Unaudited, unvetted, experimental. Do not use as a reference. AI-researched ratings that may be wrong; not advice or a statement of fact about any provider. Full disclaimer
Pending review. 1150 of 1150 ratings not yet checked by a human. Do not rely on unreviewed ratings.
Ratings apply to this deployment only. Treat them as unverified for other chains. Why this deployment: The International Card Terms define Supported Blockchains as "the Plasma blockchain network" and name Rain as issuer, so the card's collateral runs on Rain's Plasma deployment: Coordinator 0xd5dd7939... and Collateral beacon 0xBb931B7B... (block 34429835). Judgment call: Plasma One publishes no addresses; that this Coordinator serves Plasma One rests on the terms, and the sample collateral used to show the flow is not confirmed as a Plasma One cardholder's. Excluded: the US card terms and the Bridge account services.
Offered everywhere except the countries listed. Checked 2026-10-09. Not scored.
From Appendix I (Prohibited Activities List) of the Terms of Service, last updated 15 June 2026. s1.1 prohibits Cuba, Iran and North Korea; the Crimea, Donetsk, Luhansk, Kherson and Zaporizhzhia regions of Ukraine; and any other jurisdiction under OFAC, EU, UK OFSI or UN sanctions, which are not named and so are not listed here. s1.2 lists 28 "Additional Restricted Jurisdictions" where Plasma "may" restrict or terminate access. They are included as the more restrictive reading, although the wording is discretionary. All of Ukraine is listed because s1.2 names Ukraine outside the s1.1 regions. FATF grey-list countries may face case-by-case review. The card comes in two programmes, both issued by Rain: a US card for US residents (US Consumer Card Terms) and an International card for non-US citizens. Bridge provides the account services through separate US, EEA and rest-of-world entities. Vault Services are additionally unavailable to New York residents.
Conversion. The token is sold for fiat when a payment is authorised.
Fiat-backed stablecoin. An issuer holds the reserves and can freeze balances at the token contract. Value depends on the issuer redeeming at par. Censorship Resistance records whether that freeze power is disclosed.
Plasma One's Terms say the card makes fiat payments funded by stablecoin balances in the user's wallet, without naming the token. Onchain, the Rain Coordinator on Plasma accepts USDT0 as a collateral asset, and the observed card funding pulled USDT0 from the user's account into its Rain collateral; Rain then pays the merchant in dollars over Visa. Other collateral assets, if any, were not enumerated (the Coordinator exposes a per-token check, not a list). The in-app Swap Function (via 0x) converts other assets, including XPL cashback, into stablecoins, but it is a manual step, not an auto-swap at spend. Cashback is paid in XPL. USDT0 is an omnichain representation of Tether's USDT; Tether is the underlying reserve issuer.
Sample card funding tx 0x32bbf2f4...34b8 called Coordinator.pullAssetFromUserWallet to move 1.34 USDT0 from account 0xDc4930f1... into its Rain collateral 0xe0C209Db.... The sample is not confirmed as a Plasma One account.
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Censorship Resistance
Who can block valid use, and can users route around them?
0 FailsPillar rating: weakest of 5 1 of 5 Partial or better · 1 no evidence
What would raise this pillar
Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
! Under review
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 todayDrift
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The weekly re-check found that a recorded fact changed. This rating counts as unknown until a reviewer re-checks it.
The card settlement contracts are controlled by a single Rain EOA, and the Card Terms let Plasma and Rain block any cardholder's transactions at any time. Users cannot pull collateral out without a Rain signature because unsigned timelock withdrawals are switched off. EOA-held role with per-account blocking, so 0.
Evidence (2)1 verified · 1 documented
VerifiedDrift
Coordinator owner() = EOA 0x21ebc2f23a91fD7eB8406CDCE2FD653de280B5fc, which adds or removes executors and publishers, sets the treasury and supported assets; timelockWithdrawWithoutSignatureAllowed() = false.
Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer? C2
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Merchants are paid by Rain through Visa offchain. Onchain, moving funds into collateral and paying out of it both require Rain-held keys (pull operator, executor or publisher). No payer or payee can settle directly.
Evidence (1)1 verified
Verified
Sample card funding tx 0x32bbf2f4...34b8 was sent by EOA 0x2ebE9d77c907C03910157f4c437962F156FEB3Da calling Coordinator.pullAssetFromUserWallet (onlyPullOperator) to move 1.34 USDT0 from account 0xDc4930f1... into its collateral 0xe0C209Db...; payments from collateral to the Rain treasury (makePaymentFromCollateral) require a Rain executor/publisher signature.
Does the payment flow require a relayer, paymaster, bundler, or API that only the provider runs? C3
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
A card payment needs Plasma One's closed app and backend, Rain's signers and Visa. None is public and there is no fallback. Plasma publishes no Plasma One repository.
Evidence (2)1 verified · 1 documented
Verified
Coordinator publishers(0) = 0xcBD8eaE56e5D51c82E9b901ff535906077c5ab32 and executors(0) = 0xB92949bdF09F4193599Ae7700211751ab5F74aCd, both Rain-held keys.
Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Geographic and sanctions restrictions are disclosed in the Terms and enforced in the closed backend, Rain and Sumsub, so the neutrality of the settlement layer cannot be shown from code and the screening cannot be bypassed (C2 = 0). Disclosed in docs only, so 1.
Evidence (1)1 documented
Documented
Terms list prohibited and restricted jurisdictions and OFAC/EU/UK sanctions screening.
Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees? C5
2 Partial
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The collateral asset (USDT0) is enumerated in onchain Coordinator config read from verified source, and the Terms warn that stablecoin issuers can freeze addresses, without naming USDT0's blocklist. Plasma's validator set and inclusion assumptions are not stated. Judgment call: the generic freeze warning is not a per-token statement, so 2, not 3.
Does the deployed bytecode match public source, and can a third party rebuild it? O1
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Rain's Coordinator and Collateral logic are verified on Plasmascan, but the beacon that decides which Collateral logic runs is not, nothing is on Sourcify, and the user wallet contract is not identified. Some contracts verified, so 1.
Evidence (1)1 verified
Verified
Plasmascan shows Exact Match for the Coordinator, Collateral implementation 0x05263D24... and the factory proxy; the Collateral beacon 0xBb931B7B... and the collateral proxies are unverified; Sourcify v2 has none of these addresses.
Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2
1 Weak
Best evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Contract source is visible through explorer verification; the app, backend, API and indexer are closed and no API schema is published. Judgment call: explorer-verified source counts as "contracts only", so 1.
Evidence (1)1 verified
Verified
The only public code in the card path is explorer-verified Rain contract source; the PlasmaLaboratories GitHub org holds forks (reth, alloy, ethrex), a token list and node templates, and no Plasma One app, SDK, backend or API repo.
Are ABIs, event schemas, an API schema, and a payee data export in a non-proprietary format all in the repo? O4
1 Weak
Best evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
ABIs and events can be read from the explorer, but nothing is versioned in a repo and there is no API schema or data export. Judgment call: 1, as for other explorer-only cases.
Evidence (1)1 verified
Verified
Coordinator ABI and events (AssetPulled, PaymentFromCollateral, Withdrawal) are available from explorer verification only; no repo, API schema or export format.
Do the SDK, widget, or frontend ship analytics, telemetry, error reporting, or fingerprinting? P1
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Analytics is present and disclosed in the privacy policy. The app is closed, so whether it is on by default or opt-in cannot be checked in code. Judgment call: disclosed analytics with no code to show opt-in is anchor 1.
Evidence (1)1 documented
Documented
The Privacy Policy discloses Google Analytics on the Service and other tracking technologies.
