P0 vendor due-diligence facts

Facts about how P0 works, not legal advice, not a compliance statement, not a certification.

Operator: dev Mike. P0 is run by a self-developing ecosystem of AI agents on behalf of P0's dev Mike. Who runs P0.

Products, sources and refusals

A route whose data is older than its limit answers 503 with charged:false before any payment is taken; the limit for each route is in its refused_before_payment list. On the sanctions products the 48-hour limit applies to the OFAC SDN check time (checked_at). The other lists are served from their last good copy; each answer states their date and fresh per list in lists[], and they are not refused when older.

`/sanctions/check`

Screens a wallet address (exact match) or a Latin-script name (scored match) against the sanctions lists below.

Sources and licence notices

OFAC SDN: U.S. government work (17 U.S.C. 105).
UK Sanctions List: Contains public sector information licensed under the Open Government Licence v3.0.
EU Financial Sanctions: Source: European Commission, Financial Sanctions Files, CC BY 4.0; indexed and normalised by P0.
Canada Consolidated Autonomous Sanctions: Contains information licensed under the Open Government Licence - Canada.
US Consolidated Screening List: U.S. government work (trade.gov).

Limits

The UK and Canadian lists are screened for organisations, vessels and wallet addresses only: their entries for individuals are not included because their open licences do not cover personal data, and a wallet address in such an entry is matched without the person's details.
Names must be Latin script; transliterate other scripts first.
The UN Security Council consolidated list is not covered (UN Security Council consolidated list).

Refused before payment (charged: false)

503: the OFAC SDN check time of the index (checked_at) is older than 48 hours, or the index is not loaded; the other lists are not refused for age: each answer states their date and fresh in lists[], and fresh:false means the last good copy (sanctions.js STALE_HOURS)
422: a name made only of words that are very common in the SDN list (too_generic) (sanctions.js precheck)
400: the address or name is malformed

`/sanctions/check/batch`

The same screening for up to 25 addresses in one POST body (MAX_ADDRESSES), so no name or address travels in a URL.

Sources and licence notices

OFAC SDN: U.S. government work (17 U.S.C. 105).
UK Sanctions List: Contains public sector information licensed under the Open Government Licence v3.0.
EU Financial Sanctions: Source: European Commission, Financial Sanctions Files, CC BY 4.0; indexed and normalised by P0.
Canada Consolidated Autonomous Sanctions: Contains information licensed under the Open Government Licence - Canada.
US Consolidated Screening List: U.S. government work (trade.gov).

Limits

Addresses only.

Refused before payment (charged: false)

503: same freshness rule as /sanctions/check (48 hours) (sanctions.js STALE_HOURS via SANCT.ready())
400: the body is not valid, too large (20000 bytes at most) or has more than 25 addresses (sanctions_batch.js MAX_BODY_BYTES, MAX_ADDRESSES)

`/sanctions/changes`

What was added, removed or amended between successive list files P0 compared, with the list version date of each change.

Sources and licence notices

OFAC SDN: U.S. government work (17 U.S.C. 105).
UK Sanctions List: Contains public sector information licensed under the Open Government Licence v3.0.
EU Financial Sanctions: Source: European Commission, Financial Sanctions Files, CC BY 4.0; indexed and normalised by P0.
Canada Consolidated Autonomous Sanctions: Contains information licensed under the Open Government Licence - Canada.
US Consolidated Screening List: U.S. government work (trade.gov).

Limits

History kept: 90 days (RETENTION_DAYS).
Not covered: UN Security Council consolidated list.

Refused before payment (charged: false)

503: the change feed was not refreshed in the last 48 hours (sanctions_changes.js STALE_HOURS)
400: since is missing, not a real date, in the future, or more than 366 days back

`/check/counterparty`

One call for a company name: sanctions screening, GLEIF LEI record, and US bank status (FDIC), each section with its own status, source and as-of.

Sources and licence notices

Sanctions lists as for /sanctions/check: see above
GLEIF Global LEI Index: LEI reference data: GLEIF (Global Legal Entity Identifier Foundation), api.gleif.org, CC0 1.0. This service is not provided, supported or endorsed by GLEIF or any LOU.
FDIC BankFind Suite API: Source: Federal Deposit Insurance Corporation (FDIC), BankFind Suite API (https://api.fdic.gov/banks/), free at source: https://banks.data.fdic.gov/bankfind-suite/. A work of the U.S. Government (17 U.S.C. 105); not endorsed by the FDIC. Values as published, total assets converted from thousands of dollars.

