Unaudited, unvetted, experimental. Do not use as a reference. AI-researched ratings that may be wrong; not advice or a statement of fact about any provider. Full disclaimer
Pending review. 1150 of 1150 ratings not yet checked by a human. Do not rely on unreviewed ratings.
Fuse Card
card Assessed on Solana (solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp)fusewallet.com
Ratings apply to this deployment only. Treat them as unverified for other chains. Why this deployment: Fuse Card is the Bridge-run Visa card in Squads' Fuse wallet (fusewallet.com), not a product of the Fuse Network (chain 122). The Fuse Terms and Fuse Pay post say a separate Squads smart-account "Card Account" holds the USDC and Bridge spends it through a daily Spending Limit. Onchain, 1,727 Squads v4 USDC spending limits share member AE2RGS1h... with period Day and a 2,000 USDC cap, matching the documented "up to $2,000" limit. Excluded: Fuse Network (122), which no Fuse Card document mentions.
Offered only in the countries listed. Checked 2026-10-09. Not scored.
The Fuse Visa Card support page lists 18 countries twice (in the card overview and in the FAQ "Am I eligible for Fuse Card?"): the U.S. (excluding residents of New York and Alaska), Argentina, Bolivia, Brazil, Colombia, Costa Rica, Dominican Republic, Ecuador, El Salvador, Ghana, Guatemala, Honduras, Mexico, Panama, Nigeria, Paraguay, Peru and Uruguay. The same FAQ answer then says the card is for users in the U.S. and Argentina only, followed by "We are working to make Fuse Card available in more countries soon". The page contradicts itself, so the more restrictive reading (US and AR) is used; the 18-country list is probably the newer text. In the US, residents of New York and Alaska are excluded. Applicants must be 18 or older and pass KYC via Bridge.
Conversion. The token is sold for fiat when a payment is authorised.
Fiat-backed stablecoin. An issuer holds the reserves and can freeze balances at the token contract. Value depends on the issuer redeeming at par. Censorship Resistance records whether that freeze power is disclosed.
USDC on Solana is the only card asset. It stays in the user's Squads Card Account until a purchase, when Bridge pulls it through its daily spending limit and the merchant is paid in local currency over Visa.
Checked 2026-10-12
Evidence (2)1 verified · 1 documented
Verified
The sample Bridge spending limit's mint is USDC EPjFWdd5... (period Day, 2,000 USDC); all 1,727 limits with Bridge's member key use the USDC mint.
The launch post says USDC stays on Solana in the Fuse wallet until a purchase, when the merchant gets local currency and the equivalent USDC is deducted from the Card Account.
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Censorship Resistance
Who can block valid use, and can users route around them?
0 FailsPillar rating: weakest of 5 1 of 5 Partial or better
What would raise this pillar
Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Onchain, no one can pause or freeze the user's Squads accounts: the program has no such instruction and is immutable, and neither Squads nor Bridge holds a member key. The card itself can be blocked or cancelled by Lead Bank or Bridge "with or without notice", and every card settlement depends on Bridge using its spending limit. Judgment call: the documented per-card block without notice meets anchor 0, as in Gnosis Pay; the onchain layer alone would score 3.
Evidence (3)2 verified · 1 documented
Verified
The only program-level admin (ProgramConfig authority) can set itself, the multisig creation fee and the treasury; no pause, freeze or blacklist instruction exists in the program.
Sample Card Account multisig has config_authority = default (autonomous), threshold 1 and a single member GcWXuyno... (permissions 7), which is the vault of Main Account 6AFbKVmL... (threshold 2; device and 2FA keys plus a vote-only recovery key). Squads and Bridge hold no member key.
Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer? C2
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Merchants are paid by Visa and Lead Bank off-chain. The only onchain step is Bridge pulling USDC with its own key. Neither payer nor payee can complete a card payment by calling the program.
