Unaudited, unvetted, experimental. Do not use as a reference. AI-researched ratings that may be wrong; not advice or a statement of fact about any provider. Full disclaimer
Pending review. 1150 of 1150 ratings not yet checked by a human. Do not rely on unreviewed ratings.
Incumbent rails have no public chain settlement and no public code. They are scored with the same rubric as every other row. Their low ratings show the verifiability gap between rails whose behaviour can be inspected and rails whose behaviour must be trusted; that gap is the point of the comparison, not a claim that the incumbent is unsafe.
Offered everywhere except the countries listed. Checked 2026-10-09. Not scored.
From section 4 of Tria's Prohibited Use Policy (the same text is published as the Prohibitions List, which the platform agreement incorporates). It names sanctioned countries "including, without limitation" Cuba, Iran, North Korea and Syria, plus the Crimea, Donetsk and Luhansk regions of Ukraine (sub-national, not listed as codes), and high-risk jurisdictions "including but not limited to" 21 more countries (Myanmar is named twice). Both lists are open-ended, and the platform agreement also excludes any country subject to EU, UK, UN or US sanctions; only named countries are listed here. Card programme variants: the international card terms require attesting that you are not a US citizen; US users have separate US card terms, which name no state limits.
Section 4 (Sanctions and Restricted Jurisdictions) names the sanctioned and high-risk jurisdictions where the Tria Card may not be applied for or used.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-12
Settlement token
What the balance is held in and debited from. Shown as context; it does not change any rating.
Token
Class
Issuer
Contract
USDCDefault
fiat-backed stablecoin
Circle
Conversion. The token is sold for fiat when a payment is authorised.
Fiat-backed stablecoin. An issuer holds the reserves and can freeze balances at the token contract. Value depends on the issuer redeeming at par. Censorship Resistance records whether that freeze power is disclosed.
Inferred from the Card Terms fee schedule, which charges a "USDC Settlement/Deposit" fee; no Tria page names the card-balance token outright. Top-ups from 1,000+ tokens on Bitcoin, Ethereum, Polygon, Base, Arbitrum, Optimism, BSC, Aptos and Solana are swapped by BestPath into "the required currency" and credited to the card balance, which the Card Terms treat as digital-asset collateral liquidated to repay charges; the help centre says crypto is converted at payment time. The collateral chain and contract are not published.
Checked 2026-10-12
Evidence (3)3 documented
Documented
The International Card Terms fee schedule lists a USDC settlement and deposit fee of up to 1%.
The help centre says a top-up may swap the deposited asset into the currency the card balance requires, and recommends USDC or USDT on L2s as needing the fewest conversion steps.
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Censorship Resistance
Who can block valid use, and can users route around them?
0 FailsPillar rating: weakest of 5 0 of 5 Partial or better
What would raise this pillar
Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-12 7 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Tria and the issuer can block an individual cardholder's transactions and suspend the account with no stated notice. No settlement contracts are published, so no onchain role can be read. Judgment call: documented per-account blocking meets anchor 0.
Evidence (1)1 documented
Documented
International Card Terms s5 let Tria and the issuer block transactions and suspend accounts; no notice period is stated.
Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees? C5
1 Weak
Best evidence: DocumentedChecked 2026-10-12 7 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Chains are enumerated in the card terms only (with an open-ended clause); collateral tokens and their issuers' freeze powers are not listed. Enumerated in docs only, so 1.
Evidence (1)1 documented
Documented
The International Card Terms list Supported Blockchains for collateral (Ethereum, Polygon, Optimism, Arbitrum, others at the issuer's discretion) and let the issuer designate collateral assets; no token list or freeze powers are stated.
Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Nothing in the card stack is public. 0.
Evidence (1)1 verified
Verified
The TriaHQ org has four public repos - this ideathon dataset repo and forks of relay-server, sdk-testing-grounds and rainbowkit; none contains Tria's card, wallet, SDK or backend code. The npm packages tria-sdk-core/tria-sdk-web (2023) point at github.com/TriaHQ/tria-core-sdk, which returns 404, and the @tria-sdk/* packages named in the docs are not on the npm registry.
