Unaudited, unvetted, experimental. Do not use as a reference. AI-researched ratings that may be wrong; not advice or a statement of fact about any provider. Full disclaimer
Pending review. 1150 of 1150 ratings not yet checked by a human. Do not rely on unreviewed ratings.
Incumbent rails have no public chain settlement and no public code. They are scored with the same rubric as every other row. Their low ratings show the verifiability gap between rails whose behaviour can be inspected and rails whose behaviour must be trusted; that gap is the point of the comparison, not a claim that the incumbent is unsafe.
Offered only in the countries listed. Checked 2026-10-09. Not scored.
Rizon's help centre lists 44 supported nationalities and says eligibility depends on citizenship (passport), not only residence, so a resident of a listed country with another nationality may fail KYC. The codes here are those nationalities. US citizens get the Rizon US Spend Card; the Rizon Global, Inc. card terms require attesting that you are not a US citizen. The Terms of Service also list jurisdictions where accounts may not be opened under Rain's compliance rules (Afghanistan, Albania, Belarus, Bosnia, Central African Republic, Congo, Croatia, Cuba, Cyprus, Eritrea, Haiti, Iran, Iraq, Kosovo, Lebanon, Liberia, Libya, North Macedonia, Moldova, Montenegro, North Korea, Russia, Serbia, Somalia, Syria, Ukraine, Venezuela, Vietnam, Yemen, Zimbabwe, plus Crimea, Donetsk and Luhansk) and exclude EU-, OFAC- and UN-sanctioned jurisdictions; none of those are on the nationality list. The Terms also say Rizon does not actively market its services in the EU or regions outside the US and Latin America.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Settlement token
What the balance is held in and debited from. Shown as context; it does not change any rating.
Token
Class
Issuer
Contract
USDC
fiat-backed stablecoin
Circle
USDT
fiat-backed stablecoin
Tether
Conversion. The token is sold for fiat when a payment is authorised.
Fiat-backed stablecoin. An issuer holds the reserves and can freeze balances at the token contract. Value depends on the issuer redeeming at par. Censorship Resistance records whether that freeze power is disclosed.
Rizon accepts only USDC and USDT deposits (on Arbitrum, Solana, Base, Polygon, Optimism, Avalanche and BSC) into the user's self-custodial wallet. The card is a Rain card: Rizon's Terms say spending converts stablecoins into fiat through Rain and its licensed partners, and the help centre says the dollar balance with the lowest conversion fee is used at the moment of payment, so no single default token is stated. The chain and contract of the Rain collateral holding the spendable balance are not published, and the card terms' Supported Blockchains (Polygon, Optimism, Arbitrum) differ from the deposit list (see C5), so no chain or address is recorded.
Checked 2026-10-12
Evidence (3)3 documented
Documented
Rizon's help centre says the wallet accepts only USDC and USDT, and lists the supported networks.
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Censorship Resistance
Who can block valid use, and can users route around them?
0 FailsPillar rating: weakest of 5 0 of 5 Partial or better
What would raise this pillar
Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Rizon and the issuer can block individual cardholders' transactions and suspend accounts at their discretion. No contract-level role could be read, because no Rizon contract address is published (see notes).
Evidence (1)1 documented
Documented
The Rizon Global card terms let Rizon and the issuer block transactions and suspend account access for activity that does not fit consumer patterns.
Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer? C2
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Card payments settle through Rain, the issuer Third National and Visa. Users cannot settle a card payment themselves.
Evidence (1)1 documented
Documented
The Terms say each user is assigned a smart contract managed in part by Rain to enable the card off-ramp; card spending converts collateral to fiat through Rain and its licensed partners.
Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Sanctions and geographic screening is disclosed in the Terms, with the list sources named. Whether the settlement contracts filter cannot be checked, because no contract is identified. Disclosed in docs only, so 1.
Evidence (1)1 documented
Documented
The Terms exclude users in jurisdictions sanctioned under EU, OFAC or UN law and require KYC through Rain.
Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees? C5
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The card terms name chains but not tokens, and Rizon's own help centre gives a different chain list. Neither states the issuers' freeze powers or the sequencer assumptions. Judgment call: tokens are not enumerated and the chain lists conflict, so 0, not 1.
Evidence (2)1 documented · 1 claimed
Documented
The card terms define Supported Blockchains as Polygon, Optimism and Arbitrum plus any the issuer adds, and let the issuer choose which digital assets count as collateral; no tokens or freeze powers are listed.
Does the flow collect anything beyond addresses, amounts, token, and chain? P2
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
KYC and screening data are collected beyond settlement needs and disclosed in the privacy policy only, so 1.
Evidence (1)1 documented
Documented
The privacy policy describes identity verification data from partners, sanctions and PEP database checks and AML retention of up to eight years under Lithuanian law.
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6
? No evidence
Sets the pillar rating
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No checkable evidence settles this yet, so it counts as 0.
Security audits 3
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
Shared component: Rain EVM collateral contracts v2 (Beacon, Collateral, Coordinator, Factory), private best-efforts contest at 6f578d5b9c Contest ran 2-8 December 2024 on b432939a; 6f578d5 is the fix commit. Rizon's Terms say each user gets a Rain-managed collateral contract, but no address is published and the Rain repo is private, so the deployed version could not be compared with the audited one.
Shared component: Privy shamir-secret-sharing TypeScript library (index.ts, csprng.ts), used in Privy's embedded-wallet key sharding at cd8422d Covers only the open-source secret-sharing library, not Privy's closed key-management service, TEE or SDKs. Which library version Privy runs for Rizon wallets is not known.
Unknown
1 low (missing input bounds in arithmetic functions); fixed in c9f0ab86
Shared component: Privy shamir-secret-sharing TypeScript library (src/index.ts), cryptography review and source code audit at 3383ad9272 Two-day review in February 2023 (CW06); report dated 24 April 2023. Covers only the open-source library, not Privy's closed key-management service. Superseded in part by the Zellic review.
Unknown
1 high (polynomial degree might be less than t-1), 2 informational; all three marked fixed and verified by Cure53
Compiled from: getrizon.com (Terms, privacy policy) and the Rizon help centre (no audit linked), GitHub (no Rizon org), the Sherlock report repo and Rain's security page (Rain says its reports are shared under NDA and names Sherlock; its public GitHub, SignifyHQ, holds SDKs only), Privy's security docs and the privy-io/shamir-secret-sharing README, and web searches for Rizon, Rain and Privy audits. Privy's docs also name Doyensec; no Doyensec report is published. No audit of the Rizon app or backend was found. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.
Operational and procurement
Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.
Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 14 evidenced, 3 attested, 0 absent, 0 not applicable, 28 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.
Group A: operational facts
Fees
Evidenced
Component
Paid by
Amount
Basis
card
payer
Virtual card $10 (free on Gold and Emerald); physical card $49.99 Standard, $24.99 Gold, free Emerald
Help centre plan comparison; the Global card terms state $10 per virtual card; the site pricing page says "check app".
Site pricing page and help centre; set by Rizon and changeable.
fx
payer
Global card terms: FX fee 1.7% + $0.30, cross-border 0%; US card terms: 1.7% + $0.10
Card terms Important Disclosures (Global effective 27 June 2026); conflicts with the $0.10 on the pricing page.
card
payer
Small transaction fee $0.50 per charge under $1 after 5 free a month ($0.38 Gold, $0.25 Emerald)
Help centre plan comparison.
cashout
payer
ATM $1 + 0.65% (Standard and Gold); $0.10 Emerald
Help centre plan comparison and physical card article.
network
payer
Onchain withdrawal or international send: network fee + 0.1%
Site pricing page.
The FX fixed component differs between the Global card terms ($0.30) and the pricing pages ($0.10); both are recorded. Pay-in and pay-out fees for virtual accounts are discounted by plan but the base amounts are not published.
Documented
Rizon site "Fees and limits": deposits free, USD card spend free, non-USD 1.7% + $0.1 (1.02% with Emerald), send and onchain withdrawal network fee + 0.1%, no limits; card issuance "check app".
