Unaudited, unvetted, experimental. Do not use as a reference. AI-researched ratings that may be wrong; not advice or a statement of fact about any provider. Full disclaimer
Pending review. 1150 of 1150 ratings not yet checked by a human. Do not rely on unreviewed ratings.
Ratings apply to this deployment only. Treat them as unverified for other chains. Why this deployment: SafePal's card page says the card and IBAN are offered with Fiat24 and that transactions are made on Arbitrum. Onchain, Fiat24Account.walletProviderMap(8026) = "SafePal", and SafePal-referred accounts (e.g. #75546) are debited by Fiat24CardAuthorization 0xe2e3B88B... on Arbitrum. Reads pinned to block 512546136. Excluded: Fiat24's Mantle deployment (SafePal names only Arbitrum) and the SafePal wallet app (closed).
Offered only in the countries listed. Checked 2026-10-09. Not scored.
The 42 listed places are those SafePal's regions page marks "with Mastercard support" (its getMasterCountries list); they match Fiat24's own card-eligible domicile list (info.fiat24.com/api/fiat24/getCountries) exactly. SafePal's wider IBAN-only list adds 19 domiciles with a $1,000/month limit and no card (AD, AM, AR, BD, CL, CO, CR, DM, DO, GE, HR, ID, MK, MX, PE, SM, TH, TR, UY); Fiat24's own list omits HR. Eligibility also needs citizenship of a supported region per SafePal, and Fiat24 excludes US persons and nationals of Iran, North Korea and Russia. SafePal's FAQ mentions a Mainland China limit, but neither current list includes CN, so CN is not listed. Fiat24 also blocks card payments at merchants in 38 countries (its "restricted payments" list), which limits where the card works, not who can hold it.
SafePal's own API behind its "Supported regions for SafePal Fiat gateway" page (safepal.com/en/bank/regions), list of regions with Mastercard support. Raw response committed because the page is client-rendered.
Conversion. The token is converted into a fiat balance at top-up; card spend comes from that fiat balance.
Platform token. Issued by the provider or its own ecosystem. Its value and liquidity depend on that provider, which may also control supply.
SafePal Card is Fiat24's Mastercard, which spends Fiat24 cash tokens on Arbitrum: USD24, EUR24, CHF24 and CNH24 (RMB). They are tokenised deposits issued by SR Saphirstein AG (Fiat24), the card issuer, backed one-to-one by cash deposits; transfers are gated by Fiat24's KYC status and sanctions checks, so they are classed as platform tokens rather than freely circulating stablecoins. Crypto becomes fiat at top-up: the wallet swaps the user's asset into Arbitrum USDC and Fiat24's top-up contract converts it into a cash token. At spend, Fiat24's card-authorisation contract debits the balance in the transaction currency if Direct Pay is on for it; otherwise it converts from the user-selected default card currency. No default is fixed by Fiat24.
Checked 2026-10-12
Evidence (5)1 verified · 4 documented
Verified
Fiat24CardAuthorization validXXX24Tokens() returns true for USD24, CHF24, EUR24 and CNH24 (EUR24 check shown).
Fiat24's developer guide names the four cash tokens, their issuer and their deposit backing, and lists all four as supported for the debit card on Arbitrum.
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Documented
Spending rules; the matching currency balance is charged first (Direct Pay), otherwise the user's chosen default card currency is converted and debited.
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Censorship Resistance
Who can block valid use, and can users route around them?
0 FailsPillar rating: weakest of 5 1 of 5 Partial or better
What would raise this pillar
Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
Neutral settlement, disclosed filtering reaching Weak: Edge filtering is disclosed in docs only, or the neutrality of the settlement layer cannot be shown from code.
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
A single EOA holds the admin and operator roles on the card authorizer and the cash tokens. It can pause card authorizations or all transfers of a currency, and Fiat24 operators can set an individual account to Soft- or Hard-Blocked, which the token contract enforces on every transfer. The terms allow card blocks and account suspension without notice. EOA-held role that can target individual accounts with no notice, so 0.
Evidence (5)3 verified · 2 documented
Verified
EUR24 hasRole(OPERATOR_ROLE, 0x1272c99bEFa7a70f935Edca81BF9a6E85C6D9D59) = true; that address is an EOA (no code, nonce 1350) and also holds DEFAULT_ADMIN_ROLE, which can pause() the token. In the Sourcify-verified Fiat24Token source, transfers require the Fiat24Account status to be Live, and an operator can sendToSundry() any holder's balance.
