Unaudited, unvetted, experimental. Do not use as a reference. AI-researched ratings that may be wrong; not advice or a statement of fact about any provider. Full disclaimer
Pending review. 1150 of 1150 ratings not yet checked by a human. Do not rely on unreviewed ratings.
Incumbent rails have no public chain settlement and no public code. They are scored with the same rubric as every other row. Their low ratings show the verifiability gap between rails whose behaviour can be inspected and rails whose behaviour must be trusted; that gap is the point of the comparison, not a claim that the incumbent is unsafe.
No first-party country statement is on file for this provider. See the Countries index.
Censorship Resistance
Who can block valid use, and can users route around them?
0 FailsPillar rating: weakest of 5 0 of 5 Partial or better · 1 no evidence
What would raise this pillar
Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
HesabPay can suspend or terminate individual accounts, including on government order, and the terms state no notice period or appeal path. There are no settlement contracts; the role holder is HesabPay itself. Judgment call: anchor 0 ("can target individual addresses with no notice") applied to account-level suspension in a custodial ledger.
Evidence (1)1 documented
Documented
Terms and Conditions (effective 2026-04-06) s5.1: failure to provide government ID 'may result in account suspension or termination'; s7 lists termination grounds including 'Court or government orders mandating termination'. No notice period is stated.
Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer? C2
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Settlement is a book entry on HesabPay's custodial ledger. The terms describe no path for a payer or payee to settle without HesabPay's app, USSD service, or API.
Evidence (1)1 documented
Documented
Terms s2.3: 'HesabPay functions as a custodial wallet service that holds user funds at a 1:1 ratio in the banking system'; s3.1 transfers run between HesabPay accounts, bank accounts, or cash-out agents.
Does the payment flow require a relayer, paymaster, bundler, or API that only the provider runs? C3
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Every payment flow requires HesabPay's hosted services. No intermediary code is public (see notes for the search), so the dependency is closed and single-vendor.
Evidence (1)1 documented
Documented
Terms s1.2, s2.7, s2.8: every listed flow (app, USSD *580#, HesabPOS, REST API and WooCommerce plugins at developers.hesab.com) runs through HesabPay-operated services; s6 reserves all IP to HesabPay, Inc.
Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
HesabPay discloses, in its terms and privacy policy only, that it monitors transactions for AML and fraud, applies jurisdiction-based limits, and terminates accounts on court or government order. It names no screening list. There is no separate settlement layer: filtering and settlement both happen in HesabPay's closed ledger, so the neutrality of settlement cannot be shown from code, and no direct path bypasses the filtering (C2 = 0). Judgment call: anchor 1 ("edge filtering disclosed in docs only, or the neutrality of the settlement layer cannot be shown from code") rather than 0, because the filtering read is disclosed and nothing read shows undisclosed filtering; the ledger is closed, so undisclosed filtering cannot be ruled out either, and a trace or internal document showing it would lower this to 0. Documented tier caps the cell at 1.
Evidence (2)2 documented
Documented
Privacy Policy s2 'Identity Verification': data is used for KYC and AML compliance 'as required by Da Afghanistan Bank and applicable laws'; s4.2 lists automated fraud detection and real-time transaction monitoring.
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Documented
Terms s7 lists 'Court or government orders mandating termination' as a termination ground; s3.1 says transaction limits may apply based on jurisdictional regulations; s5.2 says suspicious activities are referred to the authorities.
Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No part of the stack is public. GitHub searches found no HesabPay-owned organisation or repository (search log in docs/research/hesabpay.md), and the terms reserve all IP.
Evidence (1)1 documented
Documented
Terms s6: all intellectual property in the application and website is owned by HesabPay, Inc.; users get 'a limited, non-transferable license for personal, authorized use'.
Are ABIs, event schemas, an API schema, and a payee data export in a non-proprietary format all in the repo? O4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
A REST API and a statement export are documented. Nothing is versioned in a public repo, and the export format is not named. Judgment call: the API reference at developers.hesab.com is a client-rendered app whose docs routes appear to sit behind login, so this score rests on the terms and policy text, not on a published API schema.
Evidence (2)2 documented
Documented
Terms s2.8: 'HesabPay provides RESTful APIs, WooCommerce/WordPress plugins, and split payment capabilities', governed by a Developer Agreement at developers.hesab.com; s2.2 statements are downloadable.
Does every repository needed to run the product carry an OSI-approved license? F1
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The product is proprietary. No public repository exists, and the only license offered is a limited, non-transferable use license, so a third party cannot fork or run it.