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Custody model
Unknown
CROPS S1 is unknown: no collateral contract can be tied to Rizon. Rizon says balances sit in a Rain-deployed vault controlled by the user's Privy wallet and that Rizon never has access; the card terms let the issuer liquidate collateral. Unverified, so no custody model is recorded.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Licensed lender and money transmitter; Visa-authorized card issuer (as stated by Rain) Card issuance for the Rizon card; Rain (Signify Holdings, Inc.) as programme manager.
Attested only: Rizon and Rain both call Nimbus LLC (Third National) licensed, but no regulator, state or number is given and no register entry was found. FDIC BankFind lists no institution named Third National or Nimbus; NMLS Consumer Access blocked scripted access; the Puerto Rico OCIF check could not be reached. Rizon Technologies, UAB applies Lithuanian AML law (privacy policy) but no Lithuanian registration was found; the Registry Centre list of crypto operators returned HTTP 403. Rizon states it provides no regulated services.
Documented
Rizon site footer: Rain operates under its own regulatory authorizations; Rizon provides no regulated services.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
Rain privacy policy, Entity Roles and Data Flows: describes Nimbus LLC, doing business as Third National, without naming a regulator, state or licence number.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
FDIC BankFind institutions API, run 2026-10-09: the closest matches for "Third National" are other banks (Fifth Third Bank, N.A. and inactive banks); a search for NAME:Nimbus with ACTIVE:1 returns 0 institutions. NMLS Consumer Access returned HTTP 403 to a scripted request and was not bypassed; the Puerto Rico OCIF licence check (concesionarios.ocif.pr.gov) failed the TLS handshake.
Physical card only; up to 3 withdrawals per 24 hours, $250 each; physical cards ship only to the listed countries.
everywhere offered
bank transfer
Not named (Rizon local payouts)
Not published (plan discounts on pay-out fees)
Send stablecoins and deliver fiat to bank accounts in 50+ countries; professional and business payments only.
The physical-card delivery list differs from the nationality allowlist in the provider file (it adds, for example, Bolivia, Kenya and South Africa); ALL follows the availability list. The payout partner and per-country fees are not published.
Documented
Rizon Global, Inc. Spend Card Terms, Defined Terms.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
First deployment
Evidenced
2025-04-30: Rizon Terms of Service effective, covering the Rain card off-ramp; earliest dated first-party document for the card
The current Terms may have been revised since without a new effective date. The Rain partnership was announced on the Rizon blog on 2025-08-18; the current Global card terms are effective 2026-06-27.
Documented
Rizon Terms of Service header; the Terms describe the Rain-managed smart contract behind the card off-ramp.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Operating entity
Evidenced
Rizon Global, Inc., US-DE
Not checked in the Delaware register (interactive search). The commercial agent Rizon Technologies, UAB (Lithuania) was not checked in the Lithuanian Register of Legal Entities.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Security incidents
Evidenced
2026-09-28: Rain platform: unexpected card declines and API issues for some partners, 18:53 to 19:35 UTC; root cause still under investigation. Rain-wide; which programmes were affected is not stated. funds lost: unknownsource
2026-06-25: Rain platform: elevated API error rates for 3h32m, caused by an expired encryption certificate. funds lost: unknownsource
2026-06-03: Rain platform: partial outage affecting card authorizations for 9 minutes, attributed to operating-system patching at a partner. funds lost: unknownsource
2026-05-05: Rain platform: elevated card declines for 3h10m from a partial outage at its payment processor. funds lost: unknownsource
2026-01-02: Rain platform: elevated card declines for 1h15m from an incident in the processor rules engine; Rain stated funds were safe. funds lost: nosource
Absence of a found incident is not evidence that none occurred.
No Rizon incident report found on getrizon.com, its blog or help centre. The entries are Rain platform incidents from status.rain.xyz (Rizon names Rain as its card provider); the pages do not say which programmes were affected.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Volume transacted (verified only)
Not verifiable
Incumbent: the provider file lists no contracts, so there is nothing a volume spec could be computed over; card settlement runs offchain through the issuer and Visa.