Evidence (2)1 verified · 1 documented
Verified
A sample card debit is a SpendingLimitUse signed by Bridge's key AE2RGS1h... (a system-owned keypair account) moving 1.69 USDC from a card vault 9BWWRFQ7... to 9ipHpNhr...
Does the payment flow require a relayer, paymaster, bundler, or API that only the provider runs? C3
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
A card payment needs Bridge (KYC, authorisation, the spending-limit signer), Lead Bank, Visa and the closed Fuse app. All are closed and single-vendor.
Evidence (1)1 documented
Documented
Applying, KYC and card issuance run through Bridge inside the closed Fuse app.
Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The settlement program is neutral. Geographic eligibility is disclosed as a country list in the docs, and screening runs in Bridge's closed KYC. With C2 at 0 there is no way around it. Disclosed in docs only, so 1.
Evidence (2)1 verified · 1 documented
Verified
SpendingLimitUse checks only the spending-limit member, mint and optional destination list; the program has no address or country filter.
Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees? C5
2 Partial
Best evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
USDC on Solana is the only card asset. That shows in the onchain spending-limit configuration and in the docs. Circle's freeze authority over USDC is not stated in the Fuse Terms, the support page or the cardholder agreement. Judgment call: onchain configuration counts as "enumerated in code"; assumptions not stated, so 2.
Evidence (2)2 verified
Verified
The Bridge spending limit's mint is USDC EPjFWdd5... (period Day, amount 2,000,000,000 base units); all 1,727 limits with member AE2RGS1h... use the USDC mint.
Does the deployed bytecode match public source, and can a third party rebuild it? O1
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The program has no recorded verified build. The registry entry is unverified and points at a January 2024 commit whose spending-limit code (members must be multisig members) does not match observed behaviour; the audited commit 64af733 does match it. The README gives reproducible build steps, but no one has recorded a match. Unverified, so 0.
Evidence (2)2 verified
Verified
The OtterSec verified-build registry returns is_verified false for the program ("On chain program not verified"), on-chain hash d4866083..., a registered commit 3742e552 (Jan 2024) and is_frozen true.
Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2
1 Weak
Best evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Only the program and SDK are public. The Fuse app, backend and card integration are closed, and no API schema is published. 1.
Evidence (1)1 verified
Verified
The settlement program and its TypeScript SDK are public; no repo for the Fuse app, Fuse backend or Bridge card integration exists in the Squads-Protocol org.
Can the provider unilaterally relicense future versions, and has it committed not to? F2
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The program has already been relicensed, from BUSL to AGPL. That change opened it up, but it shows the licensor can relicense unilaterally. I found no CLA and no licence-stability commitment. Judgment call: the anchor names a prior relicensing event as 0, and I applied it even though the direction was toward openness.
Evidence (1)1 verified
Verified
From January 2024 to October 2024 the v4 LICENSE was Business Source License 1.1 (Licensor Selimor Investments Limited); commit 316913ad ("Open sourced!", 2024-10-11) replaced it with AGPL-3.0.
Do the SDK, widget, or frontend ship analytics, telemetry, error reporting, or fingerprinting? P1
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Analytics are disclosed in the policy. The app is closed and no trace was run, so presence and defaults cannot be checked in code. Judgment call: disclosed, so 1.
Evidence (1)1 documented
Documented
The Squads privacy policy (covers Fuse Wallet) lists ad networks and data analytics providers among recipients and analytics among uses.
Does the flow collect anything beyond addresses, amounts, token, and chain? P2
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The regulated card requires full KYC. It is disclosed in the policy and is beyond settlement needs, so 1.
Evidence (1)1 documented
Documented
The policy discloses KYC collection by Bridge and Lead Bank for Fuse Card, plus card account numbers, name, transaction history, email, phone, address and balances.
What do calldata and events reveal about who paid whom for what? P3
2 Partial
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No merchant data goes onchain. Every purchase is still a public, exactly sized transfer from a long-lived card vault, signed by Bridge's well-known key, so anyone can list a cardholder's spending amounts and timing. There are no fresh addresses or privacy patterns. Minimal linkage, documented, so 2.