Limits

Name at most 100 characters (MAX_NAME).
The answer is not a clearance.

Refused before payment (charged: false)

503: the sanctions core is missing or its OFAC SDN check time is older than 48 hours; the other sections may come back marked unavailable (check_bundles.js header comment, sanctions.js STALE_HOURS)
422: the name is made only of words that are very common in the SDN list (too_generic) (check_bundles.js sanctionsSection via sanctions.js precheck)
400: the name is missing or too long

`/check/payee`

For a wallet that is about to be paid: sanctions match, wallet risk label, whether it is a listed x402 seller, and with url= whether the endpoint asks for payment to that address.

Sources and licence notices

OFAC SDN: U.S. government work (17 U.S.C. 105).
UK Sanctions List: Contains public sector information licensed under the Open Government Licence v3.0.
EU Financial Sanctions: Source: European Commission, Financial Sanctions Files, CC BY 4.0; indexed and normalised by P0.
Canada Consolidated Autonomous Sanctions: Contains information licensed under the Open Government Licence - Canada.
US Consolidated Screening List: U.S. government work (trade.gov).

Limits

Recommendation follows fixed written rules (RULES), not an opinion.

Refused before payment (charged: false)

503: the sanctions core is missing or its OFAC SDN check time is older than 48 hours (payee_check.js header, sanctions.js STALE_HOURS)
400: the address or url is malformed or not allowed

`/lei/changes`

Changes in GLEIF LEI records since a date.

Sources and licence notices

GLEIF Global LEI Index: LEI reference data: GLEIF (Global Legal Entity Identifier Foundation), api.gleif.org, CC0 1.0. This service is not provided, supported or endorsed by GLEIF or any LOU.

Limits

since at most 400 days back (MAX_DAYS).
Answers may be served from a shared copy up to 900 seconds old (CACHE_TTL_S).

Refused before payment (charged: false)

400: since is missing, in the future or more than 400 days back, or country, status, limit or page is malformed (lei_changes.js MAX_DAYS)

`/bank/us`

US bank status from FDIC BankFind: certificate, assets, offices, history events.

Sources and licence notices

FDIC BankFind Suite API: Source: Federal Deposit Insurance Corporation (FDIC), BankFind Suite API (https://api.fdic.gov/banks/), free at source: https://banks.data.fdic.gov/bankfind-suite/. A work of the U.S. Government (17 U.S.C. 105); not endorsed by the FDIC. Values as published, total assets converted from thousands of dollars.

Limits

FDIC data is published daily or quarterly; answers may come from a copy up to 6 hours old (TTL_S).

Refused before payment (charged: false)

400: name or cert is missing, both are given, or one is malformed

`/sec/filings`

SEC EDGAR filings and XBRL facts by ticker or CIK.

Sources and licence notices

SEC EDGAR (data.sec.gov submissions and XBRL company concepts), U.S. Securities and Exchange Commission: Public data of the U.S. Securities and Exchange Commission

Limits

A fact whose latest period ended more than 548 days ago is marked stale (STALE_DAYS).

Refused before payment (charged: false)

400: ticker or cik is missing, both are given, or one is malformed

`/eu/fx`

ECB euro reference rates (also /eu/fx/history).

Sources and licence notices

ECB euro foreign exchange reference rates: ECB data is available free of charge on the ECB website.

Limits

Marked stale after 2 business days (STALE_BUSINESS_DAYS).

Refused before payment (charged: false)

503: the newest rate is more than 5 business days old (eu_fx.js HARD_STALE_BUSINESS_DAYS)

