as issuer without any licence, and say nothing of Rain. FDIC BankFind lists no institution named Third National or Nimbus; the card terms are governed by Puerto Rico law, but the OCIF licence check could not be reached; NMLS Consumer Access blocked scripted access. Ramp partners Moonpay and Bridge (named in the Terms) were not checked against registers. Avici Inc claims no licence.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
Rain privacy policy, Entity Roles and Data Flows: describes Nimbus LLC, doing business as Third National, without naming a regulator, state or licence number.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
FDIC BankFind institutions API, run 2026-10-09: the closest matches for "Third National" are other banks (Fifth Third Bank, N.A. and inactive banks); a search for NAME:Nimbus with ACTIVE:1 returns 0 institutions. NMLS Consumer Access returned HTTP 403 to a scripted request and was not bypassed; the Puerto Rico OCIF licence check (concesionarios.ocif.pr.gov) failed the TLS handshake.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Cash-out options
Evidenced
Where
Method
Partner
Fee
Limits
everywhere offered
card spend
Third National (issuer), Visa
No Avici FX markup; Visa 0.4-1% on non-USD
Spend up to the USDC in the card escrow; no transaction limits unless set by the user.
everywhere offered
atm
Third National (issuer), Visa
Platinum $1 + 0.65%; Signature $0
$1,000 per transaction, $3,000 and 3 withdrawals per day; virtual cards at NFC ATMs.
everywhere offered
bank transfer
Virtual USD/EUR accounts (banking partners; Terms name Moonpay and Bridge for off-ramp)
ACH $0, wire $15, SEPA EUR 0, SWIFT $25
Annual limit 27,000 USD/EUR at tier 1, unlimited at tier 2 with source-of-funds proof; country risk table applies.
Bank payout is from the Avici wallet through a virtual account, not from the card escrow. The virtual-account country table prohibits some countries that are on the card allowlist (for example Bangladesh and Barbados) and limits others to SEPA or ACH; per-country rows were not split out, so ALL overstates bank payout availability in those countries. Which partner runs the virtual accounts is not named in the docs.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Security incidents
Evidenced
2026-09-28: Rain platform: unexpected card declines and API issues for some partners, 18:53 to 19:35 UTC; root cause still under investigation. Rain-wide; which programmes were affected is not stated. funds lost: unknownsource
2026-06-25: Rain platform: elevated API error rates for 3h32m, caused by an expired encryption certificate. funds lost: unknownsource
2026-06-03: Rain platform: partial outage affecting card authorizations for 9 minutes, attributed to operating-system patching at a partner. funds lost: unknownsource
2026-05-05: Rain platform: elevated card declines for 3h10m from a partial outage at its payment processor. funds lost: unknownsource
2026-01-02: Rain platform: elevated card declines for 1h15m from an incident in the processor rules engine; Rain stated funds were safe. funds lost: nosource
Absence of a found incident is not evidence that none occurred.
No Avici incident report found on avici.money, docs.avici.money or its legal pages. The entries are Rain platform incidents from status.rain.xyz, included because the issuer Third National is a Rain affiliate; Avici does not name Rain, and the pages do not say which programmes were affected.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Volume transacted (verified only)
Not verifiable
Incumbent: the provider file lists no contracts, so there is nothing a volume spec could be computed over; card settlement runs offchain through the issuer and Visa.
UnreviewedAssessed by AI research agent (operational), 2026-10-09
Group B: institutional due diligence
Control
State
What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?
Unknown
No security page, trust centre or ISO 27001 statement on avici.money (pages: home, tos, tosavicicard, privacypolicy) or docs.avici.money. Rain lists SOC 2 Type II and PCI DSS, not ISO 27001.
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?
Unknown
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?
Attested
Avici states nothing. Issuer group (Rain): SOC 2 Type II and PCI DSS, reports available to partners on request through its trust center; not read. Avici's documents name only the issuer, Third National; Rain's privacy policy identifies Third National as Nimbus LLC, a Rain affiliate, and Rain's security page covers "every card program", so Rain's statements are recorded as the issuer group's position (inferred link; Avici does not name Rain). source 1 · source 2
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?