Fiat24CardAuthorization hasRole(DEFAULT_ADMIN_ROLE, 0x1272...9D59) = true and the same EOA holds OPERATOR_ROLE, which can pause() every card authorization; paused() = false at this block.
Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer? C2
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Card settlement is a pull executed only by Fiat24's authorizer key after the card network authorizes the payment. Neither the cardholder nor the merchant can settle a card payment by calling the contract. Plain token transfers between Fiat24 accounts are a separate P2P feature, not card settlement.
Evidence (2)2 verified
Verified
authorize(), increment(), advice() and reverse() in the verified Fiat24CardAuthorizationMarqeta implementation each revert unless msg.sender has AUTHORIZER_ROLE; hasRole(AUTHORIZER_ROLE, 0xec659e857089E301C87965ED4839B74Ea835755a) = true, and that address is an EOA with nonce 7130096.
A sample card payment (tx 0x568b9d28...e21f, within the 100,000 blocks before the pinned block) is authorize() sent by the authorizer EOA, carrying a Marqeta card id ("MQ-730612-CARD-...") and moving USD24 from account
Does the payment flow require a relayer, paymaster, bundler, or API that only the provider runs? C3
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Every card payment needs Fiat24's closed authorization service and key, Marqeta processing and Mastercard. None is public, and there is no fallback operator. Closed and single-vendor, so 0.
Evidence (2)1 verified · 1 documented
Verified
The only observed caller of authorize() is this EOA (nonce 7130096), Fiat24's card authorizer; no code for the service that drives it is public.
Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Address filtering sits inside the settlement layer itself: the cash tokens check an onchain sanctions oracle and the account's KYC status on every transfer, including the card pull. Judgment call: the check is visible in Sourcify-verified source, but no Fiat24 or SafePal document discloses contract-level screening or its list source, so this takes the lower anchor, 0, rather than 1.
Evidence (2)1 verified · 1 documented
Verified
EUR24 sanctionCheck() = true and sanctionContract() = 0x40C57923924B5c5c5455c48D93317139ADDaC8fb (Sourcify-verified SanctionsList); the verified tokenTransferAllowed() reverts any transfer to or from a listed address and requires Live account status for the sender.
Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees? C5
2 Partial
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The four cash tokens are enumerated in the contract and in Fiat24's developer docs. Users are told about one freeze case (sending tokens to an unregistered address) but not about the issuer's operator powers, the sanctions oracle or Arbitrum's sequencer. Judgment call: a partial freeze statement does not meet "stated to payees", so 2.
Evidence (2)1 verified · 1 documented
Verified
validXXX24Tokens() returns true for USD24 0xbE00f3db..., CHF24 0xd41F1f0c..., EUR24 0x2c5d06f5... and CNH24 0x7288Ac74...; these are the card's settlement currencies.
SafePal's FAQ tells users that cash tokens sent to an unregistered wallet are frozen; it does not mention operator freezes, sanctions screening or Arbitrum sequencer assumptions.
Does the deployed bytecode match public source, and can a third party rebuild it? O1
2 Partial
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The settlement contracts are verified on Sourcify, mostly as partial (metadata) matches; CHF24 is a partial match and the CNH24 proxy is not on Sourcify. No public repository or build script reproduces the bytecode. Partial match without a build script, so 2.
Evidence (1)1 verified
Verified
Sourcify: card authorizer proxy exact_match, implementation 0x96AA3D05... match (partial); EUR24 and USD24 proxies and implementations (0x7aFe16b7..., 0x98BEC5F5...) match (partial); Fiat24Account proxy exact_match, implementation 0x78726B1e... match; ProxyAdmin 0x50873C85... match. Implementation slots read at the pinned block.
Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2
1 Weak
Best evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Only the contracts are public (through Sourcify). The SafePal card screens, Fiat24's backend, the authorizer and the API are closed, and no SDK is published. Contracts only, so 1.
Evidence (2)2 verified
Verified
SafePal's only public app repo (a 2024 "core version" Flutter app) has no Fiat24, bank or card code; GitHub users fiat24, Fiat24, fiat24-ag and fiat24ag return 404.
Are ABIs, event schemas, an API schema, and a payee data export in a non-proprietary format all in the repo? O4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Interfaces are documented on a hosted docs site, not versioned in a repo. No payee export format is specified. Documented only, so 1.
