Admin pause or freeze powers
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
No checkable evidence settles this yet, so it counts as 0.
Deblock Card
incumbent No public chain settlementdeblock.com
Incumbent rails have no public chain settlement and no public code. They are scored with the same rubric as every other row. Their low ratings show the verifiability gap between rails whose behaviour can be inspected and rails whose behaviour must be trusted; that gap is the point of the comparison, not a claim that the incumbent is unsafe.
At a glance
- Category
- Incumbent baseline
- Chain
- Off-chain
- CROPS tally
- 0 of 23 hold up · 18 no evidence
- Settles in
- USDC, EURC, BTC +2
- Security audits
- None published
- Offered
- Not on file
- Last edited
- 2026-10-13 · History
- Censorship ResistanceWeakest: Admin pause or freeze powers; Settle without the provider; Reliance on hosted services; Neutral settlement, disclosed filtering; Token and chain freeze risks disclosed
- OpenWeakest: Contracts verified onchain; Whole stack published; Can be self-hosted; Interfaces and data export
- FreeWeakest: Open-source licences; Protection against relicensing; No proprietary dependencies
- PrivacyWeakest: Tracking and analytics; Data collected beyond payment; Payments linkable onchain; Third parties in the payment flow; Endpoints can be changed
- SecurityWeakest: Who can upgrade the code; Token approval scope; Funds safe if provider disappears; Secrets and webhook handling; Audits and bug bounty
Holds up 0
Nothing rated Partial or Strong.
Falls short 5
Not yet evidenced 18
- Admin pause or freeze powers
- Neutral settlement, disclosed filtering
- Token and chain freeze risks disclosed
- Contracts verified onchain
- Whole stack published
- Can be self-hosted
- Interfaces and data export
- Protection against relicensing
- No proprietary dependencies
- Tracking and analytics
- Data collected beyond payment
- Payments linkable onchain
- Third parties in the payment flow
- Endpoints can be changed
- Who can upgrade the code
- Token approval scope
- Secrets and webhook handling
- Audits and bug bounty
Where it is offered
No first-party country statement is on file for this provider. See the Countries index.
Settlement token
What the balance is held in and debited from. Shown as context; it does not change any rating.
| Token | Class | Issuer | Contract |
|---|---|---|---|
| USDC | fiat-backed stablecoin | Circle | |
| EURC | fiat-backed stablecoin | Circle | |
| BTC | native token | ||
| ETH | native token | ||
| SOL | native token |
Conversion. The token is converted into a fiat balance at top-up; card spend comes from that fiat balance.
- Fiat-backed stablecoin. An issuer holds the reserves and can freeze balances at the token contract. Value depends on the issuer redeeming at par. Censorship Resistance records whether that freeze power is disclosed.
- Native token. No issuer can freeze it, but its price moves between top-up, authorisation and settlement, so the amount debited is not known in advance.
The card spends only from the user's euro e-money current account at Deblock; it cannot spend crypto directly (Deblock's help centre says this feature is not yet available). Crypto held in the self-custodial Deblock wallet reaches the card only by selling it into euros in the app, and the help centre lists SOL, BTC, ETH, USDC and EUROC (Circle's EURC) as sellable for euros. All card payments are settled in euros, with Visa converting to the merchant's currency.
Evidence (3)3 documented
- Documented
Deblock's help centre says card payments cannot yet be made directly with crypto and are always settled in euros.
intercom.help/deblock/en/articles/8911372-can-i-make-card-payments-directly-with-my-cryptocurrencies
- Documented
The help centre says crypto can be sold only for euros and lists SOL, BTC, ETH, USDC and EUROC.
intercom.help/deblock/en/articles/10365208-what-crypto-pairs-can-i-sell
- Documented
The cards page says every card draws on the user's current account.
Censorship Resistance
Who can block valid use, and can users route around them?
