Unaudited, unvetted, experimental. Do not use as a reference. AI-researched ratings that may be wrong; not advice or a statement of fact about any provider. Full disclaimer
Pending review. 1150 of 1150 ratings not yet checked by a human. Do not rely on unreviewed ratings.
Incumbent rails have no public chain settlement and no public code. They are scored with the same rubric as every other row. Their low ratings show the verifiability gap between rails whose behaviour can be inspected and rails whose behaviour must be trusted; that gap is the point of the comparison, not a claim that the incumbent is unsafe.
Offered everywhere except the countries listed. Checked 2026-10-09. Not scored.
The hyperbeat.org Terms (which cover the Pay Service, i.e. the card) bar nationals and residents of Cuba, Iran, North Korea, Sudan and Syria "or any other country subject to United States embargo", UN Security Council resolutions or HM Treasury sanctions; only the five named countries are listed here. The Terms also exclude residents of Ontario, Canada, and say geo-blocking may be used. US residents and citizens may use the Pay Service subject to a separate "Hyperbeat Pay Cardholder Agreement (U.S.)", which is not published, so any US state limits are unknown. The longer country list in the Terms applies only to Beatpot, a different service, and is not used here. The Pay web app bundle contains no country gate that I could find.
Conversion. The token is sold for fiat when a payment is authorised.
Platform token. Issued by the provider or its own ecosystem. Its value and liquidity depend on that provider, which may also control supply.
Fiat-backed stablecoin. An issuer holds the reserves and can freeze balances at the token contract. Value depends on the issuer redeeming at par. Censorship Resistance records whether that freeze power is disclosed.
Cards spend from the user's ManagementAccount on HyperEVM. In Cash mode the account holds the settlement token and the Hyperbeat Operator calls settle() to deduct each card amount; in Credit mode the Operator borrows the settlement token from Morpho or Aave against the user's deposited collateral, which is not itself spent. The architecture doc names the settlement token only by example ("beatUSD or USDC"), enforced by a TokenWhitelistRegistry whose contents were not read, so no default is marked. Hyperbeat's Pay app bundle displays beatUSD ("Hyperbeat USD", onchain name) to the user as their "USD" balance, which suggests beatUSD is the usual spending balance. beatUSD is Hyperbeat's own dollar token; its reserves or backing are not documented in the sources read (the bundle mentions a BeatUSD Teller for USDC withdrawals via Paxos). The docs' Hyperbeat Pay page also says users can spend USDC/USDT; how USDT is handled is not stated.
Checked 2026-10-12
Evidence (4)1 verified · 3 documented
Verified
name() returns "Hyperbeat USD", symbol() "beatUSD", decimals() 6 on HyperEVM (eth_call via https://rpc.hyperliquid.xyz/evm).
The TokenWhitelistRegistry enforces the specific stablecoin used for card settlements, given as "e.g., beatUSD or USDC"; in Cash mode the user holds that settlement token in the ManagementAccount.
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Documented
Hyperbeat Pay's own app bundle configures beatUSD (0x669abe85...) and USDC (0xb88339CB...) on HyperEVM and maps beatUSD to the "USD" balance shown to the user.
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Censorship Resistance
Who can block valid use, and can users route around them?
0 FailsPillar rating: weakest of 5 0 of 5 Partial or better · 1 no evidence
What would raise this pillar
Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Hyperbeat can block an individual user's access to the card and Platform with no stated notice. The settlement and operator contracts are not verified, so who holds any onchain pause or role cannot be read. Judgment call: documented per-account blocking with no notice meets anchor 0.
Evidence (1)1 documented
Documented
Terms of Use (updated 1 Mar 2026) let the Company suspend or block access, for a period or indefinitely, on a breach finding; no notice period is stated.
Does the deployed bytecode match public source, and can a third party rebuild it? O1
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Hyperbeat Pay's contracts are deployed but not verified on HyperEVMScan or Sourcify, and the audited Liquid-Bank repository is private. Unverified, so 0. Judgment call: the provider has contracts, so O1 is scored rather than left unknown.