Unknown
No audit report for the card loan-escrow contract, whose chain and address are not disclosed (CROPS S6 unknown). Rain says its own contracts are audited, but the escrow is described as created by Avici and is not shown to be Rain's.
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?
Attested
Avici states nothing. Issuer group (Rain): a penetration test summary is available to partners through its trust center; it covers Rain, not the Avici app or backend. Avici's documents name only the issuer, Third National; Rain's privacy policy identifies Third National as Nimbus LLC, a Rain affiliate, and Rain's security page covers "every card program", so Rain's statements are recorded as the issuer group's position (inferred link; Avici does not name Rain). source 1
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?
Evidenced
Avici states nothing. Issuer group (Rain): code is peer-reviewed and automatically scanned before production; no cadence stated. Avici's documents name only the issuer, Third National; Rain's privacy policy identifies Third National as Nimbus LLC, a Rain affiliate, and Rain's security page covers "every card program", so Rain's statements are recorded as the issuer group's position (inferred link; Avici does not name Rain). source 1
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?
Unknown implied from the component list
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?
Unknown
No patch timelines from Avici or Rain.
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?
Unknown implied from the component list
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?
Evidenced
Avici makes no incident-notification commitment in its terms or privacy policy. Issuer group (Rain): a documented incident response plan that keeps partners informed; no time stated. Avici's documents name only the issuer, Third National; Rain's privacy policy identifies Third National as Nimbus LLC, a Rain affiliate, and Rain's security page covers "every card program", so Rain's statements are recorded as the issuer group's position (inferred link; Avici does not name Rain). source 1
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?
Unknown
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?
Unknown
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?
Evidenced
Avici publishes no status page. Issuer group (Rain): status.rain.xyz with incident history; no post-mortems found. Avici's documents name only the issuer, Third National; Rain's privacy policy identifies Third National as Nimbus LLC, a Rain affiliate, and Rain's security page covers "every card program", so Rain's statements are recorded as the issuer group's position (inferred link; Avici does not name Rain). source 1 · source 2
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?
Evidenced
Wallet withdrawals require a biometric passkey; MCP sign-in uses email and a one-time code. No separate second factor for app login is described. source 1
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?
Unknown
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?
Unknown
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?
Unknown
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?
Unknown
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?
Evidenced
Avici's read-only MCP connector authenticates through a browser-based OAuth flow with email and a one-time code; the CLI signs in by QR approval in the mobile app and stores a session locally. No payment API is offered to customers. source 1
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?
Unknown
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?
Unknown
The CLI and MCP FAQ says logins expire and must be renewed, without stating a period.
B5.4 Export controls If an API exports data, does it limit volumes and log exports?
Unknown
The CLI and MCP are read-only (balances, card details, transactions); no export limits or export logging are described.
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?
Evidenced
Avici: administrative, technical and physical safeguards, limited access, connected-service tokens stored encrypted; no data classification or encryption-at-rest statement for other data. Issuer group (Rain): encryption in transit and at rest, PCI DSS for card data. Observed: avici.money refuses TLS 1.1 and accepts TLS 1.2. source 1 · source 2 · source 3
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?
Unknown
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?
Evidenced
KYC and AML records held by the verification provider for the relationship plus the legal period, typically five years; transaction and card records as financial regulation requires; Avi notes and connected-service tokens until deleted; data deleted or anonymised when no longer needed; account deletion available in the app subject to legal holds. source 1 CROPS P2
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?
Evidenced
Avici Inc (Delaware) is responsible for the personal data in its policy; the verification provider collects identity data directly and holds it under its own notice. Controller and processor roles are not named as such; no DPIA statement. source 1
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?
Unknown
No data processing agreement published.
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?
Unknown
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?
Evidenced
Avici states nothing. Issuer group (Rain): security events monitored centrally; no SIEM product or endpoint detection named. Avici's documents name only the issuer, Third National; Rain's privacy policy identifies Third National as Nimbus LLC, a Rain affiliate, and Rain's security page covers "every card program", so Rain's statements are recorded as the issuer group's position (inferred link; Avici does not name Rain). source 1
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?
Unknown
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?
Unknown implied from the component list
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?
Unknown implied from the component list
B9.2 CI runs on pull requests Does every pull request trigger automated checks?