Evidence (1)1 documented
Documented
Terms s6: 'Users are granted a limited, non-transferable license for personal, authorized use. Unauthorized use is strictly prohibited.'
Do the SDK, widget, or frontend ship analytics, telemetry, error reporting, or fingerprinting? P1
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Google Analytics loads by default on hesab.com and the privacy policy discloses analytics in general terms without naming Google. Google reCAPTCHA also loads on the page and is not named in the policy. The mobile app and web.hesab.com were not inspected at a pinned source, so the score covers the website plus the policy. Judgment call: 1 (present, on by default, disclosed) rather than 0, because analytics collection is disclosed even though the vendor is not named.
Evidence (2)2 documented
Documented
Reproduction: curl -sL https://hesab.com | grep -o 'googletagmanager.com/gtag/js?id=[A-Z0-9-]*' returns G-GMHMD0CKK3 (Google Analytics, loaded unconditionally); the same page preloads google.com/recaptcha/api.js. Run 2026-10-07.
Privacy Policy s6: the website uses 'analytics cookies to understand visitor behavior'; s1.2 lists automatically collected device identifiers, IP address and app usage patterns.
Does the flow collect anything beyond addresses, amounts, token, and chain? P2
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
KYC collection (name, date of birth, national ID or passport) is disclosed in the privacy policy with a stated legal basis (Da Afghanistan Bank KYC/AML rules); on its own that would score 1, since the basis is disclosed in a policy, not in code or a versioned repo document. But the same policy discloses automatic collection of app usage data (features accessed, transaction frequency, session duration) for product improvement, which goes beyond the stated legal requirement, and the updated anchor 0 covers "collection beyond the stated legal requirement". Score lowered from 1 to 0 on HesabPay's own policy text. Judgment call: usage data is read as collection by the payment flow because the policy ties it to the app that runs payments; device and location data for fraud prevention and the agent finder were not counted against the score.
Evidence (3)3 documented
Documented
Privacy Policy s1.1: registration collects full name, phone, email, date of birth, and national ID or passport for KYC; s1.2 collects device identifiers, IP, usage data and location; s1.3 adds data from identity-verification services and government databases. s2 states the KYC basis: AML/KYC regulations 'as required by Da Afghanistan Bank and applicable laws'.
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Documented
Privacy Policy s1.2 'Usage Data': app usage patterns, features accessed, transaction frequency, session duration and interaction with notifications are collected automatically; s2 'Improvement' uses them to improve app performance and develop new features, a purpose with no stated legal basis.
Which third parties see a request during a payment, and can they be swapped out? P4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Third parties see transaction data and are disclosed only in the policy. Most are named by category, a few by name. Nothing shows whether they can be swapped.
Evidence (1)1 documented
Documented
Privacy Policy s3 names recipients: banking partners, card networks (Visa, Mastercard, American Express), payment processors, Duffel and other booking/delivery partners, AI language-model providers, regulators, and agents/merchants.
Who holds funds between payer and payee, and can the provider redirect them? S1
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
HesabPay holds funds in flight and at rest, and the terms disclose this. The terms limit HesabPay's use of those funds to cases with user consent; no onchain artifact confirms this.
Evidence (1)1 documented
Documented
Terms s2.3: custodial wallet holding user funds 1:1 in the banking system; HesabPay 'does not invest, transfer, or use your funds ... without your explicit consent'; s3.4 reversals are run by HesabPay's team with recipient consent.
If the provider disappears tomorrow, do payees keep their funds and the ability to keep settling? S4
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Derived. S1 = 1 (provider custody), C2 = 0 (no direct settlement), C3 = 0 (closed single-vendor services), O3 unknown (no public code to self-host). If HesabPay stopped operating, both funds and the ability to settle would depend on HesabPay and its partner banks.
Evidence (1)1 documented
Documented
Terms s2.3 (custodial wallet) and s3.1 (all transfers via HesabPay accounts, banks or agents); no exit path independent of HesabPay is described.
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6
? No evidence
Sets the pillar rating
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No checkable evidence settles this yet, so it counts as 0.
Security audits 0
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
No published audit report was found.
Compiled from: hesab.com (home, privacy policy, terms, help and docs pages; the privacy policy mentions "blockchain-secured" fraud detection but names no audit), developers.hesab.com, web searches for HesabPay security audits, penetration tests and certifications, and GitHub. No published code audit, penetration test or SOC/ISO report was found. HesabPay is a closed custodial ledger with no public contract or repository in the payment path. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.