Evidence (1)1 documented
Documented
Fiat24's developer guide documents contract addresses and functions (approve, authorize flow, payouts, top-up) on a hosted docs site, with the API reference on a separate hosted page.
Does every repository needed to run the product carry an OSI-approved license? F1
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Required components (authorizer, backend, card processing, issuer) are closed, so F1 is 0. The verified contracts carry MIT SPDX headers, but they are not in any public repo.
Evidence (1)1 documented
Documented
Fiat24 grants users only a limited, non-transferable licence to its web app and API; the backend, authorizer and card processing have no published source.
Does a production deployment need a proprietary plugin or hosted-only service? F3
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The card cannot run without Fiat24's hosted authorizer, backend and card processor, none of which has an open alternative. Core cannot run without proprietary components, so 0.
Evidence (1)1 verified
Verified
Card debits only run through authorize() called by Fiat24's AUTHORIZER_ROLE key; the contracts alone cannot process a card payment.
Do the SDK, widget, or frontend ship analytics, telemetry, error reporting, or fingerprinting? P1
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Analytics is disclosed for Fiat24's web surfaces. The SafePal app, where SafePal users manage the card, is closed and was not traced, and SafePal's own privacy policy names no analytics vendor. Documented cap, so 1.
Evidence (1)1 documented
Documented
Fiat24's privacy policy discloses Google Analytics and Google Tag Manager on its site and web app.
Does the flow collect anything beyond addresses, amounts, token, and chain? P2
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Full KYC is required and disclosed in Fiat24's policy and SafePal's FAQ; the legal basis (Swiss AML) is stated in the terms but not limited in code or a repo document. Disclosed in policy, so 1.
Evidence (2)2 documented
Documented
Fiat24 collects identity documents, contact data and transaction data for onboarding.
What do calldata and events reveal about who paid whom for what? P3
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Every card spend is public and linked to the cardholder's account number, address, card id and amount, though not to the merchant. The linkage is disclosed in the terms. Account tags in events, disclosed, so 1.
Evidence (2)1 verified · 1 documented
Verified
The Authorized event indexes the account number (#730612) and holder address, and logs the card id, currency and amount; the calldata also carries the transaction currency and amount. Fiat24 account numbers map to Swiss IBANs.
Which third parties see a request during a payment, and can they be swapped out? P4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Third parties in the card flow (Fiat24, Marqeta, Mastercard, the KYC vendor) are disclosed by category in Fiat24's policy, and none can be swapped. No trace was run. Docs only, so 1.
Evidence (1)1 documented
Documented
The policy discloses sharing with service providers (payment processing, customer service and others) and for KYC and AML compliance, by category; Marqeta appears only in the contract name, and the sanctions oracle is not mentioned.
Who holds funds between payer and payee, and can the provider redirect them? S1
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The card balance is a Fiat24 deposit represented by tokens in the user's address, not an asset the user controls: the issuer's operator EOA can move any balance, and card pulls land in Fiat24-held EOAs. "Self-custody" here means only that the wallet key signs; the provider can redirect funds, so 0.
Evidence (2)1 verified · 1 documented
Verified
In the verified Fiat24Token source, sendToSundry(from, amount) lets any OPERATOR_ROLE holder move a holder's balance to the sundry account
Who can change the contract code, and with how much notice? S2
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Every settlement contract is upgradeable at once by a single EOA, with no timelock. EOA admin, so 0.
Evidence (2)2 verified
Verified
The EIP-1967 admin slot of the card authorizer, EUR24, USD24 and Fiat24Account proxies all hold ProxyAdmin 0x50873C85...; its owner() is EOA 0x1272c99bEFa7a70f935Edca81BF9a6E85C6D9D59. No timelock or Safe sits in between.
How large an allowance does the SDK ask users to grant, and for how long? S3
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Most SafePal cardholders have an unlimited allowance to the authorizer, which only Fiat24's key can spend through. Neither SafePal nor Fiat24 discloses that. Judgment call: the app's default is inferred from onchain allowances, not from SafePal code (closed); 10 of 12 sampled accounts are unbounded, so "unbounded, undisclosed", 0.