Evidence (2)1 verified · 1 documented
Verified
The Operator contract named in Hyperbeat's own Pay dapp bundle (OPERATOR in chunk 97b00ce1712acb99.js) has 11107 bytes of code on HyperEVM, shows "Verify and Publish" (unverified) on HyperEVMScan, and has no Sourcify match; MORPHO_SERVICE 0xb90759Ff..., MORPHO_REPAY_SERVICE 0xb4a03802... and WRAPPER_SERVICE 0x4c70eCA9... are likewise unverified.
Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No part of the card stack is public: contracts unverified, Liquid-Bank repo private, app and backend closed. 0.
Evidence (1)1 verified
Verified
The only Hyperbeat-owned non-fork repo is Audits (PDFs only); the Zellic report's scope names github.com/0xhyperbeat/Liquid-Bank at 431de44b, which returns 404 (private).
Do the SDK, widget, or frontend ship analytics, telemetry, error reporting, or fingerprinting? P1
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The Pay web app ships Google Ads tagging, Datadog browser monitoring and Intercom. The privacy policy mentions analytics providers only as a category and does not disclose advertising tags. Judgment call: present and not specifically disclosed, so 0. No network trace was run; this rests on the served page and bundles.
Evidence (2)2 documented
Documented
The Pay dapp page loads a Google Ads tag (AW-17122504444) after interaction, and its bundles include the Datadog browser SDK and Intercom.
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Documented
The Privacy Policy lists categories of processors (including "data analytics service providers") but names no analytics or advertising vendor and does not mention Google tags.
Which third parties see a request during a payment, and can they be swapped out? P4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Third parties (Turnkey, KYC provider, card issuer, Visa, analytics) are in the flow and disclosed only partly, in documents. Judgment call: 1, because the main ones are disclosed by name or category; the unnamed issuer keeps it from anything higher.
Evidence (1)1 documented
Documented
Docs name Turnkey; the privacy policy names processor categories (KYC, analytics, hosting); the card issuer is not named.
Who holds funds between payer and payee, and can the provider redirect them? S1
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Per the docs, funds sit in an upgradeable smart account the user owns, with the Operator able to settle up to a spending limit and to gate settlement-token and collateral withdrawals. Upgradeable escrow-like account, disclosed: 1 (documented cap). The contracts are unverified, so none of this can be checked.
Evidence (1)1 documented
Documented
Docs say assets sit in a user-owned UUPS-upgradeable ManagementAccount; the Operator settles up to a user-set limit, and withdrawing the settlement token needs Operator approval.
Who can change the contract code, and with how much notice? S2
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Every account is upgradeable and the upgrade authority is undisclosed (and unverifiable, since the contracts are unverified). Undisclosed proxy admin, so 0.
Evidence (1)1 documented
Documented
Docs say accounts are UUPS proxies upgradeable by an UPGRADER_ROLE limited to factory-whitelisted implementations; the role holder and any timelock are not disclosed.
How large an allowance does the SDK ask users to grant, and for how long? S3
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
A user-set spending limit bounds what the Operator can settle, per the docs. Judgment call: bounded allowance would be 2, but documented-only evidence caps at 1.
Evidence (1)1 documented
Documented
Docs say the Operator settles from the account up to a spending limit the user sets.
If the provider disappears tomorrow, do payees keep their funds and the ability to keep settling? S4
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
S1 documented only, C2 = 0, C3 = 0, O3 = 0. Per the docs, withdrawing the settlement token or collateral needs the Operator, so funds depend on Hyperbeat's liveness. 0.
Evidence (1)1 documented
Documented
Settlement-token and collateral withdrawals need Operator approval per the docs.
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Two audit reports are public and pin commits, but the audited repo is private and the deployed contracts are unverified, so neither the audited commit nor the fixes can be matched to what runs. No bug bounty found. Judgment call: audit report only, so 1.