Pillar rating: weakest of 5
0 of 5 Partial or better · 3 no evidence
What would raise this pillar
- Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
- Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
- Reliance on hosted services reaching Weak: Intermediaries required, only documented, no public code.
- Neutral settlement, disclosed filtering reaching Weak: Edge filtering is disclosed in docs only, or the neutrality of the settlement layer cannot be shown from code.
- Token and chain freeze risks disclosed reaching Weak: Enumerated in docs only.
Settle without the provider
Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer? C2
The card is a Visa debit card on Deblock's own e-money ledger, with Deblock as issuer. Settlement happens only inside Deblock and Visa, so there is no direct path.
Evidence (2)1 documented · 1 claimed
- Documented
Deblock SAS is the authorised electronic money institution behind the current account the card spends from.
- Claimed
The cards page says Deblock is itself a direct Visa member.
Reliance on hosted services
Does the payment flow require a relayer, paymaster, bundler, or API that only the provider runs? C3
Every card payment depends on Deblock's closed ledger and issuing systems and on Visa. Closed, single-vendor.
Evidence (1)1 documented
- Documented
Deblock operates the e-money account and, per its cards page, the card issuing; no other operator exists in the card path.
Neutral settlement, disclosed filtering
Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4
No checkable evidence settles this yet, so it counts as 0.
Token and chain freeze risks disclosed
Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees? C5
No checkable evidence settles this yet, so it counts as 0.
Open
Is the whole stack visible?
Pillar rating: weakest of 4
0 of 4 Partial or better · 4 no evidence
What would raise this pillar
- Contracts verified onchain reaching Weak: Some contracts verified.
- Whole stack published reaching Weak: SDK or contracts only.
- Can be self-hosted reaching Weak: Docs exist; reproduction not attempted, or failed with blockers listed.
- Interfaces and data export reaching Weak: Documented only.
Contracts verified onchain
Does the deployed bytecode match public source, and can a third party rebuild it? O1
No checkable evidence settles this yet, so it counts as 0.
Whole stack published
Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2
No checkable evidence settles this yet, so it counts as 0.
Can be self-hosted
Can a stranger reach a working deployment from the README? O3
No checkable evidence settles this yet, so it counts as 0.
Interfaces and data export
Are ABIs, event schemas, an API schema, and a payee data export in a non-proprietary format all in the repo? O4
No checkable evidence settles this yet, so it counts as 0.
Free
Does the license actually let a third party fork, modify, and run it?
Pillar rating: weakest of 3
0 of 3 Partial or better · 2 no evidence
What would raise this pillar
- Open-source licences reaching Weak: Source-available (BUSL, SSPL, ELv2, Commons Clause, custom) on a critical repo.
- Protection against relicensing reaching Weak: CLA permits relicensing; commitment exists in docs.
- No proprietary dependencies reaching Weak: Documented that production needs a hosted service with no open alternative.
Open-source licences
Does every repository needed to run the product carry an OSI-approved license? F1
All required components (app, ledger, issuing) are closed and proprietary. Nothing can be forked.
Evidence (1)1 documented
- Documented
The legal notice reserves all software and databases as Deblock's exclusive property.
Protection against relicensing
Can the provider unilaterally relicense future versions, and has it committed not to? F2
No checkable evidence settles this yet, so it counts as 0.
No proprietary dependencies
Does a production deployment need a proprietary plugin or hosted-only service? F3
No checkable evidence settles this yet, so it counts as 0.
Privacy
What can an observer learn, and did the user knowingly choose it?
Pillar rating: weakest of 5
0 of 5 Partial or better · 5 no evidence
What would raise this pillar
- Tracking and analytics reaching Weak: Present, on by default, disclosed in docs.
- Data collected beyond payment reaching Weak: Collection beyond settlement needs, disclosed in a policy only.
- Payments linkable onchain reaching Weak: Invoice IDs or payee tags in events, disclosed.
- Third parties in the payment flow reaching Weak: Present, disclosed in docs only.
- Endpoints can be changed reaching Weak: Documented workaround.