Evidence (2)1 verified · 1 documented
Verified
USD24 allowance(0x259bB9f8b01C7C818dFfe2d998b93c2Ef6b0fC1B, card authorizer) = 2^256-1 for SafePal-referred account
If the provider disappears tomorrow, do payees keep their funds and the ability to keep settling? S4
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Derived. S1 = 0 (operator can move balances), C2 = 0 (only Fiat24's key settles), C3 = 0 (closed single-vendor backend), O3 unknown. The balance is a deposit claim on Fiat24; turning it back into money needs Fiat24's payout operator, and even token transfers depend on Fiat24-set account status. Funds depend on provider liveness, so 0.
Evidence (1)1 verified
Verified
Cash-token transfers require a Live sender status set by Fiat24 operators, and cash payouts to a bank account need Fiat24's CASH_OPERATOR_ROLE to complete (cashPayoutOK).
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6
? No evidence
Sets the pillar rating
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No checkable evidence settles this yet, so it counts as 0.
Security audits 3
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
Shared Fiat24 contracts, Mantle's fork: fee manager, Arbitrum and Tempo deposit paths via LayerZero, DelegationVault, batch double-booking in Fiat24CardAuthorizationMarqeta, BufferPool, CryptoRelay and Fiat24Token changes since ad90880. at 66f0ff1590 Reviews changes made in Mantle's private fork; the Arbitrum contracts this file scores do not contain them.
Shared Fiat24 contracts, Mantle's fork: new DelegationVault, double-booking in Fiat24CardAuthorizationMarqeta and Fiat24CryptoDeposit_Avax (changes since b670bb8). at ad908801e2 Reviews changes made in Mantle's private fork; the Arbitrum card authorizer has no double-booking functions.
No
1 medium and 1 low, both fixed; 5 recommendations, 3 notes
Shared Fiat24 contracts, Mantle's fork: Fiat24CryptoDeposit (and variants), Fiat24CardAuthorizationMarqeta (card authorize/increment/reverse), Fiat24CryptoRelay, FiatTokenBeacon and FiatTokenFactory. at 8fa9f76352 Same contract names and card functions (authorize, increment) as the Arbitrum implementation 0x96AA3D05..., but the audited private repository cannot be compared with the Arbitrum source, so whether the deployed card authorizer matches is unknown.
Unknown
1 high (fixed), 2 medium, 6 low, 6 recommendations, 7 notes; most medium and low confirmed rather than fixed
Compiled from: SafePal's card page and support FAQ (no audit mentioned), Fiat24's developer and legal docs (no audit or security page), GitHub (no public Fiat24 contracts repository; the Arbitrum sources are on Sourcify only), and auditor portfolios. The only published reports found are BlockSec's three audits of Mantle's fork of the Fiat24 contracts (private repository mantle-xyz/fiat24contracts, client Mantle), listed below as the closest shared code. None is stated to cover the Arbitrum deployment: the Arbitrum Fiat24CardAuthorizationMarqeta implementation 0x96AA3D05... was deployed at block 276754432 (November 2024) and lacks the double-booking functions the 2026 reports review. No report was found for Fiat24Account, the cash tokens' Arbitrum code or the ProxyAdmin set-up. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.
Operational and procurement
Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.
Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 7 evidenced, 0 attested, 0 absent, 0 not applicable, 38 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.
Group A: operational facts
Fees
Evidenced
Component
Paid by
Amount
Basis
provider
payer
deposit and crypto top-up 0% (standard)
SafePal fee article (updated 25 July 2026); SafePal's card page still says top-up fees from 0.4% and fiat transfer and deposit fees from 0.6%.
fx
payer
1% on Mastercard transactions settled in non-USD currencies
SafePal fee article; the Fiat24 manual says a matching currency balance is charged first.
card
payer
refund processing 1 USD / 1 EUR / 1 CHF / 7 CNH per card refund; no account opening or management fee
SafePal fee article and Fiat24 MasterCard Debit manual.
cashout
payer
payout to own bank free (min 100 EUR or CHF); 10 EUR or 10 CHF if the payout is returned
Fiat24 Cash Payout manual; SafePal says IBAN transfers to external banks are free.
limit
none
card 1,600 EUR a day contactless, 5,000 EUR a day other; new individual accounts 30,000 USD a month
SafePal card page FAQ and Fiat24 Individual Account manual (from 5 June 2026).
network
payer
Arbitrum gas on every transaction
SafePal fee article (all transactions are onchain).