UnreviewedAssessed by AI research agent (operational), 2026-10-09
Group B: institutional due diligence
Control
State
What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?
Unknown
No ISO 27001 statement from Rizon (site, Terms, privacy policy, help centre "How secure is Rizon?"). Rain lists SOC 2 Type II and PCI DSS, not ISO 27001.
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?
Unknown
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?
Attested
Rizon states nothing. Partner (Rain): SOC 2 Type II and PCI DSS, reports available to partners on request through its trust center; not read. Rizon names Rain (Signify Holdings Inc. and its subsidiary Nimbus LLC) as provider of the card, smart contract wallets and transfers, so Rain's security and status pages are recorded as the partner's position. source 1 · source 2
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?
Attested
Rizon says the per-user vault is deployed and maintained by Rain; Rain says its smart contracts are independently audited before launch and per chain. No report is linked and no Rizon contract address is published (CROPS S6 unknown). Nothing covers the Rizon app. source 1 · source 2
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?
Attested
Rizon states nothing. Partner (Rain): a penetration test summary is available to partners through its trust center. Rizon names Rain (Signify Holdings Inc. and its subsidiary Nimbus LLC) as provider of the card, smart contract wallets and transfers, so Rain's security and status pages are recorded as the partner's position. source 1
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?
Evidenced
Rizon states nothing. Partner (Rain): code peer-reviewed and automatically scanned before production; no cadence stated. Rizon names Rain (Signify Holdings Inc. and its subsidiary Nimbus LLC) as provider of the card, smart contract wallets and transfers, so Rain's security and status pages are recorded as the partner's position. source 1
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?
Unknown implied from the component list
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?
Unknown
No patch timelines from Rizon or Rain.
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?
Unknown implied from the component list
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?
Evidenced
Rizon makes no incident-notification commitment in its Terms or privacy policy. Partner (Rain): documented incident response plan that keeps partners informed; no time stated. Rizon names Rain (Signify Holdings Inc. and its subsidiary Nimbus LLC) as provider of the card, smart contract wallets and transfers, so Rain's security and status pages are recorded as the partner's position. source 1
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?
Unknown
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?
Unknown
The help centre says funds stay accessible if Rizon stops operating because the wallet is non-custodial; that is a claim about exit, not a recovery plan (see CROPS S4, unknown).
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?
Evidenced
Rizon publishes no status page. Partner (Rain): status.rain.xyz with incident history; no post-mortems found. Rizon names Rain (Signify Holdings Inc. and its subsidiary Nimbus LLC) as provider of the card, smart contract wallets and transfers, so Rain's security and status pages are recorded as the partner's position. source 1 · source 2
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?
Evidenced
Rizon states it uses multi-factor authentication and biometric login; the Privy wallet uses Face ID, passkeys and biometric verification. The factors and whether MFA is mandatory are not specified. source 1
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?
Unknown
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?
Unknown
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?
Unknown
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?
Unknown
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?
Unknown
No public API documentation; dashboard.getrizon.com is a business login shell (CROPS research log).
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?
Unknown
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?
Unknown
B5.4 Export controls If an API exports data, does it limit volumes and log exports?
Unknown
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?
Evidenced
Rizon: "advanced encryption" (no detail). Partner (Rain): encryption in transit and at rest, PCI DSS for card data. Observed: www.getrizon.com refuses TLS 1.1 and accepts TLS 1.2. No data classification. source 1 · source 2 · source 3
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?
Unknown
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?
Evidenced
Retention table in the privacy policy: AML/KYC data up to 8 years after the relationship ends under Lithuanian AML law (extendable by 2 years); advertising and social media data up to 5 years; marketing until consent is withdrawn. Card data at Rain: five years or longer after closure (Rain policy). source 1 · source 2 CROPS P2
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?