Do the SDK, widget, or frontend ship analytics, telemetry, error reporting, or fingerprinting? P1
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Analytics and advertising trackers are disclosed in the privacy policy; the app is closed, so default state cannot be checked. Judgment call: disclosed in docs, so 1.
Evidence (1)1 documented
Documented
Privacy Policy s4 discloses third-party analytics and advertising using cookies and persistent identifiers.
Who holds funds between payer and payee, and can the provider redirect them? S1
1 Weak
Best evidence: DocumentedChecked 2026-10-12 7 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Card spending is secured by collateral the issuer can liquidate, disclosed in the card terms. Where the collateral sits and who controls it onchain is not published. Judgment call: disclosed issuer-controlled collateral fits anchor 1 at the documented cap.
Evidence (2)1 documented · 1 claimed
Documented
Card Terms s3 say a Linked Wallet provides digital-asset Collateral securing charges, which the issuer can liquidate if a payment is unpaid after one day or the collateral value falls below charges.
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6
? No evidence
Sets the pillar rating
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No checkable evidence settles this yet, so it counts as 0.
Security audits 1
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
Shared component: Rain EVM collateral contracts v2 (Beacon, Collateral, Coordinator, Factory), private best-efforts contest at 6f578d5b9c Logged because the card is a Rain programme (Third National issuer, collateral on Ethereum, Polygon, Optimism or Arbitrum per the card terms). Tria publishes no collateral contract, so the audited code was not tied to this card. The Rain repo is private; contest ran 2-8 December 2024 on b432939a, 6f578d5 is the fix commit.
Compiled from: docs.tria.so (all pages, including Security and TSS, TX Flow and the card terms; no audit is mentioned), the TriaHQ GitHub org (no card, wallet or SDK code), Rain's security page (audits under NDA, Sherlock named) and the Sherlock report repo (one Rain report). The international card terms carry Rain's name ("Your Rain Payment Card Terms"). No audit of Tria's app, TSS key infrastructure or BestPath routing is published. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.
Operational and procurement
Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.
Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 7 evidenced, 1 attested, 0 absent, 0 not applicable, 37 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.
Group A: operational facts
Fees
Evidenced
Component
Paid by
Amount
Basis
card
payer
Card issue and annual fee: virtual 25 USD, plastic 109 USD, metal 250 USD
International Card Terms and US Cardholder Agreement disclosures (fee disclosure date 31 October 2025); sold as Lite, Pro and Max memberships.
fx
payer
FX up to 3% plus international transactions up to 1% (international terms); US card up to 3%
Card terms. The help centre says Lite and higher memberships pay no Tria FX fee, Visa FX still applies; the terms are the binding ceiling.
cashout
payer
ATM: up to 2 USD + 3% per withdrawal (terms); help centre states 1 USD + 1%; inquiry or decline up to 2 USD
Card terms disclosures and help article 14780504 disagree; both recorded.
provider
payer
Card top-up - no Tria service fee; provider fee for swaps and bridging shown in app
Help article 14854432; the international card terms also allow a USDC settlement or deposit fee of up to 1%.
limit
none
ATM 750 USD per transaction, 3 per 24 hours; top-up minimum 10 USD (50 USD for BTC)
Help articles 14780504 and 14056654; spending limit equals posted collateral.
Fees in the card terms are maxima ("up to"); interest is 0% and late, returned and over-limit fees are not charged. Gas for top-ups is sponsored on most chains (not Solana or Tron).
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-12
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Custody model
Evidenced
Hybrid: self-custody with a provider-controlled spend path
The Tria wallet is self-custodial (TSS keys; Tria disclaims custody), but card spending is backed by collateral posted from a linked wallet that the issuer can liquidate, and top-ups move funds into a card balance under the issuer's programme. Agrees with the S1 finding.
Licensed microfinance bank marketing the card in Nigeria (as stated in the card terms)
Tria (Threely Dimensions Inc.) says it is not a bank, money services business or card issuer and claims no licence. None of the partner licences was confirmed in a register: FDIC BankFind lists no active institution named Third National (2026-10-09); Nimbus, LLC is not a bank and no licence is stated for it; the Central Bank of Nigeria register was not checked.