Contradiction: SafePal's card page advertises top-up fees from 0.4% and fiat fees from 0.6%, while the fee article it links (updated 25 July 2026) sets the standard deposit and top-up fee at 0%. Recorded as the fee article states; the more recent and more specific source. Fiat24's Terms (section 11) also say crypto top-ups carry a percentage fee per its Pricing page.
Documented
SafePal help centre, Fee Rates for the SafePal Fiat Gateway and Mastercard (linked from the card page as the Pricing and Fee disclosures).
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Custody model
Evidenced
Provider-custodial
The card spends Fiat24 cash tokens, which are claims on client deposits at SR Saphirstein AG; they sit in the user's address but Fiat24 operators can move any balance (sendToSundry) and card pulls go to Fiat24-held accounts (S1 = 0).
FinTech licence under Article 1b of the Swiss Banking Act Accepts client deposits (not covered by Swiss deposit protection, no interest); issues the Mastercard debit card and Swiss IBAN account
SafePal holds no licence for this product; its page says Fiat24 solely handles compliance and licensing. The FINMA entry gives no licence number or date. Card processing by Marqeta and the Mastercard principal membership behind the BIN were not checked.
Documented
FINMA authorised-institutions search for "Saphirstein" (client-rendered; result read in a browser and archived) lists SR Saphirstein AG, Zurich, under licensed persons pursuant to Article 1b BA (FinTech licence).
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Cash-out options
Evidenced
Where
Method
Partner
Fee
Limits
everywhere offered
card withdrawal
Fiat24 (issuer), Mastercard
1% FX on non-USD settlement
Virtual card only, spend at merchants and via Apple Pay or Google Pay (the schema has no card-spend value); 1,600 EUR a day contactless, 5,000 EUR a day other.
everywhere offered
bank transfer
Fiat24 (Swiss IBAN account)
free; 10 EUR or 10 CHF if returned
EUR or CHF payout to up to 10 registered accounts per currency in the client's name; minimum 100 EUR or CHF.
ALL means every country in the availability list (42 Mastercard regions per SafePal). No ATM route is documented; the card is virtual without a PIN. The wider IBAN-only region list has a 1,000 USD monthly limit and no card.
Documented
Fiat24 user manual, MasterCard Debit (virtual only, no PIN; Apple Pay and Google Pay).
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
First deployment
Evidenced
2024-11-12 (block 273715521): Fiat24CardAuthorization proxy 0xe2e3B88B...5b14 on Arbitrum One (card debits); the Fiat24Account NFT dates from 16 January 2022
Read from the creation receipt rather than code size at the prior block, because arb1.arbitrum.io does not serve historical state. The card authoriser may have replaced an earlier one; earlier card contracts were not traced. SafePal's card offering date was not found in a primary source.
Verified
The receipt of tx 0x53392365...57a7 (status 1, from Fiat24 admin EOA 0x1272c99b...9D59) has contractAddress 0xe2e3B88B...5b14 at block 273715521 (2024-11-12 14:08:51 UTC); Sourcify's deployment record agrees. Fiat24Account NFT 0x133CAEec... was created at block 4699178 (2022-01-16 14:39:24 UTC, tx 0x758b303c...ca48).
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Operating entity
Evidenced
SR Saphirstein AG, CH-ZH · CHE-256.014.995 · register
The contracting party for the account and card is Fiat24 (SR Saphirstein AG), not SafePal. SafePal's own legal entity was not identified in a primary source.
Documented
Swiss UID register, SR Saphirstein AG (SR Saphirstein Ltd), Aktiengesellschaft, Bellerivestrasse 245, 8008 Zurich; UID and commercial register status active, register reference CH-020.3.046.001-4.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Security incidents
Unknown
Absence of a found incident is not evidence that none occurred.
No incident notice or post-mortem was found in SafePal's help centre (Fiat Gateway section) or Fiat24's user manual and legal pages; neither publishes a status page that was found.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Product changes affecting users
Evidenced
2026-06-05: Fiat24 caps new individual accounts at 30,000 USD of transactions a month after an internal policy change and stops accepting limit upgrades. source
Upgrades of the card authoriser proxy were not listed because Arbiscan and arbitrum.blockscout.com refuse scripted requests.
Documented
Fiat24 user manual, Individual Account, Monthly Limit.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Volume transacted (verified only)
Not observable
Card debits are Authorized events on the shared Fiat24CardAuthorization contract, which serves every Fiat24 wallet provider (Bitget, SafePal and others). SafePal's share needs a walletProvider lookup per account (walletProviderMap 8026), which the spec format cannot express.
