Unaudited, unvetted, experimental. Do not use as a reference. AI-researched ratings that may be wrong; not advice or a statement of fact about any provider. Full disclaimer
Pending review. 1150 of 1150 ratings not yet checked by a human. Do not rely on unreviewed ratings.
Ratings apply to this deployment only. Treat them as unverified for other chains. Why this deployment: Tuyo's FAQ says "The Tuyo Card and account services operate on Base" and the card guide says the card is powered by USDC on Base. Tuyo's recovery guide names the account contracts on Base: Kernel 3.2 implementation 0xD830D15D... and ECDSA validator 0x845ADb2C... (ZeroDev). Excluded: Ethereum, Arbitrum, BSC and Polygon, which are deposit and withdraw networks only. I could not identify a sample Tuyo account or its card collateral contract, so per-account onchain cells are unknown.
Offered everywhere except the countries listed. Checked 2026-10-09. Not scored.
Two layers, both from Tuyo's help guides (verified by Tuyo on 16 July 2026 against its Prohibitions page, last updated 15 July 2026). The 27 platform-wide prohibited jurisdictions block all Tuyo services, the card included. The card provider adds issuance exceptions; of these only Israel and Nicaragua are not already platform-wide prohibitions. The card provider also blocks card payments (spending) in CU, IR, KP, RU, SY, UA and VE. In the US, the card cannot be issued to residents of Arizona, Delaware, Georgia, Idaho, Louisiana, Maryland, Mississippi, Missouri, Nevada, New Mexico, North Dakota, Ohio, Oregon, Rhode Island, South Dakota, Tennessee, Vermont, Washington, Wisconsin or the District of Columbia. Puerto Rico, the U.S. Virgin Islands, American Samoa, Guam and the Northern Mariana Islands are also excluded. They have their own ISO codes, so they are in the list. The Terms of Service add a general exclusion of US-embargoed or sanctioned jurisdictions without naming them.
Tuyo's platform-wide prohibited jurisdictions table, which applies to the card. It lists 27 countries, from Afghanistan to Yemen, including the United Kingdom.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
The card provider's issuance exceptions add Israel and Nicaragua to the platform-wide list. The page also lists the US states and territories where the card cannot be issued.
Conversion. The token is sold for fiat when a payment is authorised.
Fiat-backed stablecoin. An issuer holds the reserves and can freeze balances at the token contract. Value depends on the issuer redeeming at par. Censorship Resistance records whether that freeze power is disclosed.
The card spends only USDC on Base. Other tokens deposited on Base, Ethereum, Arbitrum, BSC or Polygon must be converted to Base USDC in the app first; this is a manual step, not an auto-swap at spend. EURC held in Cash cannot pay by card. The card can also spend USDC sitting in a Tuyo Earn strategy (a yield vault), so the debited position may be a vault share redeemed for USDC at spend; users can turn this off. Fiat received on virtual accounts is converted to USDC (USD, MXN) or EURC (EUR) by Bridge. The card collateral contract was not identified, so the onchain debit path is not confirmed.
Checked 2026-10-12
Evidence (3)3 documented
Documented
Card guide names USDC on Base as the only compatible token, with other deposits converted inside Tuyo.
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Censorship Resistance
Who can block valid use, and can users route around them?
0 FailsPillar rating: weakest of 5 0 of 5 Partial or better
What would raise this pillar
Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Tuyo can suspend an individual's access at its sole discretion, with no notice period stated. The card issuer's own terms were not public to me. The FAQ says withdrawals to the user's own wallet still work when an account is restricted, but that is exit, not payment. Judgment call: per-user suspension with no stated notice meets anchor 0. The account contracts would not support a pause.
Evidence (1)1 documented
Documented
Terms of Service (updated 28 July 2026) s2.1; s3.4 also reserves the right to restrict transaction submission; card use is subject to the unnamed Issuer's terms.
Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Geographic and sanctions filtering is disclosed in docs. The card settlement contracts could not be inspected, so the neutrality of the settlement layer cannot be shown. 1.
Evidence (1)1 documented
Documented
The guide tabulates country and U.S. state exclusions; Terms s2.1 require OFAC and SDN eligibility.
Does the deployed bytecode match public source, and can a third party rebuild it? O1
1 Weak
Best evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The account contracts are partially verified. The card collateral contracts that hold spendable funds were not identified, so not every settlement contract is verified. Some contracts verified, so 1.
Evidence (1)1 verified
Verified
Sourcify reports match (partial, not exact) for the Kernel 3.2 implementation and for the ECDSA validator 0x845ADb2C...; both have code at this block.
Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Only third-party account contracts are public. Tuyo's app, backend and card integration are closed. 1.
Evidence (1)1 verified
Verified
The smart-account contracts (ZeroDev Kernel, tag v3.2) are public; no Tuyo-owned public repo exists (GitHub user "tuyo" has 0 repos; searches found none).
Does the flow collect anything beyond addresses, amounts, token, and chain? P2
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Card KYC is required and its existence is disclosed, but the policy does not list the card KYC fields or a legal basis. Judgment call: disclosed in docs, so 1. It could be 0 because the policy is stale.
Evidence (1)1 documented
Documented
The guide says identity verification and the card provider's review apply; the Privacy Policy lists name, email and bank details for ramps but predates the card and does not describe card KYC.
Which third parties see a request during a payment, and can they be swapped out? P4
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The card provider, issuer, KYC vendor and analytics vendors that see each payment are not named in any Tuyo document I found. Card Map names Rain, but that is a third-party claim. Undisclosed third parties in the flow, so 0.
Evidence (1)1 documented
Documented
Neither the Terms, the Privacy Policy nor the help guides name the card provider, issuer or KYC vendor; only Bridge (ramps) is named.
If the provider disappears tomorrow, do payees keep their funds and the ability to keep settling? S4
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Chain of reasoning. S1 is unknown: the collateral contract was not identified. C2 = 0 and C3 = 0: the card stops without Tuyo and its provider. O3 is unknown: there is no public frontend. Funds in the user's Kernel account are retrievable through a documented manual contract call with the user's own signer, and the Terms say the same. Funds already moved to card collateral may follow the provider's release rules. Documented manual call, so 1.
Evidence (2)1 verified · 1 documented
Verified
execute and upgradeTo are guarded by onlyEntryPointOrSelfOrRoot, which lets a direct caller through when the root validator's hook accepts it; the ECDSA validator accepts its recorded owner.
Tuyo's guide walks the user through calling execute on their Kernel 3.2 account with the mnemonic-derived signer, and warns that funds in collateral contracts need separate release rules.
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6
? No evidence
Sets the pillar rating
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No checkable evidence settles this yet, so it counts as 0.
Security audits 7
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
Shared ZeroDev Kernel component: incremental review of Kernel changes from v3.0 to v3.x (changes only), plus the WebAuthn, MultiChainWebAuthn and Weighted validators and the SpendingLimit hook. Review period 27 May to 9 June 2024; uploaded to the repository in August 2024 as the v3.1 incremental audit. The Kernel 3.2 release (December 2024) changed Kernel.sol, ExecLib and the core managers again after this review.
Partly
3 minor, all in the Weighted validator and SpendingLimit hook; none in the Kernel diff
Shared ZeroDev Kernel component: Kernel v3 KernelFactory and FactoryStaker (filed as kalos_v3_plugins.pdf). at 85617952ec The factory deploys Kernel accounts; which factory Tuyo uses to deploy its accounts was not established.
Shared ZeroDev Kernel component: Kernel v3.0 (ERC-7579) core contracts, including the validation, executor, hook and selector managers, ExecLib and the ECDSA validators. at 8646f2c25f Audited commits 5f08673 and 8646f2c (March 2024, named in the report as zerodevapp/kernel_v3). Tuyo accounts run the Kernel 3.2 implementation 0xD830D15D..., which adds the v3.1 and v3.2 changes on top of the audited v3.0 code; the ECDSA validator is the audited design.