Operational and procurement
Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.
Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 7 evidenced, 1 attested, 0 absent, 0 not applicable, 37 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.
Terms s4.1; HesabPay may adjust with reasonable notice.
card
payer
no issuance, periodic, 3DS or SMS fee on the Visa Card
HesabPay Visa Card FAQ.
fx
payer
about 1% when converting AFN to USD for card use
HesabPay Visa Card FAQ; terms s1.4 says card currency exchange is at Da Afghanistan Bank rates.
limit
none
Visa Card 20,000 AFN per week, 80,000 AFN per month
HesabPay Visa Card FAQ, which says these limits are set by the Central Bank.
No published tariff for transfers, E-Hawala cash-out or agent cash-in was found on hesab.com (sitemap read 2026-10-09; /fees and /pricing return 404). Those components are unknown, not zero.
Documented
Terms and Conditions (effective 2026-04-06) s4.1 Monthly Maintenance Charges; s2.2 says statements carry no fee.
The terms and privacy policy name HesabPay, Inc. (Delaware) as the contracting party. Neither document states how it relates to the licensee Zinzir Ltd. HesabPay's September 2026 security post says the official app is published under the Zinzir Ltd. brand. No US money-transmitter licence was looked for.
Documented
Da Afghanistan Bank list of licensed electronic money institutions: HesabPay, Name of EMI: Zinzir Ltd, license No: EMI101005, License Date: 5 June 2023, website https://hesab.com/.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
Terms s1.4 HesabPay Visa Card. HesabPay's July 2026 announcement describes the card as virtual, so ATM use may depend on a physical card or a wallet-enabled ATM; this was not checked.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
First deployment
Unknown
No primary source dating the service launch was found. HesabPay's own July 2026 press release says Hesab was founded in 2018 (company, not service). The Da Afghanistan Bank EMI licence is dated 5 June 2023 (see changes).
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Operating entity
Evidenced
HesabPay, Inc., US-DE
The Delaware company register was not read (its entity search sits behind a challenge page, which was not bypassed), so no registration number is recorded. The licensed entity in Afghanistan is Zinzir Ltd (see licences).
Documented
Privacy Policy s8; terms s9 put the agreement under Delaware law; contact address 2093 Philadelphia Pike, Claymont, DE.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Security incidents
Unknown
Absence of a found incident is not evidence that none occurred.
No primary-source incident notice was found on hesab.com (sitemap and blog read 2026-10-09). HesabPay's 2026-09-01 security post warns about phishing and tampered APKs but reports no incident. No status page found.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Product changes affecting users
Evidenced
2023-06-05: Da Afghanistan Bank EMI licence EMI101005 granted to Zinzir Ltd (HesabPay). source
2026-07-24: HesabPay announced the launch of Visa virtual cards in Afghanistan (own press release). source
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Volume transacted (verified only)
Not verifiable
Closed custodial ledger. HesabPay describes using Algorand, but no HesabPay document links a settlement address or asset, so nothing can be read and attributed from a chain. Reported figures are not recorded.
UnreviewedAssessed by AI research agent (operational), 2026-10-09
Group B: institutional due diligence
Control
State
What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?
Unknown
No ISO 27001 statement or certificate found on hesab.com, the terms or the privacy policy.
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?
Unknown
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?
Unknown
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?
Unknown
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?
Attested
The privacy policy states regular security audits and penetration testing; no report, date or tester is named. source 1
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?
Unknown
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?
Unknown implied from the component list
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?
Unknown
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?
Unknown implied from the component list
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?
Unknown
The privacy policy commits to notify users of material policy changes, not of incidents.
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?
Unknown
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?
Unknown
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?
Unknown
No status page linked from hesab.com.
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?
Evidenced
The policy states multi-factor authentication for account access and high-value transactions; the September 2026 security post refers to PIN and OTP. source 1
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?
Unknown
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?
Unknown
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?
Unknown
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?
Unknown
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?
Unknown
The API reference at developers.hesab.com is a client-rendered app whose docs routes need a login; its public bundle shows no auth scheme.
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?
Unknown
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?
Unknown
B5.4 Export controls If an API exports data, does it limit volumes and log exports?
Unknown
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?
Evidenced
Policy states encryption at rest and in transit. Observed: hesab.com refuses TLS 1.1 and accepts TLS 1.2. No data classification found. source 1 · source 2
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?
Unknown
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?