What do calldata and events reveal about who paid whom for what? P3
2 Partial
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No merchant data goes onchain, but each card funding is a public pull from a long-lived wallet into its own collateral, tagged with a Rain transaction id, so amounts and timing are linkable to the wallet. Public visibility is disclosed. Minimal linkage, documented, so 2. Judgment call: the sample is a Rain collateral on Plasma not confirmed as a Plasma One account.
Evidence (2)1 verified · 1 documented
Verified
The pull call and its AssetPulled event carry the user wallet, its collateral, asset, amount and an opaque UUID transaction id (edd302da-4d10-497c-9258-ce471a434f88); no merchant or order data.
Which third parties see a request during a payment, and can they be swapped out? P4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Rain, Visa, Privy, Sumsub and Google see payment or identity data; they are disclosed in documents only and cannot be swapped. 1.
Evidence (1)1 documented
Documented
The Terms name Privy for wallet keys and Bridge for account services; the card terms name Rain and Visa; the privacy policy names Sumsub and Google Analytics.
Who holds funds between payer and payee, and can the provider redirect them? S1
! Under review
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 todayDrift
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The weekly re-check found that a recorded fact changed. This rating counts as unknown until a reviewer re-checks it.
Funds in collateral are released only by Rain's Coordinator, and users cannot withdraw without a Rain signature. The observed account grants its collateral an unlimited USDT0 allowance that Rain's pull operator uses, and a single Rain EOA can swap the collateral logic through the beacon. Rain can redirect funds, so 0. Judgment call: the allowance sample is not confirmed as a Plasma One account.
Evidence (2)1 verified · 1 claimed
VerifiedDrift
Collateral beacon owner() = Rain EOA 0x21ebc2f2...; Collateral.withdrawERC20Asset is onlyCoordinator; the sample account's USDT0 allowance to its collateral is 2^256-1, and the Coordinator's pull operator can pull any amount.
Who can change the contract code, and with how much notice? S2
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Every collateral contract can be upgraded at once by a single Rain EOA through the beacon, with no timelock or notice; the factory is upgradeable by the same EOA. EOA admin, so 0.
Evidence (1)1 verified
Verified
Factory EIP-1967 admin = ProxyAdmin 0x6f3b5Fd9..., whose owner() is EOA 0x21ebc2f2...; the same EOA owns the Collateral beacon and the Coordinator.
How large an allowance does the SDK ask users to grant, and for how long? S3
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The observed card account grants an unbounded USDT0 approval to a collateral contract whose logic a Rain EOA can replace; neither the Terms nor the card terms disclose an unbounded approval. Unbounded and undisclosed, so 0. Judgment call: the sample is a Rain collateral on Plasma not confirmed as a Plasma One account, and the app code that sets the approval is not public.
If the provider disappears tomorrow, do payees keep their funds and the ability to keep settling? S4
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
S1: collateral is Rain-controlled. C2: no direct settlement (0). C3: closed single-vendor (0). O3: no self-host path. Funds already in collateral cannot leave without Rain's signature, so they depend on Rain's liveness; balances left in the user's wallet stay under the user's Privy-managed key, but that wallet is not public code. 0.
Evidence (1)1 verified
Verified
timelockWithdrawWithoutSignatureAllowed() = false, so Collateral.initiateTimeLockWithdrawal reverts without a Rain signature.
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6
? No evidence
Sets the pillar rating
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No checkable evidence settles this yet, so it counts as 0.
Security audits 1
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
Shared component: Rain EVM collateral contracts v2 (Beacon, Collateral, Coordinator, Factory), private best-efforts contest at 6f578d5b9c Contest ran 2-8 December 2024 on b432939a; 6f578d5 is the fix commit. The Rain repo is private, the Plasma collateral beacon is unverified, and the Plasma Coordinator's pullAssetFromUserWallet and timelocked withdrawal functions are not named in the report, so the deployment may be a later version.