Tracking and analytics
Do the SDK, widget, or frontend ship analytics, telemetry, error reporting, or fingerprinting? P1
No checkable evidence settles this yet, so it counts as 0.
Data collected beyond payment
Does the flow collect anything beyond addresses, amounts, token, and chain? P2
No checkable evidence settles this yet, so it counts as 0.
Payments linkable onchain
What do calldata and events reveal about who paid whom for what? P3
No checkable evidence settles this yet, so it counts as 0.
Third parties in the payment flow
Which third parties see a request during a payment, and can they be swapped out? P4
No checkable evidence settles this yet, so it counts as 0.
Endpoints can be changed
Can RPC and indexer URLs be changed, and is the indexer code public? P5
No checkable evidence settles this yet, so it counts as 0.
Security
Who can cause loss, lock users in, or change the rules?
Pillar rating: weakest of 6
0 of 6 Partial or better · 4 no evidence
What would raise this pillar
- Who can upgrade the code reaching Weak: Multisig admin, no timelock.
- Token approval scope reaching Weak: Unbounded by default, disclosed.
- Funds safe if provider disappears reaching Weak: Funds retrievable only through a documented manual contract call.
- Secrets and webhook handling reaching Weak: Secrets in client with a disclosed mitigation.
- Audits and bug bounty reaching Weak: Audit report only (documented tier cap).
Who holds funds in transit
Who holds funds between payer and payee, and can the provider redirect them? S1
The card spends a balance that Deblock holds as e-money. That is a disclosed provider-held balance, so 1. The self-custodial crypto wallet is a separate product and not in the card path.
Evidence (1)1 documented
- Documented
Card funds are e-money held by Deblock SAS as the authorised electronic money institution.
Who can upgrade the code
Who can change the contract code, and with how much notice? S2
No checkable evidence settles this yet, so it counts as 0.
Token approval scope
How large an allowance does the SDK ask users to grant, and for how long? S3
No checkable evidence settles this yet, so it counts as 0.
Funds safe if provider disappears Derived
If the provider disappears tomorrow, do payees keep their funds and the ability to keep settling? S4
Derived from S1 = 1 (provider-held e-money), C2 = 0 and C3 = 0. Card funds and access depend on Deblock operating; any recovery would go through EMI safeguarding (see context), not through a path the user controls. Crypto in the self-custodial wallet is outside the card rail.
Evidence (1)1 documented
- Documented
The card balance exists only on Deblock's e-money ledger.
Secrets and webhook handling
Are secrets kept out of client bundles and are webhooks signed and verified? S5
No checkable evidence settles this yet, so it counts as 0.
Audits and bug bounty
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6
No checkable evidence settles this yet, so it counts as 0.
Security audits 0
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
No published audit report was found.
Operational and procurement
Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.
Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 7 evidenced, 0 attested, 0 absent, 0 not applicable, 38 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.
Group A: operational facts
Fees
| Component | Paid by | Amount | Basis |
|---|---|---|---|
| provider | payer | Standard plan free; Premium 10 EUR per month | Pricing plans page; fees may change under the Client Terms s1.4 with 60 days to decline. |
| card | payer | Virtual cards free; physical card delivery fee on Standard (shown in app); up to 3 physical cards free on Premium | Help articles 8911205 and 8911216; Standard delivery fee amount not published. |
| fx | payer | First 500 EUR a month free of markup; then Standard 0.5% weekdays, 1% weekends; Premium 0% | Help article 8911354. The cards page says 0% FX on card payments abroad, which conflicts for Standard users beyond the allowance. |
| cashout | payer | ATM: 1% (min 1 EUR) beyond the plan allowance, plus any ATM operator surcharge | Help article 11093412 (allowance Standard 1 withdrawal or 100 EUR a month, Premium 5 or 1,000 EUR; limits 15,000 EUR a month Standard, 30,000 EUR Premium, 1,000 EUR a day). |
| cashout | none | SEPA and SEPA Instant transfers out free | Help article 8913029; Terms s6.1 allow cross-border or SWIFT fees for other currencies. |
| cashout | payer | Crypto sell (crypto to EUR): 1.99% Standard, 0.49% Premium | Pricing plans page; applies to the self-custodial wallet off-ramp into the e-money account. |
| limit | none | Each card payment capped at 10,000 EUR | Help article 8911134; Deblock says the cap may change. |
Card top-ups into the account are free up to 2,000 EUR a month, then a fee shown in the app (help article 11087296); a funding fee, not recorded above. Insurance and cashback are plan benefits, not fees.