Evidence (1)1 verified
Verified
Zellic "Hyperbeat Pay Smart Contract Security Assessment" (6 Nov 2025) scopes Liquid-Bank at 431de44b (1 critical, 3 medium, 7 low); Nethermind NM-0697 (Management Account) lists fix commits such as d527b144 and 8489657e.
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
Hyperbeat Pay Management Account (NM-0697): ManagementAccount, ManagementAccountFactory, MorphoService, ServiceRegistry, TokenWhitelistRegistry and libraries (1785 lines of Solidity) at 33f200c Initial report 25 November 2025 on commit 09e970; 33f200c is the final commit. The audited Liquid-Bank repo is private and the deployed contracts are unverified on HyperEVMScan and Sourcify, so the audited code could not be matched to the deployment.
Hyperbeat Pay smart contracts in Liquid-Bank: ManagementAccount, ManagementAccountFactory, ManagementAccountStorage, ManagementAccountLib, MorphoService, ServiceRegistry, TokenWhitelistRegistry at 431de44bc3 Review window 24-31 October 2025. The Liquid-Bank repo returns 404 (private) and the deployed contracts are unverified, so neither the audited commit nor the fixes can be matched to what runs.
Shared component (credit mode only): Morpho Blue core lending contract, public competition Competition ran 16 November to 7 December 2023. Morpho Blue is used only when a user borrows in Credit mode; the Morpho deployment on HyperEVM was not compared with the audited code.
Shared component (credit mode only): Morpho Blue core lending contract, managed review Review ran 28 September to 16 October 2023 on commit 11e69b...810c53 (abbreviated in the report).
Shared component (credit mode only): Morpho Blue core lending contract and the Speed Jump IRM The PDF's text is encrypted and could not be extracted, so findings are not summarised here.
Unknown
Compiled from: github.com/0xhyperbeat/Audits (folders liquid-bank, BeatPot, USD+, Vault-Infra, Vaults-Solver, Withdrawal-Queue, beHYPE), docs.hyperbeat.org audits page, and the audits/ folder of github.com/morpho-org/morpho-blue for the credit-mode Morpho dependency. Only the liquid-bank reports cover the Hyperbeat Pay card path; the other folders cover Hyperbeat vaults, staking and BeatPot and are not listed (any of them may relate to the beatUSD settlement token, which is context only). No audit of the Hyperbeat Operator backend or the Pay app was found. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.
Operational and procurement
Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.
Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 12 evidenced, 0 attested, 0 absent, 0 not applicable, 33 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.
Group A: operational facts
Fees
Evidenced
Component
Paid by
Amount
Basis
card
none
Virtual cards free (up to 20 active)
Help article 16086494; physical card fee not published.
fx
payer
0.4% to 1% on foreign-currency purchases (Visa rate)
Help article 12674592; merchant DCC and surcharges are extra.
cashout
payer
ATM: 1 USD + 0.65% per withdrawal; 0.60 USD per balance inquiry or decline; plus ATM operator fees
Help articles 12674592 and 12898397; physical card only.
cashout
payer
Fiat withdrawal: fixed + variable per currency, e.g. USD ACH 0.25 USD + 0.12%, EUR 1 EUR + 0.20%, GBP 1 GBP + 0.25%
Help article 14107075 (24 August 2026); processed by Noah.
provider
payer
Platform Fee on transactions, amount not published in the Terms; Credit Mode borrowing at a variable APR shown in app
Terms of Use, Payment, Gas Fees and Taxes; the Company may change the Platform Fee at any time.
limit
none
100,000 USD default monthly spending limit; ATM 250 USD per transaction, 3 per day
Help articles 12674592 and 12898397.