Compiled from: Plasma's Plasma One pages and Rain's Plasma case study (both say contracts are audited before launch; no report is linked), Rain's security page (reports shared under NDA; Sherlock named), the Sherlock report repo (github.com/sherlock-protocol/sherlock-reports), the Guardian report repo, and web searches for Plasma One and Rain card-contract audits. Rain's public GitHub (SignifyHQ) holds SDKs only. No audit of Plasma One's own app or backend or of the Privy wallet stack is logged. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.
Operational and procurement
Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.
Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 7 evidenced, 0 attested, 0 absent, 0 not applicable, 38 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.
Group A: operational facts
Fees
Evidenced
Component
Paid by
Amount
Basis
fx
payer
International card: FX up to 1% on non-USD spend; cross-border 0%; Platinum: Plasma covers the Visa FX fee
International Card Terms Important Disclosures (effective 26 February 2026) and /personal FAQ.
fx
payer
US card: 1% international transaction fee; no annual fee; late payment 2% of balance
U.S. Consumer Card Terms account-opening disclosures (agreement last updated 12 February 2026).
card
payer
Core tier 199 USD per year or 20,000 XPL locked for 12 months; Lite tier free
Plasma One Core page (Core has reduced fees and up to 2 free virtual cards; Lite 1). Tier pricing and card fees otherwise live in the Help Center (not read).
provider
payer
No Plasma fee; partner fees on FX and bank withdrawals are shown in the app before confirming
/personal FAQ "Are there fees?".
card
payer
International card penalty fees: late payment up to 40 USD, returned payment up to 29 USD
International Card Terms Important Disclosures.
The "Standard" versus "Reduced" fee levels per tier are not quantified on the public pages; the Rewards Addendum points to the Help Center for card fees and tier pricing. Platinum pricing is not shown. Bridge's off-ramp fees are not published.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Custody model
Evidenced
Hybrid: self-custody with a provider-controlled spend path
Balances rest in the user's own wallet, but the observed account grants its Rain collateral an unlimited USDT0 allowance that Rain's pull operator uses, and collateral is released only by Rain's Coordinator. Agrees with the S1 finding (score 0, Rain can redirect funds; the sample account is not confirmed as Plasma One's).
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Licences and registrations
Unknown
No licence found in a register. The card terms (US and International) name Third National as issuer; no Plasma document gives its regulator or licence number, and FDIC BankFind lists no active institution of that name. The site footer instead says the card is issued by Rain, a Visa Principal Member, which is a network membership, not a licence. Bridge Building Inc. (US), Bridge Building Sp. z o.o. (EEA) and Bridge Building Limited provide account services; their registrations were not checked. Plasma states it is not a regulated financial institution.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Cash-out options
Evidenced
Where
Method
Partner
Fee
Limits
everywhere offered
card spend
Third National (issuer), Rain (programme manager), Visa
FX up to 1% (International) or 1% (US); covered on Platinum
US card for US residents, International card for non-US citizens; spend is funded by Rain pulling USDT0 into collateral.
everywhere offered
bank transfer
Bridge (Bridge Building Inc. / Sp. z o.o. / Limited by residence)
partner fee shown in the app
Off-ramp rails depend on the user's region; not listed publicly.
ATM access is not documented: the International Card Terms do not mention ATMs, and the US terms list no cash-advance fee and allow PIN ATM use only if enabled; no ATM row is recorded. Contradiction on the issuer: the card terms say Third National, the site footer says Rain.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
First deployment
Evidenced
2026-03-19 (block 17026601): Rain collateral factory 0x36F5A315... and Collateral beacon 0xBb931B7B... on Plasma, created by Rain EOA 0x21ebc2f2...
These are Rain's contracts and may serve other Rain programmes on Plasma; that they serve Plasma One rests on the card terms (provider file judgment call). The Coordinator and Collateral implementation now in use were deployed on 2026-09-29 (see changes).
Verified
The factory proxy has code size 0 at block 17026600 and 1167 at 17026601 (2026-03-19 22:12:39 UTC); creation tx 0x3885b508...bf9b from EOA 0x21ebc2f2.... The beacon 0xBb931B7B... appears in the same block (0 to 1084 bytes).