- Documented
Pricing plans page (Standard and Premium columns).
- Documented
Help article on physical card fees.
intercom.help/deblock/en/articles/8911216-are-there-any-fees-for-ordering-a-physical-card
- Documented
Help article on card payment and FX fees.
intercom.help/deblock/en/articles/8911354-are-there-any-fees-for-making-card-payments
- Documented
Help article on ATM limits and fees.
intercom.help/deblock/en/articles/11093412-what-are-the-limits-and-fees-for-atm-withdrawals
- Documented
Help article on outgoing transfer fees.
intercom.help/deblock/en/articles/8913029-are-there-any-fees-to-send-transfers
- Documented
Help article on card spending limits.
Custody model
Provider-custodial
The card spends a Deblock-issued e-money balance, safeguarded in client money accounts at banks (Terms s8.1). The separate crypto wallet is a 2-of-2 key-shard wallet with one shard on Deblock's backend; it is outside the card path, as in the S1 finding.
Licences and registrations
| Entity | Country | Regulator | Licence | Register |
|---|---|---|---|---|
| Deblock SAS | France | Autorité de contrôle prudentiel et de résolution (ACPR) | Electronic money institution (agrément) · CIB 17748 Issuing and distributing e-money; authorised 2023-11-22, active; free-provision-of-services passports to 29 other EEA states from 2024-09-04 | register |
| Deblock SAS | France | Autorité des marchés financiers (AMF) | Crypto-asset service provider (MiCA) · A2025-001 Exchange of crypto-assets for funds and for other crypto-assets, execution of orders; authorised 2025-05-23, notified for 29 other EEA states | register |
The register lists DEBLOCK as an EMI with no card-issuing licence separate from the EMI authorisation; Deblock's cards page says it is a direct Visa member (provider statement, not checked against Visa).
- Documented
ACPR REGAFI register open-data API, authorisation record for DEBLOCK (id 732211, SIREN 948264163, CIB 17748, LEI 254900XTUI35BGIBXP21); category Établissement de Monnaie Électronique, nature Agrément. The entity record is in dataset prd-banque-entites and the 29 outbound passports in prd-banque-passeports-sortants.
www.regafi.fr/api/explore/v2.1/catalog/datasets/prd-banque-autorisations/records
- Documented
ESMA interim MiCA register of authorised CASPs; row for DEBLOCK SAS (AMF, authorised 23/05/2025).
Cash-out options
| Where | Method | Partner | Fee | Limits |
|---|---|---|---|---|
| France | card spend | Deblock SAS (issuer), Visa | No card payment fee; FX markup beyond 500 EUR a month on Standard (0.5% weekdays, 1% weekends) | 10,000 EUR per card payment; card works at Visa merchants worldwide. |
| France | atm | Deblock SAS (issuer), Visa | Free allowance by plan, then 1% (min 1 EUR) plus operator surcharge | 15,000 EUR a month (Standard) or 30,000 EUR (Premium); 1,000 EUR a day; any Visa ATM, including abroad. |
| France | bank transfer | SEPA (Deblock SAS as EMI) | Free (SEPA and SEPA Instant) | Euro SEPA only; other international transfers not yet supported per help article 8912244. |
Countries: the only first-party eligibility statement found is the French Client Terms v12.3 (residence in France). The same Terms mention clients residing in Germany (PayPal top-ups), the ACPR register shows passports into 29 other EEA states, and the site has French Pacific locales, so other residents may be served under terms versions not read; the provider file has no availability block. Crypto off-ramp into the e-money account (fee in `fees`) precedes any of these routes.