Evidence (2)1 verified · 1 documented
Verified
Each card purchase is a public SpendingLimitUse whose log names the card vault, the destination 9ipHpNhr... and the exact amount (1,690,000 base units); no merchant or MCC data is onchain.
Who holds funds between payer and payee, and can the provider redirect them? S1
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
At rest, funds stay in the user's Card Account, whose only member is the user's Main Account. When a purchase happens, Bridge pulls USDC into its own wallet and settles with the merchant off-chain, so funds in flight are provider-held. Bridge's key can also send up to the daily limit to any address, because the destination is unrestricted. Judgment call: that is a bounded ability to redirect funds, so 0. With a receiver-locked limit this would be 1.
Evidence (2)2 verified
Verified
The sample Bridge spending limit has member AE2RGS1h..., period Day, 2,000 USDC and an empty destinations list; 1,723 of the 1,727 limits with that member have no destination restriction.
Who can change the contract code, and with how much notice? S2
3 Strong
Best evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The program is immutable, and the Main and Card Account configurations can only be changed by the user's own keys. No one at Squads or Bridge can change the code. Non-upgradeable, so 3. The Fuse app could steer users to a different program in future; that is outside this cell.
Evidence (2)2 verified
Verified
Program account points to programData Fy3YMJCvwbAXUgUM5b91ucUVA3jYzwWLHL3MwBqKsh8n, whose upgrade authority is None (immutable).
The sample Main Account has config_authority = default, threshold 2 and members F6ow8NRv... (7), F7yCa8b4... (7) and Du5LoukF... (vote only); account configuration changes need the user's own keys.
How large an allowance does the SDK ask users to grant, and for how long? S3
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The allowance is bounded and refilling, but it is not limited to one receiver, which anchor 2 requires. Judgment call: between 1 and 2, so I took the lower. It is disclosed, capped and user-adjustable, but the destination is open.
Evidence (2)1 verified · 1 documented
Verified
The allowance granted to Bridge is a refilling 2,000 USDC per day spending limit with no destination restriction (1,656 of 1,727 limits use the 2,000 maximum).
If the provider disappears tomorrow, do payees keep their funds and the ability to keep settling? S4
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Chain of reasoning. S1: funds at rest sit in the user's own accounts, outside the spending limit. S2: the program is immutable and holds no provider key. C2 = 0 and C3 = 0: card settlement stops without Bridge and Fuse. O3 = 1: a public MIT Squads v4 client could drive the withdrawal, but self-hosting is unproven. Judgment call: the onchain withdrawal path is verified, but I found no evidence that the Device and 2FA keys can be used outside the closed Fuse app. Funds are retrievable through a documented manual contract call, so 1, not 2.
Evidence (2)1 verified · 1 documented
Verified
A member-approved vault transaction executes after the multisig's time_lock (300 s on the Card Account); no Squads or Bridge signature is involved.
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The settlement program has audits pinned to a commit and a bounty process. The audited commit matches observed spending-limit behaviour, but no verified build ties it to the deployed bytecode (O1 = 0), and finding fixes are not linked. Fuse's own app and Bridge integration have no published audit. Judgment call: 1 rather than 2 because deployed-equals-audited is unproven.
Evidence (1)1 verified
Verified
The README lists ten audit reports (OtterSec, Neodyme, Certora, Trail of Bits) in audits/ and names 64af7330413d5c85cbbccfd8c27a05d45b6e666f as "the final and fully audited commit"; SECURITY.md describes a bug bounty process.
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
Squads v4 multisig program updates: transaction buffers and the custom allocator, reviewed October to November 2024. at dcac867070 The report states that the last reviewed revision corresponds to the deployed program hash d4866083...f2fac, which matches the program data read onchain on 2026-10-13.