Shared ZeroDev Kernel component: original ZeroDev wallet Kernel (v1), account factory, MinimalAccount and session key plugin. at ae356c5478 Superseded Kernel v1 line, audited in the former ZeroDev-wallet-kernel repository (now zerodevapp/kernel).
No
5 tips, 3 resolved
Compiled from: Tuyo's site and help guides (no audit or security page; no Tuyo-owned contract is published), the audits/ folder of github.com/zerodevapp/kernel at tag v3.2 (cfedcb9, the source of the Kernel 3.2 implementation and ECDSA validator Tuyo names) and v3.3, ZeroDev's docs audits page (points to that folder; the current dev branch for v4 has no audits folder), and the ChainLight and KALOS reports themselves. Left out: KALOS reports on the Recovery/Weighted ECDSA plugin and the WebAuthn plugin, which are not in Tuyo's account path. No published audit was found for the Kernel v3.2 changes (December 2024) or for the card collateral contracts, whose operator Tuyo does not name. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.
Operational and procurement
Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.
Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 10 evidenced, 1 attested, 6 absent, 0 not applicable, 28 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.
1% FX fee on non-USD spend plus 1% abroad fee (card provider) outside the US; up to 2% per purchase
Card guide and FAQ. The international cardholder agreement allows up to 3% FX plus up to 3% cross-border; the US agreement states 1% on international transactions. Fees may change on 30 days' notice.
fx
payer
Ceiling in the international agreement: FX up to 3% and cross-border up to 3%
Tuyo Cardholder Agreement (International), Important Disclosures effective 7 March 2025.
provider
payer
0.25% volume fee on trades; bridging and stablecoin-to-stablecoin trades exempt
Tuyo FAQ.
cashout
payer
ATM: no Tuyo fee stated; ATM operator fees and FX apply and count toward the 250 USD cap
ATM withdrawals guide.
limit
none
Daily card limit up to 50,000 USD for new cards, rising to 100,000 and 200,000 USD with cumulative spend
Card guide and card limits guide.
Bank-transfer (off-ramp) fees and Bridge's conversion charges are not stated in the guides; the app shows them before confirming. The US agreement lists a 2% late-payment fee; the international agreement lists none.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Custody model
Unknown
Not recorded because CROPS S1 is unknown in the provider file and this value must agree with it. Tuyo's own guide now describes the structure: funds rest in the user's Kernel smart account; card funds move to a per-user collateral account (implementation 0x221677d8... on Base, Sourcify exact match) released only with a counterparty signature or by depositor ejection after a cooldown. That reads as hybrid; the provider file's S1 should be re-assessed with this collateral contract before this fact is set.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Microfinance bank licence (as stated by Tuyo) Markets the Tuyo Card to Nigerian users and is responsible for CBN requirements and Nigerian data protection for them.
Attested from Tuyo's agreement only; the CBN register was not reached (its microfinance list page returned no list to curl). The issuer for both programmes is Third National; no Tuyo document states its regulator or licence number, FDIC BankFind lists no active institution of that name, and Puerto Rico's OCIF register was not reachable for sibling providers. Bank accounts are provided by Bridge, whose licences were not checked.
Documented
International cardholder agreement s7.4 Nigerian Users.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Cash-out options
Evidenced
Where
Method
Partner
Fee
Limits
everywhere offered
card spend
Third National (issuer), Visa
1% FX and 1% abroad fee, up to 2%
Virtual card with Apple Pay and Google Pay; daily limit up to 50,000 USD for new cards. Spending blocked in CU, IR, KP, RU, SY, UA, VE.
everywhere offered
atm
Third National (issuer), Visa ATMs
ATM operator fee and FX only
250 USD per withdrawal including surcharge; 3 attempts per rolling 24 h; select Credit and enter the PIN.
everywhere offered
bank transfer
Bridge
not stated (shown in app)
USD (ACH, domestic wire), EUR (SEPA), MXN (SPEI where available); Bridge does not serve 20 listed countries or New York residents.