- Documented
Help article on card acceptance abroad.
intercom.help/deblock/en/articles/8899846-do-my-cards-work-in-all-countries
- Documented
Help article on ATM limits and fees.
intercom.help/deblock/en/articles/11093412-what-are-the-limits-and-fees-for-atm-withdrawals
- Documented
Help article on outgoing transfers.
intercom.help/deblock/en/articles/8913029-are-there-any-fees-to-send-transfers
- Documented
Client Terms v12.3 (French version, s3.5) require legal residence in France to open an account.
cdn1.deblock.com/terms/personal-terms/FR/20260223-v12.3-personal-terms-EN.pdf
First deployment
2023-11-22: ACPR authorisation of Deblock SAS as an electronic money institution (regulator date); no dated public launch of the account or card was found.
The card cannot have been issued to customers before the e-money authorisation; the earliest status-page entry is 2024-10-07, and the about page says the company was founded in October 2022.
- Documented
REGAFI authorisation record, date_debut 2023-11-22.
www.regafi.fr/api/explore/v2.1/catalog/datasets/prd-banque-autorisations/records
Operating entity
Deblock SAS, FR · SIREN 948 264 163 (RCS Lille Métropole) · register
- Documented
French government company search API; legal unit created 2023-01-16, active, NAF 63.11Z, head office 612 rue de la Chaude Rivière, Lille.
- Documented
Legal notice naming the publisher and its registration.
Security incidents
- 2025-12-19: Platform outage affecting all services including card payments and SEPA transfers, 31 minutes (status page, major incident). funds lost: unknown source
- 2026-02-04: Services down for 27 minutes; a fix was rolled out to all services (status page, major incident). funds lost: unknown source
- 2026-08-04: Degraded performance affecting crypto transactions, card payments and app access (status page, major incident). funds lost: unknown source
- 2026-09-04: All Deblock card transactions declined for about 3 hours because Visa's settlement system stopped registering the funds Deblock holds with Visa; Deblock states no customer funds were affected. funds lost: no source
- 2026-10-02: Card payments declined for some customers despite sufficient funds, 13 minutes (status page, major incident). funds lost: unknown source
Absence of a found incident is not evidence that none occurred.
Selected from the 30 status-page entries (2024-10-07 to 2026-10-02) the major incidents touching card payments or all services; minor incidents and scheduled maintenance are omitted. No security incident or data breach notice was found on deblock.com or in the help centre.
- Documented
Status page incident entry for the 2026-09-04 Visa settlement issue.
Product changes affecting users
- 2023-01-16: Legal unit DEBLOCK (SIREN 948 264 163) created (French company register). source
- 2023-11-22: Authorised by the ACPR as an electronic money institution (CIB 17748). source
- 2024-09-04: E-money free-provision-of-services passports registered for 29 other EEA states. source
- 2025-05-23: Authorised as a crypto-asset service provider under MiCA by the AMF (A2025-001). source
- 2026-02-23: Client Terms and Conditions version 12.3 dated. source
- Documented
REGAFI outbound passport records for Deblock (29 rows, all Libre prestation de services from 2024-09-04).
www.regafi.fr/api/explore/v2.1/catalog/datasets/prd-banque-passeports-sortants/records
- Documented
ESMA interim MiCA CASP register row for Deblock, authorisation date 23/05/2025.
Volume transacted (verified only)
Closed e-money ledger and Visa card issuing with no listed contracts; card settlement is not on any public chain. Deblock publishes no transaction volumes that could be checked.