Evidenced
Rizon Global, Inc. processes data under the GDPR and Lithuanian law; the policy does not use the terms controller or processor and makes no DPIA statement. Card issuance data is controlled by Nimbus LLC (Third National) under Rain's policy. source 1 · source 2
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?
Unknown
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?
Unknown
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?
Evidenced
Rizon states nothing. Partner (Rain): security events monitored centrally; no SIEM or endpoint detection named. Rizon names Rain (Signify Holdings Inc. and its subsidiary Nimbus LLC) as provider of the card, smart contract wallets and transfers, so Rain's security and status pages are recorded as the partner's position. source 1
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?
Unknown
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?
Unknown implied from the component list
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?
Unknown implied from the component list
B9.2 CI runs on pull requests Does every pull request trigger automated checks?
Unknown implied from the component list
B9.3 Tests run in CI Do the CI workflows run the test suite?
Unknown implied from the component list
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?
Unknown implied from the component list
B9.5 Versioned releases Are releases tagged with immutable semantic versions?
Unknown implied from the component list
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?
Unknown implied from the component list
B9.7 Changelog Is a changelog maintained with the code?
Unknown implied from the component list
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?
Unknown implied from the component list
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?
Evidenced
Logical view only, in a help article: Privy creates the embedded wallet on the device; deposits go to an onchain vault deployed and maintained by Rain, with the Rizon wallet as its controller. No infrastructure or integration architecture and no contract addresses. source 1
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?
Evidenced
Rizon Global, Inc., a Delaware C corporation (registered agent at 131 Continental Dr, Newark, DE), with Rizon Technologies, UAB (Lithuania) as commercial agent authorised to conclude agreements in its name; the card terms are three-party with the issuer Third National. source 1 · source 2
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?
Evidenced
Customer fees and subscriptions: paid plans (Gold $3.99/month, Emerald $6.99/month per the help centre), card issuance, FX, small-transaction, ATM, trading and payout fees. No financial statements or funding statement found. source 1
B11.3 Termination terms What happens to customer funds and data on termination by either side?
Evidenced
Rizon or its partners may suspend, restrict or terminate the account temporarily or permanently, and may cancel or delay pending transactions including card off-ramp; the user can export the Privy wallet and disconnect once the smart-contract balance is zero. The issuer may cancel the card with or without notice. AML data is kept up to 8 years (B6.3). source 1 · source 2
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?
Evidenced
Rizon says it does not use automated decision-making; its card partner Rain uses automated systems for fraud detection, sanctions screening, transaction monitoring and eligibility. Machine learning is not mentioned by either. source 1 · source 2
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?
Evidenced
Only Rain's override path (human review where law grants it). No monitoring, validation, decommissioning or bias documentation. source 1
Scope of assessment
Components in the payment path
Component
Role
Public
Licence
Operator
Required
Rizon app (iOS, Android)
frontend
No
proprietary
Rizon Global, Inc. (agent Rizon Technologies, UAB)
Yes
Rizon backend
backend
No
proprietary
Rizon Global, Inc.
Yes
Privy embedded wallet (user signer)
signer
No
proprietary
Privy
Yes
Rain collateral smart contract per user (addresses not published)
None found. Absence of public code is itself a finding.
Contracts
None listed.
Assessor notes
Incumbent: no verified contract or public repository needed to run the product was found. Searched: GitHub (repo search "rizon" returns only unrelated projects such as the RIZON Cosmos chain and the Rizon IRC network; orgs rizonapp, rizon-app, rizonmoney, rizonfi and others do not exist); getrizon.com pages, Terms, privacy policy and card terms; the Intercom help centre (legal, deposit, card and wallet collections); dashboard.getrizon.com (business login shell, no contract or chain config). The Terms say each user gets a Rain-managed collateral smart contract, but no Rizon or Rain document gives an address, factory or team id for this program. The card terms' Supported Blockchains (Polygon, Optimism, Arbitrum) are Rain boilerplate and conflict with the help centre's list, and Rain's shared collateral contracts serve many programs, so no onchain contract can be attributed to Rizon (same reasoning as the Avalanche Card file). Card Map and review sites were not used as evidence.