Up to 2 USD + 3% (terms); 1 USD + 1% (help centre)
750 USD per transaction, 3 per 24 hours; select "Credit" at the ATM; local ATM caps apply.
ALL means every country not on the provider file's blocklist. Card eligibility is narrower in practice: the card application checks the country of residence against an unpublished supported list (help article 14056678). No bank off-ramp to fiat accounts was found in the help centre or terms.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-12
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
First deployment
Evidenced
2025-10-31: Fee Disclosure Date of the Tria card terms, the earliest dated card document found (terms effective date, not a confirmed launch date).
No dated launch announcement of the Tria card was found (www.tria.so is client-rendered with no newsroom; help articles carry 2026 update dates). The card may have launched earlier.
Documented
International Card Terms, Important Disclosures effective date.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-12
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Operating entity
Evidenced
Threely Dimensions Inc., US-DE
Jurisdiction inferred from the Delaware governing-law and venue clause; incorporation state not stated and not checked in the Delaware Division of Corporations search (interactive). SEC EDGAR full-text search returned no filings for the name.
Documented
Terms of Service naming the contracting entity; governed by Delaware law.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Security incidents
Unknown
Absence of a found incident is not evidence that none occurred.
No incident report or status page found on www.tria.so, docs.tria.so or help.tria.so. Searched 2026-10-09.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Product changes affecting users
Evidenced
2025-10-31: Card fee disclosures take effect (memberships 25, 109 and 250 USD; FX and ATM fee ceilings). source
2026-01-09: International Card Terms updated, naming Nimbus, LLC as issuer (the platform agreement still names Third National, LLC and partners as Card Program Providers); US Cardholder Agreement with Third National updated the same day. source
Not listed because undated - the Security and TSS, TX Flow and protocol docs pages, public when the CROPS seed was researched on 2026-10-07, were password-protected by 2026-10-09 (see B10.1).
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-12
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Volume transacted (verified only)
Not verifiable
No listed contracts; the collateral chain and addresses are not published (provider file notes), and card settlement runs through the issuers' closed systems.
UnreviewedAssessed by AI research agent (operational), 2026-10-09
Group B: institutional due diligence
Control
State
What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?
Unknown
No ISO 27001 statement found in Tria's legal pages (docs.tria.so terms, privacy policy, card terms, prohibited use policy), the 25 articles at help.tria.so or www.tria.so. The "Security and TSS" docs page is now password-protected and was not read.
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?
Unknown
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?
Unknown
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?
Unknown
No independent code review report found; CROPS S6 is unknown for this provider.
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?
Unknown
No penetration-test report or bug bounty found; www.tria.so/.well-known/security.txt returns 404.
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?
Unknown
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?
Unknown implied from the component list
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?
Unknown
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?
Unknown implied from the component list
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?
Unknown
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?
Unknown
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?
Unknown
The help centre describes the wallet as non-custodial; no recovery plan for the card service or for collateral held under the card programme was found.
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?
Unknown
No status page found (status.tria.so does not resolve) and no post-mortems found.
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?
Evidenced
Login with a Google or Apple account, with an optional secondary email for recovery; card number and CVV are revealed only after a device biometric check. No separate second factor for login is described. source 1 · source 2
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?
Unknown
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?
Unknown
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?
Unknown
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?
Unknown
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?
Unknown
The public SDK docs (CoreSDK, React and React Native references) cover wallet onboarding with SSO and passkeys; no card API is documented, and the TX Flow and protocol pages are password-protected.
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?
Unknown
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?
Unknown
B5.4 Export controls If an API exports data, does it limit volumes and log exports?
Unknown
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?
Evidenced
The privacy policy states encryption at rest and in transit with reasonable procedural, physical and electronic safeguards; no data classification is stated. Observed: www.tria.so refuses TLS 1.1 and accepts TLS 1.2. source 1 · source 2
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?
Unknown
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?
Evidenced
Retention "as long as necessary", set case by case by type of data, purpose and legal reason; no periods are given. On termination Tria may delete or deactivate the account and related information. See CROPS P2 for what is collected. source 1 CROPS P2
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?