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Operating entity
Evidenced
Plasma (exempted company with limited liability), KY · CO-412800
The Cayman Islands register is not publicly searchable, so no register_url. The UK affiliate and joint controller Plasma Labs UK Ltd. is on Companies House (16405367); see B11.1.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Security incidents
Unknown
Absence of a found incident is not evidence that none occurred.
No incident report or post-mortem found on www.plasma.org (sitemap pages other than blog posts read) or in the PlasmaLaboratories GitHub organisation; blog posts were not searched one by one.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Product changes affecting users
Evidenced
2026-02-12: US cardholder agreement last updated. source
2026-02-26: International Card Terms disclosures effective (FX up to 1%, issuer Third National). source
2026-09-29: New Rain Collateral implementation (block 33757857) and Coordinator (block 33757874) deployed on Plasma; the Coordinator in use was created here. source
Whether a previous Coordinator served the card before 2026-09-29 was not traced.
Verified
Coordinator code size 0 at block 33757873 and 24540 at 33757874 (2026-09-29 16:20:25 UTC); Collateral implementation 0x05263D24... goes from 0 bytes at 33757856 to code at 33757857 (16:20:08 UTC).
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Volume transacted (verified only)
Unknown
not computed on 2026-10-19: no blocks-per-day estimate for chain 9745
Not yet computed; the maintainer runs scripts/volumes.mjs. The figure is gross pulls into card collateral, an upper bound on Plasma One card funding because the Coordinator may serve other Rain programmes.
UnreviewedAssessed by AI research agent (operational), 2026-10-09
Group B: institutional due diligence
Control
State
What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?
Unknown
No ISO 27001, SOC 2, security page or trust centre found for Plasma One (www.plasma.org/security and /trust return 404; sitemap, terms, privacy policy and card terms read). Rain and Third National not checked.
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?
Unknown implied from the component list
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?
Unknown implied from the component list
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?
Unknown implied from the component list
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?
Unknown implied from the component list
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?
Unknown implied from the component list
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?
Unknown implied from the component list
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?
Unknown implied from the component list
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?
Unknown implied from the component list
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?
Unknown implied from the component list
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?
Unknown implied from the component list
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?
Unknown implied from the component list
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?
Unknown implied from the component list
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?
Evidenced
Wallet access is through linked authentication methods (Apple or Google sign-in, email verification, passkeys, biometrics) and any multi-factor authentication the user enrols in; MFA is optional and users are told to enrol more than one method. Keys are held by a key-management provider (Privy per CROPS components). source 1
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?
Unknown implied from the component list
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?
Unknown implied from the component list
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?
Unknown implied from the component list
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?
Unknown implied from the component list
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?
Unknown implied from the component list
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?
Unknown implied from the component list
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?
Unknown implied from the component list
B5.4 Export controls If an API exports data, does it limit volumes and log exports?
Unknown implied from the component list
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?
Unknown implied from the component list
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?
Unknown implied from the component list
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?
Evidenced
KYC/AML data for the relationship plus 5 years (up to 10 where law requires); transaction and blockchain data 5 years; marketing data until opt-out or 24 months' inactivity; communications up to 3 years. Sumsub keeps face data under its own rules (3 years Illinois, 1 year after purpose Texas, otherwise AML period). Onchain data cannot be erased. source 1 CROPS P2
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?
Evidenced
Plasma (Cayman Islands, CO-412800) and Plasma Labs UK Ltd. are joint controllers under Article 26 GDPR / UK GDPR; Sumsub processes biometric KYC data; EEA/UK transfers rely on SCCs and the UK IDTA. No DPIA statement found. source 1
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?
Unknown implied from the component list
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?
Unknown implied from the component list
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?
Unknown implied from the component list
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?
Unknown implied from the component list
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?
Unknown implied from the component list
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?