Fiat deposits cost 0.12% + 0.25 USD (ACH) to 0.12% + 35 USD (SWIFT) and 0.2% + 1 EUR (SEPA) (help article 14107006). No card purchase fee is published; the Hyperbeat Pay Cardholder Agreement, where card fees would be set, is not public. Gas for Operator settlement is not described as a user fee.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Custody model
Evidenced
Hybrid: self-custody with a provider-controlled spend path
Per the architecture docs (S1 finding), funds sit in a user-owned, upgradeable ManagementAccount, but Hyperbeat's Operator settles card spends up to a user-set limit and must approve settlement-token and collateral withdrawals. Hyperbeat's help centre says it cannot move, freeze or lock funds; that provider claim conflicts with the docs and is not used for the value.
Card issuer under licence from Visa (as stated in Hyperbeat's Terms) Issues the Hyperbeat Pay card; does not extend credit (credit comes from onchain lending markets)
No licence held by Zoeion Ltd Corporation was found or claimed. Not found in a register: an active FDIC-insured institution named Third National (FDIC BankFind search, 2026-10-09). Noah, which processes fiat deposits and withdrawals, is named without a licence. The help centre says availability depends on licensing and partner rails without naming licences.
Documented
Terms of Use, Card clause (the same clause also refers to "Ether.Fi protocol", apparently copied from another programme's terms).
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Cash-out options
Evidenced
Where
Method
Partner
Fee
Limits
everywhere offered
card spend
Third National (issuer), Visa
FX 0.4% to 1%; no purchase fee published
100,000 USD default monthly; Cash Mode spends the USD balance, Credit Mode borrows against collateral up to the Spending Cap.
everywhere offered
atm
Third National (issuer), Visa
1 USD + 0.65%; 0.60 USD per inquiry or decline
Physical card only; 250 USD per transaction, 3 per day; not allowed in North Korea, Iran or Myanmar.
everywhere offered
bank transfer
Noah
Fixed + variable per currency (e.g. USD ACH 0.25 USD + 0.12%)
15 payout currencies available (USD, EUR, GBP, AED, AUD, BRL, IDR, MYR, NGN, PLN, THB, TRY, VND, PHP, ZAR); limits per channel shown in app; third-party recipients allowed.
ALL means every country not blocked in the provider file's availability (blocklist of five embargoed countries). Narrower first-party lists exist: help article 13512812 lists supported card jurisdictions (about 50 countries, "Europe" and 35 US states), and help article 16199140 lists countries per virtual bank account; neither is reflected row by row here. The withdrawal-currency article says 13 currencies in its summary but marks 15 as available.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
First deployment
Evidenced
2026-04-08: Liquid Banking (account, Hyperbeat Pay card and credit) announced as live in Hyperbeat's newsroom.
The card predates this announcement - help-centre card articles are dated from 15 January 2026, the Zellic audit of Hyperbeat Pay is dated 6 November 2025, and the privacy policy from 21 August 2025 - but no dated first launch of the card was found. The Operator contract's deployment block could not be read (HyperEVM public RPC ignores the block parameter for eth_getCode; contracts unverified).
Documented
Newsroom post "Introducing Liquid Banking", dated 8 April 2026.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Security incidents
Unknown
Absence of a found incident is not evidence that none occurred.
No incident report found in the Hyperbeat newsroom, docs or help centre, and there is no status page. The Zellic audit's critical finding was pre-deployment and is covered by CROPS S6, not recorded as an incident. Searched 2026-10-09.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Product changes affecting users
Evidenced
2025-08-21: Privacy Policy (Zoeion Ltd Corporation, Panama) last updated. source
2026-03-01: Terms of Use last updated, covering the Pay Service and naming Third National as card issuer. source
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Volume transacted (verified only)
Not verifiable
No listed contracts. Card settlement runs through Hyperbeat's Operator and a batchSettle contract on HyperEVM that are unverified and not attributed in any Hyperbeat publication (provider file notes), so no spec over listed settlement contracts can be written.
UnreviewedAssessed by AI research agent (operational), 2026-10-09
Group B: institutional due diligence
Control
State
What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?