Contradiction: the international cardholder agreement says cash advances are not available, while the help guide documents ATM withdrawals for the virtual card; the US agreement treats ATM use as a cash advance where enabled. Recorded as the help guide states.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
First deployment
Evidenced
2025-02-25 (block 26827639): CollateralAccount implementation 0x221677d88E507D21b4f7eC4D8D17e0f2FEd526af on Base, named by Tuyo as its card collateral implementation
The collateral implementation is not in the provider file's contracts list (it was not known at seed time); per-user collateral proxies were not enumerated. The card agreements' disclosures are effective from 7 March 2025, consistent with this date.
Verified
Code size is 0 at Base block 26827638 and 9963 bytes at 26827639 (2025-02-25 00:50:25 UTC); Sourcify reports an exact runtime match for src/collateral/CollateralAccount.sol:CollateralAccount. Tuyo's smart-account guide links this address as the verified collateral implementation.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Operating entity
Evidenced
Tuyo, Inc., US
Judgment call: the Terms name Tuyo, Inc. but not its state of incorporation; US is inferred from the Delaware governing-law clause and the Delaware support number (302). No register entry: the Delaware ICIS search is CAPTCHA-gated (not bypassed) and SEC EDGAR full-text search has no filer named Tuyo.
Documented
Terms of Service name Tuyo, Inc. and choose Delaware law.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Security incidents
Unknown
Absence of a found incident is not evidence that none occurred.
No incident report or post-mortem found in help.tuyo.com guides (all 40 linked from the index), the about.tuyo.com legal hub, or the Terms. Tuyo has no public GitHub organisation to search.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Product changes affecting users
Evidenced
2025-03-07: Card disclosures effective (US cardholder agreement last updated; international Important Disclosures effective); issuer Third National. source
2025-11-25: International cardholder agreement last updated; the current text names Third National as issuer and BANEX Microfinance Bank for Nigerian users. source
What changed on 2025-11-25 is not stated by Tuyo; the summary names the clause present now. Also announced without a date: card spending from vaults is being phased out in favour of Cash (help guide vault-to-Cash update).
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Volume transacted (verified only)
Not observable
Card funds are collected from per-user collateral proxies whose addresses Tuyo does not publish; the listed contracts (Kernel implementation and ECDSA validator) are shared by all ZeroDev accounts and emit no card-specific events, so card settlement cannot be separated from ordinary USDC transfers over listed contracts.
UnreviewedAssessed by AI research agent (operational), 2026-10-09
Group B: institutional due diligence
Control
State
What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?
Unknown implied from the component list
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?
Unknown implied from the component list
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?
Unknown implied from the component list
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?
Attested
The Tuyo legal hub lists a "Security audits" section with a file "Tuyo card.pdf" (374.1 KB). The file was not downloaded, so auditor, scope and date are not recorded. source 1
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?
Unknown implied from the component list
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?
Unknown implied from the component list
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?
Absent
none of 1 repo(s): zerodevapp/kernel ✗ no security policy file source 1
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?
Unknown implied from the component list
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?
Absent
none of 1 repo(s): zerodevapp/kernel ✗ no scanning config or workflow step found source 1
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?
Unknown implied from the component list
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?
Unknown implied from the component list
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?
Unknown implied from the component list
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?
Unknown implied from the component list
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?
Unknown implied from the component list
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?
Unknown implied from the component list
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?
Unknown implied from the component list
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?
Unknown implied from the component list
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?
Unknown implied from the component list
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?
Unknown implied from the component list
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?
Unknown implied from the component list
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?