Unknown implied from the component list
B9.2 CI runs on pull requests Does every pull request trigger automated checks?
Unknown implied from the component list
B9.3 Tests run in CI Do the CI workflows run the test suite?
Unknown implied from the component list
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?
Unknown implied from the component list
B9.5 Versioned releases Are releases tagged with immutable semantic versions?
Unknown implied from the component list
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?
Unknown implied from the component list
B9.7 Changelog Is a changelog maintained with the code?
Unknown implied from the component list
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?
Unknown implied from the component list
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?
Unknown implied from the component list
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?
Evidenced
Plasma, an exempted company incorporated in the Cayman Islands (CO-412800), with affiliates Plasma Labs UK Ltd. (Companies House 16405367, active, incorporated 24 April 2025) and Plasma US, Inc.; the card agreements are with the issuer, Third National; account services with Bridge Building Inc. (US), Bridge Building Sp. z o.o. (EEA) or Bridge Building Limited (others). source 1 · source 2 · source 3
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?
Unknown implied from the component list
B11.3 Termination terms What happens to customer funds and data on termination by either side?
Evidenced
Plasma may terminate at any time for any or no reason, with or without notice, but for consumers only for a valid reason and with reasonable notice unless immediate action is needed; the issuer may cancel the card at any time with or without notice. Plasma says it does not custody user assets; funds already in Rain collateral need a Rain signature to leave (CROPS S4). source 1 · source 2 CROPS S4
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?
Evidenced
Automated processing (Sumsub's identity verification platform and internal compliance tooling) assesses KYC and AML and can restrict or close accounts. The policy does not say whether these are AI or machine-learning systems. source 1
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?
Evidenced
Only an override path is documented (the user can request human review and contest an automated decision that restricts or closes the account). No monitoring, validation, decommissioning or bias evaluation documentation found. source 1
Scope of assessment
Components in the payment path
Component
Role
Public
Licence
Operator
Required
Rain Coordinator and per-user Collateral contracts
contracts
Yes
proprietary
Signify Holdings, Inc. d/b/a Rain (owner EOA 0x21ebc2f2...)
Yes
Rain collateral beacon and factory admin (unverified beacon)
contracts
No
proprietary
Rain (EOA 0x21ebc2f2...)
Yes
Rain executor, publisher and pull-operator keys
signer
No
proprietary
Rain
Yes
Rain (card issuer and program manager, Visa Principal Member)
card-issuer
No
proprietary
Signify Holdings, Inc. d/b/a Rain
Yes
Visa (card network)
card-network
No
proprietary
Visa
Yes
Plasma One app and backend
backend
No
proprietary
Plasma (Cayman Islands) and Plasma Labs UK Ltd.
Yes
Privy wallet contracts and TEE key management (not identified)
wallet
No
proprietary
Privy
Yes
Sumsub (identity verification)
kyc
No
proprietary
Sumsub
Yes
Bridge (global account services; not in the card path)
other
No
proprietary
Bridge Building Inc. / Sp. Z.o.o. / Limited
No
Plasma chain (PlasmaBFT validators)
other
Yes
none
Plasma validators
Yes
Repositories
None found. Absence of public code is itself a finding.
Plasma One publishes no contract addresses or repositories. The card-side contracts were found from USDT0 Transfer logs on Plasma (block range 34379335-34429334): per-user Rain Collateral BeaconProxies funded by Coordinator.pullAssetFromUserWallet. The International Card Terms name Plasma as the only Supported Blockchain and Rain as issuer, which is the basis for scoring Rain's Plasma deployment; the specific sample account is not confirmed as a Plasma One user. The accounts seen funding collateral are EIP-7702 delegations to ZeroDev Kernel v3.3 (0xd6CEDDe8...), which does not match a third-party claim (HarrisHan/plasma-one-account) that Plasma One uses Biconomy Nexus 1.2.0; neither is attributed. All reads pinned to Plasma block 34429835.