Evidenced
Personal data kept while the account is active or as needed; transaction records at least 5 years; account deletion on request except where law requires retention. source 1
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?
Unknown
The privacy policy speaks as HesabPay, Inc. but does not use controller or processor terms, and no DPIA is mentioned.
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?
Unknown
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?
Unknown
The policy describes "blockchain-secured audit trails" for transaction records; no account-change or login logging statement was found.
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?
Unknown
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?
Unknown
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?
Unknown implied from the component list
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?
Unknown implied from the component list
B9.2 CI runs on pull requests Does every pull request trigger automated checks?
Unknown implied from the component list
B9.3 Tests run in CI Do the CI workflows run the test suite?
Unknown implied from the component list
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?
Unknown implied from the component list
B9.5 Versioned releases Are releases tagged with immutable semantic versions?
Unknown implied from the component list
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?
Unknown implied from the component list
B9.7 Changelog Is a changelog maintained with the code?
Unknown implied from the component list
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?
Unknown implied from the component list
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?
Unknown
No public architecture document found; developer docs need a login.
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?
Evidenced
HesabPay, Inc. (Delaware, US), per the terms; Delaware law governs. Licensee in Afghanistan is Zinzir Ltd. source 1
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?
Evidenced
Customer fees (monthly maintenance charges, card FX); no other funding source was read. source 1
B11.3 Termination terms What happens to customer funds and data on termination by either side?
Evidenced
Terms list termination grounds (fraud, breach, unregistered phone, court or government order) with no notice period and no statement of what happens to balances on termination; s2.3 says funds can be withdrawn at any time. source 1
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?
Evidenced
Yes: the Ask HesabPay AI assistant initiates transactions from natural-language commands (standard authentication still applies), and inputs go to third-party language-model providers. The policy also states automated fraud detection and real-time transaction monitoring. source 1
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?
Unknown
The policy says AI inputs are not used to train third-party models; no monitoring, override or bias-evaluation documentation found.
Scope of assessment
Components in the payment path
Component
Role
Public
Licence
Operator
Required
HesabPay custodial wallet ledger and transaction backend
ledger
No
proprietary
HesabPay
Yes
Partner banks holding customer funds 1:1 (not named in sources read)
other
No
proprietary
Licensed partner banks
No
HesabPay mobile app
wallet
No
proprietary
HesabPay
No
USSD *580# service
frontend
No
proprietary
HesabPay
No
web.hesab.com web wallet and enterprise web platform
frontend
No
proprietary
HesabPay
No
Merchant REST API (api.hesab.com) and developer portal (developers.hesab.com)
api
No
proprietary
HesabPay
No
HesabPOS terminals and mPOS devices
other
No
proprietary
HesabPay
No
Identity verification (KYC) via verification services and government databases
kyc
No
proprietary
HesabPay and unnamed identity verification services
No
HesabPay Visa Card (issued with partner banks)
card-issuer
No
proprietary
Licensed partner banks (not named in sources read)
No
Visa card network
card-network
No
proprietary
Visa
No
Cash-out agent network (1,200+ agents per terms s2.4)
other
No
proprietary
HesabPay agents
No
Repositories
None found. Absence of public code is itself a finding.
Contracts
None listed.
Assessor notes
Eligibility: no public repository owned by HesabPay and no verified contract found, so type is incumbent. Searched 2026-10-07: gh search repos hesabpay / hesab; gh search code hesabpay; GitHub users/orgs hesabpay, HesabPay, hesab-pay, hesabpay-official, hesabpayglobal (all 404) and user search "hesabpay" (two unrelated accounts: HesabPayZinzir with 0 repos, habib-studio). Every hesabpay repo found is a third-party merchant integration (WooCommerce, Laravel, Django, Flutter) calling HesabPay's hosted API, not code needed to run the product. Blockscout search "hesab" on Ethereum returned nothing; hesab.com, its privacy policy, terms and the developer-portal bundle contain no EVM address or contract reference. hesabpay.com returns a Cloudflare 403 to non-browser clients; the operating site is hesab.com, which the privacy policy names as the website. HesabPay is described on hesab.com and in an Algorand Foundation case study (claimed tier) as running on Algorand. Algorand ASAs named "HesabPay" exist (e.g. 1258542524, 3561304383) whose self-asserted url field points at hesab.com, but no HesabPay document links to them, ASAs carry no verifiable source, and the schema does not represent Algorand; they are logged in docs/research/hesabpay.md and not used. Scores rest on the terms and privacy policy (documented tier, cap 1) and one reproducible page fetch.