Unknown implied from the component list
B5.4 Export controls If an API exports data, does it limit volumes and log exports?
Unknown implied from the component list
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?
Unknown implied from the component list
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?
Unknown implied from the component list
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?
Evidenced
Deleting the account in the app cancels the Tuyo Card and the virtual bank account numbers at Tuyo's providers; KYC data may be kept by Tuyo and its providers for up to 5 years. The privacy policy (2024) says technical logs are kept "for a limited period" without a figure. source 1 · source 2
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?
Evidenced
The Tuyo privacy policy (17 July 2024) names Tuyo and shares ramp data with Bridge under Bridge's own policy; it predates the card and uses no controller/processor terms. The issuer's notice (Third National) covers card data; BANEX handles Nigerian users' data under the Nigeria Data Protection Act. No DPIA statement found. source 1 · source 2
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?
Unknown implied from the component list
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?
Unknown implied from the component list
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?
Unknown implied from the component list
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?
Unknown implied from the component list
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?
Absent
none of 1 repo(s): zerodevapp/kernel ✗ no deployment configuration source 1
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?
Absent
none of 1 repo(s): zerodevapp/kernel ✗ no branch rules visible (classic branch protection is not readable without push access) source 1
B9.2 CI runs on pull requests Does every pull request trigger automated checks?
Evidenced
all of 1 repo(s): zerodevapp/kernel ✓ 1 workflow file(s) source 1
B9.3 Tests run in CI Do the CI workflows run the test suite?
Evidenced
all of 1 repo(s): zerodevapp/kernel ✓ test command in a workflow source 1
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?
B9.5 Versioned releases Are releases tagged with immutable semantic versions?
Evidenced
all of 1 repo(s): zerodevapp/kernel ✓ latest tags: v4.0.0-beta.15, v4.0.0-beta.13, v4.0.0-beta.12 source 1
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?
Evidenced
all of 1 repo(s): zerodevapp/kernel ✓ 6 of 10 recent commits signed source 1
B9.7 Changelog Is a changelog maintained with the code?
Evidenced
all of 1 repo(s): zerodevapp/kernel ✓ 9 release(s) with notes source 1
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?
Absent
none of 1 repo(s): zerodevapp/kernel ✗ none found source 1
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?
Evidenced
Logical view only: Tuyo's help guides describe the signer (BIP-39 key on the device), the ZeroDev Kernel 3.2 smart account on Base, and the separate collateral account with its two release routes (counterparty-signed release, or depositor ejection after a cooldown). No infrastructure or integration architecture is published. source 1
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?
Evidenced
Tuyo, Inc. under the Terms of Service (Delaware law); the card agreements are three-way between the user, Tuyo Inc. and the issuer, Third National; for Nigerian users the card is marketed by BANEX Microfinance Bank Limited. No company-register entry was found. source 1 · source 2
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?
Unknown implied from the component list
B11.3 Termination terms What happens to customer funds and data on termination by either side?
Evidenced
Tuyo may suspend or terminate an account at its sole discretion without prior notice and may delete account data; the issuer may cancel the card with or without notice. Because the wallet is self-custodial, the Terms say a suspended user can still export the wallet or withdraw via a block explorer; funds already in the card collateral account follow its release rules (counterparty signature or ejection cooldown). source 1 · source 2
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?
Unknown implied from the component list
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?
Scored from Tuyo's Terms (Notion, client-rendered, archived), Privacy Policy (archived), the help.tuyo.com guides (curl-readable), the ZeroDev Kernel source at tag v3.2, and Sourcify for the two Base contracts that Tuyo names. I could not identify a sample Tuyo account or its card collateral. base.blockscout.com is behind a Cloudflare challenge (not bypassed), Base public RPC refuses USDC log scans over 300 blocks, and Rain's docs need a login. As a result S1, S2, S3, P3 and the card-path onchain facts are unknown. Card Map (third party) lists Rain as issuer; no Tuyo document confirms it.