Group B: institutional due diligence
| Control | State | What was found |
|---|---|---|
| Assurance and certifications | ||
| B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity? | Unknown | No ISO 27001 statement found on deblock.com (legal notice, cards, pricing, about, press; /en/security returns 404), in the 274 public help articles (intercom.help/deblock) or in the Client Terms v12.3. The privacy policy loads only through Deblock's token-protected API and was not read. |
| B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service? | Unknown | Same search as B1.1. The legal notice names Vercel Inc (servers in the European Union) as website host; the hosting of the app and ledger is not stated, and no certificate was found for either. |
| B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available? | Unknown | No SOC 2 or ISAE 3402 statement found in the same search. |
| B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked? | Unknown | No independent code review report found; CROPS S6 is unknown for this provider. |
| B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available? | Unknown | No penetration-test report, attestation or bug bounty found (help centre keyword search for penetration, pentest, bug bounty returned nothing). |
| B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months? | Unknown | |
| Vulnerability and patch management | ||
| B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)? | Unknown | |
| B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)? | Unknown | No patch timelines in the Client Terms v12.3 or the help centre. |
| B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically? | Unknown | |
| Incident reporting and continuity | ||
| B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)? | Unknown | No customer incident-notification time found. The Client Terms (s3.7) say Deblock will email or text the client if it suspects unauthorised access to that client's account, without a time limit. |
| B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule? | Unknown | |
| B3.3 Recovery plan Is there an approved and tested recovery plan for the service? | Unknown | The Client Terms (s11.5) promise only best efforts for service continuity; no recovery plan is described. |
| B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents? | Evidenced | Public status page (status.deblock.com, StatusPal) with per-service status and an incident and maintenance history back to 2024-10-07. Incident entries carry short cause statements (for example the 2026-09-04 Visa settlement issue); no separate post-mortem documents were found. source 1 · source 2 |
| Identity and access (operator side) | ||
| B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication? | Evidenced | Access only through the app on the user's phone, with a passcode or device biometrics; sensitive operations (payments, transfers to external accounts, viewing card numbers and IBANs, crypto actions) require strong authentication with a 4-digit code or biometrics plus possession of the registered "Key Smartphone". A selfie check is required after reinstalling the app. source 1 · source 2 |
| B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts? | Unknown | |
| B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly? | Unknown | |
| B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process? | Unknown | |
| B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)? | Unknown | No idle-session timeout stated. The Terms (s8.3) only advise the client to close the app when not in use. |
| API and integration | ||
| B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls? | Unknown | No public API documentation found for personal or business accounts; the card product is used through Deblock's own apps. |
| B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable? | Unknown | |
| B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)? | Unknown | |
| B5.4 Export controls If an API exports data, does it limit volumes and log exports? | Unknown | Monthly statements download in the app (help article 14136786) and a transaction report is available on request (Terms s3.6); no API export, volume limit or export logging found. |
| Data protection and privacy governance | ||
| B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit? | Evidenced | No data classification or encryption-at-rest statement found (the privacy policy was not readable without Deblock's API token). Observed: deblock.com refuses TLS 1.1 and accepts TLS 1.2. source 1 |
| B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing? | Unknown | |
| B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination? | Unknown | The Client Terms (s13) say data may be kept after closure "for other legal reasons" without periods, and funds left after closure can be claimed for six years (s9.3). Retention periods are in the privacy policy, which loads only through Deblock's token-protected API and was not read. |
| B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined? | Evidenced | Deblock SAS is data controller, with a Data Protection Officer (dpo@deblock.com) and the CNIL as supervisory authority. No processor list (the KYC provider is unnamed in the provider file) and no DPIA statement found. source 1 |