What is logged and kept

P0's code does not write a screened name or address to a log line, a database row or a storage key on /sanctions/check, /sanctions/check/batch and /check/payee. On /check/counterparty the normalised company name and country are kept as the lookup key of a shared copy of the public answer: 3600 seconds for the LEI step (company_registry.js LEI_CACHE_TTL_S) and 6 hours for the FDIC step (bank_us.js TTL_S). The key holds the name, not who asked.
Name and address screening on the GET routes puts the input in the request URL. The hosting provider (Cloudflare Workers; this worker has its logs switched on) may keep that URL in its own request logs under its own retention rules. To keep addresses out of URLs, use the POST route /sanctions/check/batch. A POST route for names does not exist yet.
P0's own log lines carry the route path, never the query string. An MCP call is logged as method, tool name and the first 80 characters of the user agent, with no arguments and no network address; on initialize the line also carries the client name the client reports (first 40 characters) and its kind from a closed list. Payment lines are logged with the transaction hash, and the paying wallet address where the payment network reports one (paid, prepaid), network and amount; a request that is answered 402 is logged with the route and the first 80 characters of the user agent. Payment events in the database hold time, event, route, facilitator and reason, not the wallet.
A company name on /check/counterparty is sent to GLEIF (api.gleif.org) and FDIC (api.fdic.gov). On /check/payee the wallet address is sent to public EVM RPC nodes (drpc.org) for the wallet-risk read, and with url= P0 requests that URL from the host named. Those services keep their own logs.
One-way hashes of network address and user agent, with the route, for 24 hours (freemium.js FREE_TTL_S).
A one-way hash of day, network address and user agent with the tool and route, for 40 days (mcp_attr.js KEEP_DAYS).
Full policy: Privacy

Security

Policy file: /.well-known/security.txt
Contact: chebotarev.mike@gmail.com
Vulnerability disclosure policy: not published yet

Uptime and changes

Uptime evidence is not published yet. GET /health answers ok, the catalog size, the snapshot hash and time, the scoring revision, the version and the settlement facilitator list; it keeps no history.
An Atom feed of data updates. A separate changelog is not published. /feed.xml

Payment

Protocols: x402, MPP
Networks and assets: eip155:8453, eip155:42161, eip155:137 (USDC); stacks:1 (sBTC); eip155:43114, eip155:10, eip155:42220 (USDC via UltravioletaDAO); eip155:42161 (USDT0), eip155:1 (USDC) via UltravioletaDAO

Not available

P0 offers no signed contract. The only terms are the public Terms of Use (/terms).
P0 offers no service-level agreement and no penalties. No availability percentage is published.
P0 holds and publishes no certification (for example SOC 2 or ISO 27001) and offers no audit or inspection rights.
P0 publishes no insurance cover.
P0 publishes no legal-entity identifier (LEI) for its operator.
P0 publishes no country of headquarters and no location of data at rest.
P0 takes no fiat payment: payment is in crypto only.
Coverage gaps: the UN Security Council consolidated list, and names in non-Latin scripts.

Mapping to published frameworks

Quoted words are the documents' own, read by P0 on 07.11.2026. The map shows where this page answers a topic or that P0 does not publish it. It does not say that P0 meets any requirement.

Due diligence on the provider (DORA Art. 28(4)(d), CELEX:32022R2554): “undertake all due diligence on prospective ICT third-party service providers” → this page
Data protection: availability, authenticity, integrity, confidentiality (DORA Art. 30(2)(c)): “availability, authenticity, integrity and confidentiality in relation to the protection of data” → data_handling, products[].refused_before_payment
Service level descriptions (DORA Art. 30(2)(e)): “service level descriptions, including updates and revisions thereof” → not_available (no service-level agreement); freshness limits in products[]
Provider's country of headquarters (ITS (EU) 2024/2956, B_05.01.0080, CELEX:32024R2956): “Country of the ICT third-party service provider's headquarters” → not_available (not published)
Location of the data at rest (ITS (EU) 2024/2956, B_02.02.0150): “Location of the data at rest (storage)” → not_available (not published)
Legal entity identifier (ITS (EU) 2024/2956, Art. 3(5)): “valid and active legal entity identifier (LEI)” → not_available (none published)
Information security and incident reporting (US interagency third-party guidance, SR 23-4 attachment, due-diligence topics): “information security” → security, data_handling
Proportionality (SR 23-4 attachment): “commensurate with the level of risk and complexity” → left to the bank's own classification

JSON · Markdown

Support & DonateAll options

Your donation is highly appreciated and goes directly toward funding the compute infrastructure and hardware scaling required to sustain P0. P0 is run by a self-developing ecosystem of AI agents that builds, tests, and ships its own updates.

BTC (Bitcoin): bc1qqwgyyqv6raq2jnghals2n2aujgwd4e9p64g4hr
ETH or USDT (Ethereum ERC-20; same address on Base and Arbitrum): 0xECa891e34b3E5873181Fb779672564E198C55354
USDT (Tron TRC-20): TB9rHqT8yLxwdsWCb3zN2nvjc8wLhsUdaQ

Exact amounts, QR codes and every coin: /donate.

Or send any amount to the address.