Unknown
No ISO 27001 statement for Hyperbeat or Zoeion Ltd Corporation found on hyperbeat.org (terms, privacy), docs.hyperbeat.org or the 87 help articles at help.hyperbeat.org. The help centre's KYC article lists ISO 27001, ISO 27017/27018, SOC 2 Type II and PCI DSS for Sumsub, the KYC processor only.
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?
Unknown
Same search as B1.1; the hosting of the Pay backend is not stated.
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?
Unknown
No SOC 2 or ISAE 3402 statement for Hyperbeat found (only for Sumsub, see B1.1).
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?
Evidenced
Two smart-contract audits of the Liquid Bank contracts are public (Zellic, 6 November 2025, 1 critical, 3 medium, 7 low; Nethermind NM-0697 on the Management Account). The audited repository is private and the deployed contracts are unverified, so the audited code cannot be matched to what runs; no review of the closed backend or app found. CROPS S6
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?
Unknown
No penetration-test report or bug bounty found; hyperbeat.org/.well-known/security.txt returns 404.
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?
Unknown
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?
Unknown implied from the component list
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?
Unknown
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?
Unknown implied from the component list
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?
Unknown
The privacy policy lists "notice of a personal data breach (unless the breach is unlikely to be prejudicial to you)" among data subject rights, without a time limit; no wider incident-notification commitment found.
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?
Unknown
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?
Evidenced
Hyperbeat documents a provider-exit path: users recover their Turnkey-secured wallet by email one-time code and export the recovery phrase or private key to another wallet without Hyperbeat. This contradicts the architecture docs used for CROPS S1 and S4, under which settlement-token and collateral withdrawals need Operator approval; no recovery plan for Hyperbeat's own service was found. source 1 CROPS S4
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?
Unknown
No status page found (status.hyperbeat.org does not resolve) and no post-mortems found in the blog, docs or help centre.
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?
Evidenced
Accounts and card actions are signed with a passkey (Turnkey key management); email one-time codes are used for login and recovery. No separate second factor is described. source 1 CROPS P4
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?
Unknown
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?
Unknown
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?
Unknown
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?
Unknown
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?
Unknown
No public API documentation for Hyperbeat Pay found; the staking API in the docs is a separate product.
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?
Unknown
Agent Cards hand card credentials or a skill file to an AI agent under per-card spending limits, with one-tap revocation; no server-to-server API key scheme is documented.
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?
Unknown
B5.4 Export controls If an API exports data, does it limit volumes and log exports?
Unknown
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?
Evidenced
Hyperbeat's privacy policy states no encryption or classification and warns that data in transit may not be secure. For KYC data only, the help centre states Sumsub encrypts data in transit (TLS 1.2+) and at rest in German data centres. Observed: hyperbeat.org refuses TLS 1.1 and accepts TLS 1.2. source 1 · source 2
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?
Unknown
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?
Evidenced
The privacy policy keeps data "only for so long as necessary" with no periods; Hyperbeat may keep Pay account registration information after termination (Terms). KYC data held by Sumsub is kept 5 years after the relationship ends, with deletion requests processed within 30 days except legally retained records. Account deletion is self-service in settings. See CROPS P2 for what is collected. source 1 · source 2 CROPS P2
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?
Evidenced
Zoeion Ltd Corporation (Panama City) is data controller; Sumsub is named as KYC data processor acting on Hyperbeat's instructions. Other processors are named by category only; complaints go to Panama's data protection authority. No DPIA statement found. source 1 · source 2
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?
Unknown
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?
Unknown
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?
Unknown
The Pay web app bundles the Datadog browser SDK (provider file, CROPS P1), which indicates client-side monitoring; no statement on server-side logging, SIEM or endpoint detection found.
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?
Unknown
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?
Unknown implied from the component list
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?
Unknown implied from the component list
B9.2 CI runs on pull requests Does every pull request trigger automated checks?
Unknown implied from the component list
B9.3 Tests run in CI Do the CI workflows run the test suite?
