Trust & Sub-Processors
Last updated: October 2026
This page lists the third-party services ChainHint relies on to operate the platform. Per GDPR Article 28, customers are notified of these sub-processors and any future additions. We commit to publishing changes to this list at least 30 days before they take effect for production data. Companion pages: /security for the controls in place, /privacy for the data we collect.
Tier 1 — Sub-processors that handle Personal Data
These services process data that may include EU Personal Data (email, IP address, account metadata).
| Provider | Purpose | Data processed | Region |
|---|---|---|---|
| Supabase Inc. (USA) | Database, auth, Edge Functions, file storage | Account email, OAuth profile, auth tokens, IP (in audit logs), incident records, payment metadata | AWS eu-west-1 (Ireland) |
| Lovable AB (Sweden) | Frontend hosting (React app) | Request IPs, user-agents, performance telemetry | EU |
| Functional Software, Inc. dba Sentry (USA) | Error tracking, performance monitoring | Error stack traces (may include user IDs / emails in error context), browser metadata | EU (Germany) — Sentry EU data region |
| Google LLC (USA) | Web analytics (Google Analytics 4) — loaded only after cookie consent | Pseudonymous client ID, pages viewed, referrer, coarse location derived from IP (IP itself is not stored), browser metadata | US / EU (EU–US DPF) |
| Cloudflare, Inc. (USA) | Cookieless web analytics beacon (Cloudflare Web Analytics) | Page URL, referrer, user agent, country derived from IP, page-timing metrics — no cookies, no identifiers, no fingerprinting per Cloudflare's policy | Global edge (EU–US DPF) |
| Resend, Inc. (USA) | Transactional email | Recipient email address, email content | AWS eu-west-1 (Ireland) |
| NOWPayments OÜ (Estonia) | Crypto payment processing | Customer email (invoice metadata), payment amount, blockchain tx metadata | EU |
| Google LLC (USA) | OAuth identity provider | Google account: name, email, picture URL (scope: openid email profile) | Global |
| GitHub, Inc. / Microsoft (USA) | OAuth identity provider, source code hosting | OAuth: name, email; Source: codebase | Global |
| Anthropic PBC (USA) | AI report generation (Claude API) | Incident summary text (no PII intentionally — only addresses + on-chain data); used via "no training" API tier | USA |
| Telegram Messenger Inc. (outside the EEA) | The @chainhint_bot Telegram bot (address screening, Telegram Stars payments) and the operator's own alerts, which the bot sends to the operator's Telegram chat | Bot users: Telegram user and chat IDs, the messages they send the bot (normally the address to screen), the bot's replies (that address with its risk score, entity label and any sanctions or law-enforcement listing), Stars invoices, payment charge IDs and refunds. Telegram's updates also carry the sender's public name, username and language, which we do not store. Operator alerts: a /for-investigators applicant's name, email, country, organization, links and use case; the other alerts carry no customer data | Data of users who signed up from the UK or EEA is stored in the Netherlands (Telegram Privacy Policy §4.1); Telegram may share it with its group companies in the British Virgin Islands and Dubai under EU SCCs (§8.2) |
Tier 2 — Blockchain data providers (no PII)
These services receive blockchain addresses and transaction hashes (which are public on-chain data, not PII) and return on-chain data. We do not transmit user identity, email, IP, or account information to these providers. Listed for transparency.
| Provider | Purpose | Region |
|---|---|---|
| Moralis Web3 Technology AB | EVM wallet history, tokens, DeFi positions (tier 1 cascade) | EU (Sweden) |
| Alchemy Insights, Inc. | EVM tx/transfers (tier 2 cascade); Solana RPC transaction history | USA |
| Ankr Network | EVM tx/transfers (tier 3 cascade — BSC/AVAX/Gnosis) | Global RPC |
| NodeReal (MegaNode) | EVM tx/transfers (BNB Chain fallback after Ankr) — from 13 Nov 2026 | Global RPC |
| Etherscan | Entity labels, contract source, internal txs (60+ EVM chains) | USA |
| GoPlus Labs | Token security flags, address risk scoring | Asia |
| DeFiLlama | Protocol TVL, hacks database, historical token prices | Global CDN |
| 1inch Network | Token enrichment, swap-event detection, spot prices | Global |
| TON Foundation | TON chain account info + event-based tracer (TonAPI) | EU/Asia |
| Blockstream / mempool.space | Bitcoin tx + address data | Global |
| TronGrid | Tron chain tx/transfers + TRC-20 metadata (Tron tracing) | Global |
| TronScan | Tron public account tags (exchange/scam entity labels) | Global |
| U.S. Treasury — OFAC | Specially Designated Nationals (SDN) list, incl. listed digital currency addresses (public domain, U.S. Government work) — synced to our DB, not a runtime call | USA |
| OpenSanctions | Sanctions and law-enforcement list data not yet taken from a primary source (Israel NBCTF seizure orders, FBI Lazarus attributions, some other government lists; CC BY-NC 4.0) — synced to our DB, not a runtime call | EU (Germany) |
| DG Trésor (French Treasury) | Registre national des gels — EU, UN and French asset-freeze list data (Licence Ouverte v2.0) — synced to our DB, not a runtime call | EU (France) |
Tier 3 — Operational tools (do not process customer data)
| Provider | Purpose |
|---|---|
| Cloudflare | DNS resolution for chainhint.com — sees domain queries only |
| Cloudflare Workers | Uptime watch: calls our public health-check every 2 minutes and pages the operator — sees that endpoint's answer only |
| ipinfo.io (lite tier) | Anonymous geo-IP for visitor analytics; no PII sent beyond the visitor IP the provider already sees from the request |
Cross-border transfers
ChainHint is operated from the EU. Some sub-processors are US-based. For US transfers we rely on:
- EU–US Data Privacy Framework (DPF) for participating providers (Google, Cloudflare, GitHub/Microsoft).
- Standard Contractual Clauses (SCCs) for non-DPF providers (Sentry, Resend, Anthropic, NOWPayments, Supabase) — incorporated by reference into each provider's DPA.
Telegram Messenger Inc. (outside the EEA) is covered by neither: it offers bot developers no DPA and no SCCs, so no contract between ChainHint and Telegram covers what the bot and the operator alerts send it. Telegram is the data controller for its own Services under its Privacy Policy; it stores the data of UK and EEA users in the Netherlands and applies EU SCCs when it shares data with its group companies outside the EEA.
For customers with strict EU data-residency requirements, contact us via the contact form to discuss EU-only deployment options.
What ChainHint never sends to sub-processors
- Plaintext passwords (handled by Supabase Auth, hashed before storage)
- Payment card data (NOWPayments crypto-only — no card data exists in our system)
- Government IDs, biometrics, health data
- The contents of investigations beyond what is strictly needed for AI report generation (incident summary text → Anthropic)
- Anything at all from our funnel step counters — they stay first-party, hold only "step name + date + number", and no sub-processor sees them (see /privacy §2)
How to be notified of changes
We publish updates to this page whenever the sub-processor list changes. For B2B customers, we commit to 30 days written notice via email before adding a new sub-processor that will process customer data. To object to a new sub-processor, use the contact form.