| B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent? | Unknown | |
| Logging and monitoring | ||
| B7.1 Audit logging Are account changes, logins and activity on important records logged and retained? | Unknown | The account-closure help article says closure decisions are recorded for audit and regulatory review; no statement on login or activity logging. |
| B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms? | Unknown | |
| Hosting and network | ||
| B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation? | Unknown | |
| B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden? | Unknown | |
| Engineering practice in public repositories | ||
| B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes? | Unknown | |
| B9.2 CI runs on pull requests Does every pull request trigger automated checks? | Unknown | |
| B9.3 Tests run in CI Do the CI workflows run the test suite? | Unknown | |
| B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)? | Unknown | |
| B9.5 Versioned releases Are releases tagged with immutable semantic versions? | Unknown | |
| B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed? | Unknown | |
| B9.7 Changelog Is a changelog maintained with the code? | Unknown | |
| B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released? | Unknown | |
| Architecture documentation | ||
| B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used? | Unknown | No architecture documentation found. The Terms describe the crypto wallet's 2-of-2 key-shard design in prose (s3.3, s5.1); nothing covers the e-money ledger or card stack. |
| Commercial and financial | ||
| B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction? | Evidenced | Deblock SAS, French société par actions simplifiée, SIREN 948 264 163 (RCS Lille Métropole), Lille; French law and French courts govern the Client Terms. Deblock is itself the EMI and card issuer (direct Visa member per its cards page). source 1 · source 2 |
| B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source? | Evidenced | Customer fees and paid plans (Premium at 10 EUR a month; crypto buy, sell and swap fees of 1.99% on Standard and 0.49% on Premium; ATM and FX fees beyond allowances). No financial statements or funding disclosures found. source 1 |
| B11.3 Termination terms What happens to customer funds and data on termination by either side? | Evidenced | Client may close at any time for free. Deblock may terminate without giving reasons on two months' email notice, or immediately on listed grounds (missing source-of-funds information, false documents, abnormal use, suspected fraud, reputational harm, legal order). Balance is sent to the client's bank account; at least 60 days to withdraw, then a minimum 1 EUR fee per transfer, and funds can be claimed for six years. On closure Deblock hands over its key shard so the client keeps the self-custodial crypto wallet. source 1 · source 2 |
| AI components | ||
| B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)? | Unknown | The Client Terms (s8.5) say Deblock may set up monitoring systems for anti-money-laundering checks, without saying whether they are automated or use AI. Automated decision-making would be disclosed in the privacy policy, which was not readable without Deblock's API token. |
| B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented? | Unknown | |
Scope of assessment
Components in the payment path
| Component | Role | Public | Licence | Operator | Required |
|---|---|---|---|---|---|
| Deblock app (iOS, Android, app.deblock.com) | frontend | No | proprietary | Deblock SAS | Yes |
| Deblock current account and card ledger (e-money) | ledger | No | proprietary | Deblock SAS (EMI) | Yes |
| Deblock card issuing (direct Visa member) | card-issuer | No | proprietary | Deblock SAS | Yes |
| Visa | card-network | No | proprietary | Visa | Yes |
| KYC provider (not identified) | kyc | No | proprietary | undisclosed | Yes |
| Self-custodial crypto wallet (seed-phrase keys on device; not in the card path) | wallet | No | proprietary | user, app by Deblock SAS | No |
Repositories
None found. Absence of public code is itself a finding.
Contracts
None listed.
Assessor notes
Incumbent: no verified contract or public repository needed to run the product was found. The card is a Visa debit card on Deblock's own e-money account. The self-custodial crypto wallet uses seed-phrase keys generated on the device (self-custody page), with no smart contract in the card path. Searched: GitHub (org DeblockApp exists with 0 public repos and nothing linking it to Deblock; other org names do not exist; repo search "deblock" returns only image-deblocking projects); deblock.com sitemap, legal notice, legal agreements, cards, self-custody and FAQ pages; the app.deblock.com bundle (Sentry enabled outside localhost, Intercom, Google Tag Manager, Fireblocks key-format helpers; no contract addresses). The Terms, privacy policy and complaints policy render client-side from a Deblock API that needs a bearer token embedded in the page script. I did not use that token, so those documents were not read and the cells that depend on them (C1, C4, P1, P2, P4) are unknown.