Squads v4 multisig program: full audit at 7d79e69 with formal verification and follow-up reviews up to 64af733 (final report). at 64af733041 Undated; added to the repository on 2024-12-09. The report names d4866083...f2fac as the onchain hash of the audited program, matching the deployed program.
Squads v4 multisig program: security assessment and Certora Prover verification of the 2024 additions (transaction buffers and related changes), 3 September to 1 October 2024. The report names program hash d4866083...f2fac as the latest audited build; the deployed program matches it.
Squads v4 multisig program updates: rent reclamation and global program config, January 2024. at 3742e5521a Earlier revision of the deployed program; later changes were covered by the December 2024 reports.
Squads v4 multisig program: audit at 7d79e69 with formal verification and follow-up reviews up to 3742e55. at 3742e5521a Undated; added to the repository on 2024-02-08. Superseded by the final 2024 report.
Squads v4 multisig program: the October 2023 audit and formal verification plus an appendix on the rent reclamation and global program config PRs (#60 to #66). at 81842a7e37
Partly
October 2023 findings plus 1 low/medium and 2 recommendations in the appendix
Squads v4 multisig program: manual security analysis (29 August to 5 October 2023) and formal verification. at 81842a7e37 Earlier revision of the deployed program; SQ-005 (spending-limit members not checked against multisig members) concerns the spending limits Fuse uses.
Squads v4 multisig program, full source including the September 2023 spending-limit instructions, plus design and social-engineering resilience. Earlier revision of the deployed program.
Partly
No critical or high; 2 medium, 2 low and informational issues; all addressed
Squads v4 multisig program, assessed 6 July to 22 September 2023. at 7d79e69 Earlier revision of the deployed program; superseded by the 2024 OtterSec reports.
Partly
3 low, 3 informational suggestions
Compiled from: The Security section of the Squads-Protocol/v4 README and its audits/ folder (ten reports, read at af94153), Squads' public-v4-client repository (no reports), Fuse's site and support pages, and Bridge's card agreement. Fuse's iOS app, backend and Bridge's spending-limit key handling have no published audit. Coverage check: the SHA-256 of the deployed SQDS4ep65... program data (read 2026-10-13 from api.mainnet-beta.solana.com) is d48660833989ecea...f2fac, the program hash that the final 2024 OtterSec, Neodyme and Certora reports name as the audited build of 64af733. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.
Operational and procurement
Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.
Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 16 evidenced, 4 attested, 2 absent, 0 not applicable, 23 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.
Group A: operational facts
Fees
Evidenced
Component
Paid by
Amount
Basis
card
none
0 USD to obtain the card; no monthly, annual, inactivity or replacement fee
Cardholder agreement fee schedule (Lead Bank); the bank may change fees on notice by posting or email.
fx
none
0% on transactions with merchants outside the US
Cardholder agreement long-form disclosure (international transaction fee).
provider
none
No top-up fee or card transaction fee
Fuse support page; top-up is a transfer from the Main Account to the Card Account on Solana (network fee paid via Fuse's paymaster, not quantified).
cashout
payer
Bank transfer: 1 USD ACH fee or 1 USD SEPA fee; no Fuse fee
Fuse support page on bank transfers.
limit
none
Daily card spending limit up to 2,000 USD by default (user-adjustable; may rise with usage)
Fuse support page; enforced onchain as the Bridge spending limit.
The cardholder agreement leaves the annual-fee and per-transaction rows blank in its long-form table and says Platform Provider or Program Manager fees may apply to stablecoin sales; Fuse's pages state none. Spread on the USDC-to-USD conversion by Bridge is not stated.
Documented
Lead Bank Prepaid Visa Card long-form fee disclosure.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Custody model
Evidenced
Hybrid: self-custody with a provider-controlled spend path
Funds rest in the user's own Squads v4 Card Account (sole member is the user's Main Account); Bridge's key can pull up to the daily limit (default 2,000 USDC) to any destination and settles with merchants off-chain. Agrees with the S1 finding (score 0, bounded ability to redirect funds).