UnreviewedAssessed by AI research agent (operational), 2026-10-09
Group B: institutional due diligence
Control
State
What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?
Unknown
Fiat24's documents mention no audit or bug bounty (CROPS S6 unknown); SafePal's wallet app is closed and not reviewed here.
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?
Unknown implied from the component list
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?
Unknown implied from the component list
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?
Evidenced
Account access is by the cardholder's own Arbitrum wallet holding the Fiat24 account NFT (no separate login factor is documented); online card purchases are confirmed with a one-time password sent by email. source 1 · source 2
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B5.4 Export controls If an API exports data, does it limit volumes and log exports?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?
Evidenced
Fiat24 states only that it uses industry standard security measures; no data classification, encryption at rest or TLS commitment is published. source 1
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?
Evidenced
Information is kept as long as necessary for the stated purposes and as required by law, then deleted or de-identified; no period is stated (see CROPS P2 for what is collected). source 1 CROPS P2
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?
Evidenced
SR Saphirstein AG (Fiat24), Zurich, is the company responsible under its privacy policy; SafePal's own role as wallet front end is not described there. DPIA availability not found. source 1
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?
Unknown implied from the component list
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?
Unknown implied from the component list
B9.2 CI runs on pull requests Does every pull request trigger automated checks?
Unknown implied from the component list
B9.3 Tests run in CI Do the CI workflows run the test suite?
Unknown implied from the component list
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?
Unknown implied from the component list
B9.5 Versioned releases Are releases tagged with immutable semantic versions?
Unknown implied from the component list
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?
Unknown implied from the component list
B9.7 Changelog Is a changelog maintained with the code?
Unknown implied from the component list
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?
Unknown implied from the component list
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?
Evidenced
Fiat24's developer guide documents contract addresses, functions and the card authorisation flow (integration and part of the logical architecture); infrastructure architecture and SafePal's app are not documented. CROPS O4
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?
Evidenced
SR Saphirstein AG (Fiat24), Zurich, Switzerland (CHE-256.014.995) provides the account and the card; SafePal says Fiat24 solely handles compliance and licensing. source 1 · source 2 · source 3
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B11.3 Termination terms What happens to customer funds and data on termination by either side?
Evidenced
Fiat24 may close an account with two months' notice (immediately if the balance is zero) or without notice on breach, and may force a payout of the client's assets and close the account on sanctions, PEP, fraud or recall grounds. Deposits are not covered by the Swiss deposit protection scheme. source 1 · source 2 · source 3
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
Scope of assessment
Components in the payment path
Component
Role
Public
Licence
Operator
Required
Fiat24CardAuthorization contract (debits the cardholder's cash tokens)
contracts
Yes
MIT
SR Saphirstein AG (Fiat24); admin EOA 0x1272...9D59
Yes
Fiat24 cash tokens EUR24, USD24, CHF24, CNH24 and Fiat24Account NFT
ledger
Yes
MIT
SR Saphirstein AG (Fiat24)
Yes
Fiat24 card authorizer key (sole AUTHORIZER_ROLE holder, an EOA)
signer
No
proprietary
SR Saphirstein AG (Fiat24)
Yes
Fiat24 backend and API (api.fiat24.com; KYC, status, payouts)
backend
No
proprietary
SR Saphirstein AG (Fiat24)
Yes
Marqeta card processing (named in the authorizer contract)
other
No
proprietary
Marqeta
Yes
Fiat24 (SR Saphirstein AG) as card issuer and account provider
SafePal Card is the Fiat24 Mastercard and Swiss IBAN account offered inside the SafePal app. The "self-custody" framing is a claim: the card spends Fiat24 cash tokens (EUR24, USD24, CHF24, CNH24) that sit in the user's Arbitrum address but are issued, gated and movable by Fiat24, and card debits are pulled by Fiat24's authorizer key. The SafePal link is onchain: Fiat24Account.walletProviderMap(8026) returns "SafePal", and SafePal-referred accounts appear among card payers. All reads are pinned to Arbitrum block 512546136; Arbiscan returns 403 to scripted requests, so explorer links point to Blockscout and Sourcify. Neither SafePal nor Fiat24 publishes a repo for the card. No browser trace was run.