Unknown implied from the component list
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?
Unknown implied from the component list
B9.5 Versioned releases Are releases tagged with immutable semantic versions?
Unknown implied from the component list
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?
Unknown implied from the component list
B9.7 Changelog Is a changelog maintained with the code?
Unknown implied from the component list
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?
Unknown implied from the component list
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?
Evidenced
Logical architecture only, in prose (docs page "Liquid banking Architecture" describing ManagementAccount, factory, registries, the Operator's settle() and Turnkey key management). No infrastructure or integration architecture, no diagrams of the backend, and no contract addresses for the card stack. source 1
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?
Evidenced
Zoeion Ltd Corporation, Panama (address PH Iver 77, Calle José Matilde Perez, San Francisco, Panama City); disputes go to arbitration in Panama (CECAP). The card is issued by Third National under the separate, unpublished Hyperbeat Pay Cardholder Agreement; bank ramps run through Noah. No company register entry found. source 1 · source 2
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?
Evidenced
Platform fees on transactions (set and changeable by the Company), FX and ATM fees on the card, fiat ramp fees and interest on Credit Mode borrowing; cashback is described as funded from account activity rather than a marketing budget. No financial statements found. source 1
B11.3 Termination terms What happens to customer funds and data on termination by either side?
Evidenced
The Company may terminate the Terms at any time, for any reason or none, with or without notice; after termination users keep access to their Digital Wallet through means outside the Platform. Hyperbeat may keep Pay account registration data after the user terminates. Collateral can be withdrawn only after repaying all borrowings. Card-level termination terms are in the unpublished Cardholder Agreement. source 1 · source 2
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?
Evidenced
AI agents can initiate card payments: Agent Cards let AI assistants (Claude, ChatGPT and others) and backend code spend under per-card limits. The privacy policy says no decisions with legal or similarly significant effects are taken solely by automated processing unless assessed in writing; KYC screening (sanctions, PEP, liveness) runs through Sumsub. source 1 · source 2
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?
Evidenced
For Agent Cards only spending controls are documented (per-transaction or period limits, optional expiry, one-tap revocation, passkey-signed issuance). No monitoring, validation, bias or decommissioning documentation found. source 1
Scope of assessment
Components in the payment path
Component
Role
Public
Licence
Operator
Required
Liquid Bank contracts (ManagementAccount, factory, registries; source private)
contracts
No
proprietary
Hyperbeat (Zoeion Ltd Corporation)
Yes
Hyperbeat Operator (settlement contract and backend)
Card issuer and program manager (not named in public documents)
card-issuer
No
proprietary
unknown
Yes
Visa (card network)
card-network
No
proprietary
Visa
Yes
KYC and screening provider (not named)
kyc
No
proprietary
unknown
Yes
Morpho (credit-mode borrowing)
other
Yes
GPL-2.0-or-later
Morpho
No
Repositories
None found. Absence of public code is itself a finding.
Contracts
None listed.
Assessor notes
Eligibility: no verified contract and no public repository needed to run the card, so type is incumbent. Searched 2026-10-07: GitHub orgs 0xhyperbeat (Audits plus forks; Liquid-Bank named in the Zellic scope returns 404) and hyperbeat (unrelated 2015 user); docs.hyperbeat.org (Liquid Banking architecture, Hyperbeat Pay, addresses, audits, legal pages; no card contract addresses); hyperbeat.org terms, privacy, sitemap; the Pay dapp at hyperbeat.org/dapp/pay and its 61 JS chunks (Operator and service addresses found, factory not); HyperEVMScan and Sourcify for the Operator, Morpho service, repay service, wrapper service, a beatUSD batchSettle contract 0xFc29c432... and a sample ERC1967 account 0xd9c6a70b... with implementation 0x6e209362... (all unverified). The Hyperbeat Pay Cardholder Agreement referenced in the Terms is not published, so the card issuer is unknown. HyperEVM onchain reads pinned to block 47900593.