Unknown implied from the component list
B9.3 Tests run in CI Do the CI workflows run the test suite?
Unknown implied from the component list
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?
Unknown implied from the component list
B9.5 Versioned releases Are releases tagged with immutable semantic versions?
Unknown implied from the component list
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?
Unknown implied from the component list
B9.7 Changelog Is a changelog maintained with the code?
Unknown implied from the component list
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?
Unknown implied from the component list
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?
Evidenced
Logical view only: the docs describe the card flow (USDC into a loan-escrow contract, USD credit on the card, Avici "spend attestation" charges, liquidation every 1 to 7 days to settle with Visa). No infrastructure or integration architecture, and no chain or contract address. source 1
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?
Evidenced
Avici Inc, a Delaware corporation (651 N Broad St, Suite 201, Middletown, Delaware), under Delaware law for the Terms of Use; the card terms are three-party between the user, Avici Inc and the issuer Third National, under Puerto Rico law. source 1 · source 2
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?
Evidenced
Customer fees: card purchase and annual fees, ATM fees on Platinum cards, a $35 dispute fee, wire and SWIFT fees on virtual accounts; the Terms list cards, Credit Mode, Grow, Privacy Send and Avici Biz as paid features. No financial statements or funding statement found. source 1
B11.3 Termination terms What happens to customer funds and data on termination by either side?
Evidenced
Avici may terminate, restrict or pause use at its discretion, including for compliance, fraud or risk reasons; Avici and the issuer may cancel the card at any time with or without cause or notice. Wallet funds stay in the self-custody wallet (Avici's claim); funds in the card escrow are subject to liquidation for outstanding charges. Account deletion is available, subject to legal retention (B6.3). source 1 · source 2
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?
Evidenced
Partly. Avici's AI assistant Avi and the CLI/MCP are read-only and cannot move money, so they are not in the payment path. Card compliance runs through Sumsub ongoing AML monitoring (Avici docs) and, at the issuer group, Rain's automated fraud, sanctions and transaction-monitoring systems; whether either uses machine learning is not stated. Avici's documents name only the issuer, Third National; Rain's privacy policy identifies Third National as Nimbus LLC, a Rain affiliate, and Rain's security page covers "every card program", so Rain's statements are recorded as the issuer group's position (inferred link; Avici does not name Rain). source 1 · source 2
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?
Evidenced
For Avi, the privacy policy limits model providers to those that do not train on user content and keep data briefly or not at all. For compliance decisions only Rain's override path is documented (human review where law grants it). No monitoring, validation, decommissioning or bias documentation. source 1 · source 2
Scope of assessment
Components in the payment path
Component
Role
Public
Licence
Operator
Required
Avici app and wallet backend
backend
No
proprietary
Avici Inc
Yes
Card loan escrow contract (EVM; chain and address not disclosed)
contracts
No
proprietary
Avici Inc / card partner
Yes
Avici smart wallet (ZeroDev on EVM; key-based wallet on Solana)
wallet
No
proprietary
User (infrastructure by ZeroDev and Avici)
Yes
Avici gas relayer (EVM and Solana)
relayer
No
proprietary
Avici Inc
No
Relay (auto-swap and bridging for card top-ups)
other
No
proprietary
Relay
No
Sumsub (KYC and ongoing AML monitoring)
kyc
No
proprietary
Sumsub
Yes
Third National (card issuer)
card-issuer
No
proprietary
Third National
Yes
Visa (card network)
card-network
No
proprietary
Visa
Yes
Repositories
None found. Absence of public code is itself a finding.
Contracts
None listed.
Assessor notes
Classified as incumbent: I found no verified contract or public repository needed to run the card. Searched: avici.money (home, tos, tosavicicard, privacypolicy), docs.avici.money (llms.txt index and the card, wallet and FAQ pages), and GitHub (Avici-Labs org with 4 unrelated repos; users avici, avicimoney, aviciii; code search for avici.money). The docs say the card collateral sits in a self-custodial "Loan Escrow" contract "on EVM" that "only user's wallet" can withdraw from, but they give no chain, address, ABI or audit. These claims cannot be checked and were not used to score custody. The wallet supports ten EVM chains plus Solana. Re-assess as type card if the escrow contract address is published.