FDIC (primary federal regulator); state charter, Missouri
State-chartered commercial bank, FDIC-insured, non-member (BKCLASS NM) · FDIC certificate 8283 Issuer of the Fuse Card (Lead Bank Prepaid Visa Card); Kansas City, MO; active.
Only the issuer is register-checked. Bridge Ventures LLC (programme manager) holds no stated licence for the card; Bridge's legal page says US account services are provided by Bridge Building Inc. (NMLS ID 2450917), which was not checked in NMLS Consumer Access. Squads says it is not a bank or a digital asset custodian. The cardholder agreement says card funds are not FDIC insured.
Documented
FDIC BankFind API record for certificate 8283, Lead Bank, Kansas City, Missouri; active, state charter, regulator FDIC, class NM.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-12
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Cash-out options
Evidenced
Where
Method
Partner
Fee
Limits
everywhere offered
card spend
Lead Bank (issuer), Bridge (programme manager), Visa
none stated; 0% international
Virtual card only (Apple Pay in store); daily limit up to 2,000 USD by default. Available where the card is offered (see availability).
everywhere offered
atm
none
n/a
Not available; the cardholder agreement says ATM withdrawals are not available and the support page says the card cannot be used at ATMs.
everywhere offered
bank transfer
not named on the page (Fuse's virtual bank accounts are powered by Bridge)
1 USD ACH or 1 USD SEPA; no Fuse fee
To ACH or SEPA accounts; not for residents of New York or Alaska or of 35 listed countries (incl. CN, CU, IR, KP, RU, UA, KE, SI).
The off-ramp announcement says US and Europe; the support page lists residence-based exclusions instead of an allowlist. Recorded as ALL with the exclusions in limits.
Documented
Fuse Card support page, fees and international use.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
First deployment
Evidenced
2023-03-20 (block 183693695): Squads v4 program SQDS4ep65T869zMMBKyuUq6aD6EgTu8psMjkvj52pCf first deployed on Solana mainnet (slot); Bridge's first card SpendingLimitUse followed on 2025-01-15
The settlement program predates the card; the date recorded is the program's. The first observed card debit by Bridge's key (2025-01-15) dates the card programme onchain. The current bytecode is from the upgrade of 2024-11-20; the program has been immutable since 2024-11-21 (see changes).
Verified
The oldest of the 23 transactions touching programData Fy3YMJCv... is a System createAccount of SQDS4ep... plus BPF upgradeable loader deployWithMaxDataLen (authority HM5y4mz3...), slot 183693695, 2023-03-20 17:14:36 UTC.
Paging getSignaturesForAddress back to the start for Bridge's spender key AE2RGS1h... (49,500 signatures) ends at this SpendingLimitUse + TransferChecked, slot 314054836, 2025-01-15 01:38:07 UTC, fee payer 7kEydiJ9....
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Operating entity
Evidenced
Selimor Investments Limited (d/b/a Squads), VG
Judgment call. Three names appear: Squads Inc. (Fuse Terms counterparty), Squads Labs Inc. (card disclosures) and Selimor Investments Limited d/b/a Squads (Squads Terms and privacy policy, BVI). Selimor is recorded because it is the only one with a stated jurisdiction and the Fuse Terms form part of its terms. The BVI register is not publicly searchable; no register entry was checked.
Documented
Squads Terms (of which the Fuse Terms form part) name Selimor Investments Limited, governed by BVI law; the privacy policy gives 19 Waterfront Drive, Road Town, Tortola.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-12
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Security incidents
Unknown
Absence of a found incident is not evidence that none occurred.