Evidenced
The privacy policy is issued by Threely Dimensions, Inc. without using controller or processor terms; Sumsub is named for biometric identity checks, and the card terms point to the issuer's privacy notice hosted by Rain (legal.raincards.xyz). No DPIA statement found. source 1
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?
Unknown
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?
Unknown
The protected docs pages say access to them is logged; nothing is stated about logging of customer accounts or activity.
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?
Unknown
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?
Unknown
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?
Unknown implied from the component list
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?
Unknown implied from the component list
B9.2 CI runs on pull requests Does every pull request trigger automated checks?
Unknown implied from the component list
B9.3 Tests run in CI Do the CI workflows run the test suite?
Unknown implied from the component list
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?
Unknown implied from the component list
B9.5 Versioned releases Are releases tagged with immutable semantic versions?
Unknown implied from the component list
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?
Unknown implied from the component list
B9.7 Changelog Is a changelog maintained with the code?
Unknown implied from the component list
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?
Unknown implied from the component list
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?
Attested
Tria's architecture pages (Protocol Construct, Security and TSS, TX Flow, BestPath) exist on docs.tria.so but are now password-protected for authorised readers, with a password from a Tria representative. They were public when the CROPS seed was researched on 2026-10-07; the card stack (issuer, collateral contracts) was not described in them. source 1
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?
Evidenced
Threely Dimensions Inc. (Tria), Delaware law and courts. Card issuers differ by programme: Third National for the US card, Nimbus, LLC (a Delaware company) for the international card, with BANEX Microfinance Bank marketing the card in Nigeria. No company register entry found. source 1 · source 2 · source 3
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?
Evidenced
Annual card memberships (Lite/virtual 25 USD, Pro/plastic 109 USD, Max/metal 250 USD) and card transaction, FX and ATM fees. No financial statements found. source 1
B11.3 Termination terms What happens to customer funds and data on termination by either side?
Evidenced
Tria and/or the issuer may suspend, revoke or cancel card privileges at any time with or without cause or notice, and termination does not end the obligation to repay; collateral can be liquidated if a payment is more than one day late or its value falls below charges. Tria may modify or discontinue the Services at any time and on termination may block the wallet address and delete or deactivate the account and its information. source 1 · source 2
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?
Unknown
No statement on AI or automated decision-making in payments or compliance found in the privacy policy, terms or help centre. The help centre describes automatic routing of top-up swaps (BestPath), which is not described as AI.
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?
Unknown
Scope of assessment
Components in the payment path
Component
Role
Public
Licence
Operator
Required
Tria app and backend (web and mobile, card management, BestPath routing)
backend
No
proprietary
Threely Dimensions, Inc. (Tria)
Yes
Tria TSS wallet key infrastructure
wallet
No
proprietary
Tria
Yes
Third National, LLC and partner Card Program Providers (issuer, collateral)
card-issuer
No
proprietary
Third National, LLC and partners
Yes
Visa (card network)
card-network
No
proprietary
Visa
Yes
Sumsub (identity verification, biometrics)
kyc
No
proprietary
Sumsub
Yes
Collateral contracts (chain and addresses not published)
contracts
No
proprietary
Card Program Providers
Yes
Repositories
None found. Absence of public code is itself a finding.
Contracts
None listed.
Assessor notes
Eligibility: no public repository needed to run the product and no published or verified contract, so type is incumbent. Searched 2026-10-07: GitHub org TriaHQ (four repos: an ideathon dataset and forks of relay-server, sdk-testing-grounds, tria-rainbowkit); tria-labs/TriaLabs (unrelated Tria Labs, triafed.com) and triaso (0 repos); gh search repos "tria sdk" (unrelated projects); npm @tria-sdk/core, connect, authenticate(-react/-web), react-native, chains, utils, constants (all 404) and legacy tria-sdk-core/tria-sdk-web 2023 (repository github.com/TriaHQ/tria-core-sdk, 404); docs.tria.so (54 pages incl. CoreSDK, BestPath, Security and TSS, TX Flow, supported networks, all legal pages; only example wallet addresses in SDK samples, no card or collateral contracts); www.tria.so (client-rendered shell). The card terms are a collateral-backed Third National program with a generic Supported Blockchains list; the collateral chain and contracts are not published, so no onchain cell could be scored.