No primary-source incident report found on fusewallet.com (all blog and support pages in the sitemap), the Squads Trust Center, or the Squads-Protocol/v4 repository (README, SECURITY.md). Not recorded as an empty list because these sources would not necessarily disclose an incident.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Product changes affecting users
Evidenced
2024-01-27: Squads v4 program upgraded through its upgrade-authority multisig (3YNUB5PL...). source
2024-10-11: Squads v4 relicensed from BUSL-1.1 to AGPL-3.0 (commit 316913ad, "Open sourced!"). source
2024-11-20: Squads v4 program upgraded to the bytecode now deployed. source
2024-11-21: Upgrade authority set to none; the program is immutable from this slot (302808455). source
2025-01-15: First observed Fuse card debit (SpendingLimitUse) by Bridge's spender key. source
Fuse-side changes (card availability widened from US-only at launch to the 18 countries now listed) are not dated in any first-party page and are not listed.
The programData transaction list holds upgrades at slots 244446274, 297082331 and 302582236 (inner BPF loader upgrade, authority 3YNUB5PL...) and a setAuthority to null at slot 302808455 (2024-11-21 21:45 UTC).
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Volume transacted (verified only)
Unknown
Card debits are observable on Solana: each is a SpendingLimitUse signed by Bridge's key AE2RGS1h... moving USDC out of a Card Account vault (about 49,500 signatures from 2025-01-15 to 2026-10-09). The volume spec takes an EVM chain_id, log topic and contract list only, so no spec can be written for this Solana rail and the figure is not computed.
UnreviewedAssessed by AI research agent (operational), 2026-10-09
Group B: institutional due diligence
Control
State
What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?
Unknown
The Squads Trust Center (trust.squads.xyz) lists one framework, SOC 2 Type 1, and no ISO 27001 certificate. Not recorded as absent because a trust-centre listing is not a certifier search; no certifier directory entry was found for Squads, Bridge or Lead Bank.
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?
Unknown implied from the component list
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?
Attested
Squads Trust Center shows SOC 2 Type 1 as "Compliant" (Type 1, not Type II); no report is published and documents are behind a "Request Access" form. Bridge and Lead Bank reports not found. source 1
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?
Evidenced
The Squads v4 settlement program has ten published audits (OtterSec, Neodyme, Certora, Trail of Bits) pinned to commit 64af733; no audit of the Fuse app, Fuse backend or Bridge card integration is published. CROPS S6
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?
Unknown implied from the component list
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?
Unknown implied from the component list
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?
Evidenced
some of 2 repo(s): Squads-Protocol/v4 ✓ security policy file: SECURITY.md; Squads-Protocol/public-v4-client ✗ no security policy file source 1 · source 2
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?
Attested
A "Vulnerability & Patch Management" policy is listed on the Squads Trust Center; its patch timelines are not public. source 1
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?
Absent
none of 2 repo(s): Squads-Protocol/v4 ✗ no scanning config or workflow step found; Squads-Protocol/public-v4-client ✗ no scanning config or workflow step found source 1 · source 2
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?
Attested
An "Incident Response & Breach Notification" policy is listed on the Squads Trust Center; no notification deadline is published in it, the Fuse Terms, the Squads Terms or the privacy policy. source 1
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?
Unknown implied from the component list
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?
Attested
A "Disaster Recovery Policy" is listed on the Squads Trust Center (text on request). For the user's funds, the walkaway path is the onchain withdrawal from the Card Account (CROPS S4). source 1 CROPS S4
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?
Unknown
No status page or post-mortem found on fusewallet.com (sitemap read in full), squads.xyz or trust.squads.xyz; status.squads.so did not resolve.
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?
Evidenced
Every Fuse wallet has a Device Key (Face ID) and a 2FA Key (iCloud, or a Ledger); the threshold is 1-of-2 until a Recovery Key is added, then 2-of-n, so a second factor is mandatory only after onboarding completes. Card controls (freeze, limit) sit in the same app. source 1 · source 2
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?
Unknown implied from the component list
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?
Unknown implied from the component list
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?
Unknown implied from the component list
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?
Unknown implied from the component list
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?
Unknown implied from the component list
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?
Unknown implied from the component list
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?
Unknown implied from the component list
B5.4 Export controls If an API exports data, does it limit volumes and log exports?
Unknown implied from the component list
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?
Unknown implied from the component list
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?
Unknown implied from the component list
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?
Evidenced
Squads keeps personal information for as long as the user uses the Services or as needed for stated purposes (disputes, audits, legal defence); no fixed period and no deletion-on-termination commitment. KYC data is also held by Bridge and Lead Bank under their own policies (not read). source 1
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?
Evidenced
Selimor Investments Limited d/b/a Squads (BVI) is named as the party processing personal information; Bridge and Lead Bank are named as financial-services partners that collect KYC data. The policy does not use controller/processor terms; no DPIA statement found. source 1
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?
Unknown implied from the component list
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?
Unknown implied from the component list
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?
Unknown implied from the component list
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?
Unknown implied from the component list
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?
Evidenced
some of 2 repo(s): Squads-Protocol/v4 ✗ no deployment configuration; Squads-Protocol/public-v4-client ✓ deployment configuration: Dockerfile source 1 · source 2
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?
Evidenced
some of 2 repo(s): Squads-Protocol/v4 ✗ no branch rules visible (classic branch protection is not readable without push access); Squads-Protocol/public-v4-client ✓ rules: deletion, non_fast_forward, pull_request source 1 · source 2
B9.2 CI runs on pull requests Does every pull request trigger automated checks?
Evidenced
some of 2 repo(s): Squads-Protocol/v4 ✓ 5 workflow file(s); Squads-Protocol/public-v4-client ✗ 1 workflow file(s) source 1 · source 2
B9.3 Tests run in CI Do the CI workflows run the test suite?
Evidenced
some of 2 repo(s): Squads-Protocol/v4 ✓ test command in a workflow; Squads-Protocol/public-v4-client ✗ test command in a workflow source 1 · source 2
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?
Evidenced
all of 2 repo(s): Squads-Protocol/v4 ✓ 9 of 10 recent commits signed; Squads-Protocol/public-v4-client ✓ 10 of 10 recent commits signed source 1 · source 2
B9.7 Changelog Is a changelog maintained with the code?
Evidenced
some of 2 repo(s): Squads-Protocol/v4 ✗ no changelog or release notes; Squads-Protocol/public-v4-client ✓ CHANGELOG file source 1 · source 2
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?
Evidenced
some of 2 repo(s): Squads-Protocol/v4 ✗ none found; Squads-Protocol/public-v4-client ✓ contribution section in README source 1 · source 2
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?
Evidenced
Logical view only: Fuse posts describe the Main Account (Squads v4 multisig with Device, 2FA and Recovery keys), the separate Card Account with the Main Account as sole signer, and Bridge's daily Spending Limit. No infrastructure or integration architecture is published. source 1
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?
Evidenced
Three parties: Squads Inc. under the Fuse Wallet and Card Terms (which form part of the Squads Terms with Selimor Investments Limited, BVI law); Lead Bank (Missouri) as card issuer under the cardholder agreement; Bridge Ventures LLC as programme manager. No company-register entry was checked for the Squads entities. source 1 · source 2
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?
Unknown implied from the component list
B11.3 Termination terms What happens to customer funds and data on termination by either side?
Evidenced
On card closure the remaining balance is returned as stablecoin to the user's Fuse wallet at no fee, but the bank may refuse to return balances under 1 USD. Squads may end the platform agreement without reason on 30 days' notice, or sooner where regulators, third parties or risk require. Funds outside the card stay in the user's own Squads accounts. source 1 · source 2
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?
Unknown implied from the component list
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?
"Fuse Card" here is Squads' Fuse wallet card (fusewallet.com), not a Fuse Network (chain 122) product. A Fuse Network blog post announces a different card (Solid Card); no Fuse Card document mentions chain 122. Solana reads were taken through api.mainnet-beta.solana.com at slots 454199060-454202586, and the Bridge spender key was identified by getProgramAccounts over v4 SpendingLimit accounts with the USDC mint. Fuse's app and backend are closed, so O4, P5 and S5 are unknown. Card Map was used only to identify the product.
