{"title":"P0 vendor due-diligence facts","version":"2026-11-07.1","generated_from":"constants in the P0 worker code; nothing on this page is typed by hand except the plain statements under not_available","not_advice":"Facts about how P0 works, not legal advice, not a compliance statement, not a certification.","operator":{"name":"dev Mike","statement":"P0 is run by a self-developing ecosystem of AI agents on behalf of P0's dev Mike.","about":"https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/about"},"products":[{"id":"sanctions_check","path":"/sanctions/check","answers":"Screens a wallet address (exact match) or a Latin-script name (scored match) against the sanctions lists below.","sources":[{"list":"OFAC SDN","licence_notice":"U.S. government work (17 U.S.C. 105)."},{"list":"UK Sanctions List","licence_notice":"Contains public sector information licensed under the Open Government Licence v3.0."},{"list":"EU Financial Sanctions","licence_notice":"Source: European Commission, Financial Sanctions Files, CC BY 4.0; indexed and normalised by P0."},{"list":"Canada Consolidated Autonomous Sanctions","licence_notice":"Contains information licensed under the Open Government Licence - Canada."},{"list":"US Consolidated Screening List","licence_notice":"U.S. government work (trade.gov)."}],"source_url":"https://www.treasury.gov/ofac/downloads/sdn.xml","coverage_limits":["The UK and Canadian lists are screened for organisations, vessels and wallet addresses only: their entries for individuals are not included because their open licences do not cover personal data, and a wallet address in such an entry is matched without the person's details.","Names must be Latin script; transliterate other scripts first.","The UN Security Council consolidated list is not covered (UN Security Council consolidated list)."],"refused_before_payment":[{"status":503,"when":"the OFAC SDN check time of the index (checked_at) is older than 48 hours, or the index is not loaded; the other lists are not refused for age: each answer states their date and fresh in lists[], and fresh:false means the last good copy","constant":"sanctions.js STALE_HOURS","charged":false},{"status":422,"when":"a name made only of words that are very common in the SDN list (too_generic)","constant":"sanctions.js precheck","charged":false},{"status":400,"when":"the address or name is malformed","charged":false}]},{"id":"sanctions_check_batch","path":"/sanctions/check/batch","answers":"The same screening for up to 25 addresses in one POST body (MAX_ADDRESSES), so no name or address travels in a URL.","sources":[{"list":"OFAC SDN","licence_notice":"U.S. government work (17 U.S.C. 105)."},{"list":"UK Sanctions List","licence_notice":"Contains public sector information licensed under the Open Government Licence v3.0."},{"list":"EU Financial Sanctions","licence_notice":"Source: European Commission, Financial Sanctions Files, CC BY 4.0; indexed and normalised by P0."},{"list":"Canada Consolidated Autonomous Sanctions","licence_notice":"Contains information licensed under the Open Government Licence - Canada."},{"list":"US Consolidated Screening List","licence_notice":"U.S. government work (trade.gov)."}],"source_url":"https://www.treasury.gov/ofac/downloads/sdn.xml","coverage_limits":["Addresses only."],"refused_before_payment":[{"status":503,"when":"same freshness rule as /sanctions/check (48 hours)","constant":"sanctions.js STALE_HOURS via SANCT.ready()","charged":false},{"status":400,"when":"the body is not valid, too large (20000 bytes at most) or has more than 25 addresses","constant":"sanctions_batch.js MAX_BODY_BYTES, MAX_ADDRESSES","charged":false}]},{"id":"sanctions_changes","path":"/sanctions/changes","answers":"What was added, removed or amended between successive list files P0 compared, with the list version date of each change.","sources":[{"list":"OFAC SDN","licence_notice":"U.S. government work (17 U.S.C. 105)."},{"list":"UK Sanctions List","licence_notice":"Contains public sector information licensed under the Open Government Licence v3.0."},{"list":"EU Financial Sanctions","licence_notice":"Source: European Commission, Financial Sanctions Files, CC BY 4.0; indexed and normalised by P0."},{"list":"Canada Consolidated Autonomous Sanctions","licence_notice":"Contains information licensed under the Open Government Licence - Canada."},{"list":"US Consolidated Screening List","licence_notice":"U.S. government work (trade.gov)."}],"source_url":"https://www.treasury.gov/ofac/downloads/sdn.xml","coverage_limits":["History kept: 90 days (RETENTION_DAYS).","Not covered: UN Security Council consolidated list."],"refused_before_payment":[{"status":503,"when":"the change feed was not refreshed in the last 48 hours","constant":"sanctions_changes.js STALE_HOURS","charged":false},{"status":400,"when":"since is missing, not a real date, in the future, or more than 366 days back","charged":false}]},{"id":"check_counterparty","path":"/check/counterparty","answers":"One call for a company name: sanctions screening, GLEIF LEI record, and US bank status (FDIC), each section with its own status, source and as-of.","sources":[{"list":"Sanctions lists as for /sanctions/check","licence_notice":"see above"},{"list":"GLEIF Global LEI Index","licence_notice":"LEI reference data: GLEIF (Global Legal Entity Identifier Foundation), api.gleif.org, CC0 1.0. This service is not provided, supported or endorsed by GLEIF or any LOU."},{"list":"FDIC BankFind Suite API","licence_notice":"Source: Federal Deposit Insurance Corporation (FDIC), BankFind Suite API (https://api.fdic.gov/banks/), free at source: https://banks.data.fdic.gov/bankfind-suite/. A work of the U.S. Government (17 U.S.C. 105); not endorsed by the FDIC. Values as published, total assets converted from thousands of dollars."}],"source_url":"https://banks.data.fdic.gov/bankfind-suite/","coverage_limits":["Name at most 100 characters (MAX_NAME).","The answer is not a clearance."],"refused_before_payment":[{"status":503,"when":"the sanctions core is missing or its OFAC SDN check time is older than 48 hours; the other sections may come back marked unavailable","constant":"check_bundles.js header comment, sanctions.js STALE_HOURS","charged":false},{"status":422,"when":"the name is made only of words that are very common in the SDN list (too_generic)","constant":"check_bundles.js sanctionsSection via sanctions.js precheck","charged":false},{"status":400,"when":"the name is missing or too long","charged":false}]},{"id":"check_payee","path":"/check/payee","answers":"For a wallet that is about to be paid: sanctions match, wallet risk label, whether it is a listed x402 seller, and with url= whether the endpoint asks for payment to that address.","sources":[{"list":"OFAC SDN","licence_notice":"U.S. government work (17 U.S.C. 105)."},{"list":"UK Sanctions List","licence_notice":"Contains public sector information licensed under the Open Government Licence v3.0."},{"list":"EU Financial Sanctions","licence_notice":"Source: European Commission, Financial Sanctions Files, CC BY 4.0; indexed and normalised by P0."},{"list":"Canada Consolidated Autonomous Sanctions","licence_notice":"Contains information licensed under the Open Government Licence - Canada."},{"list":"US Consolidated Screening List","licence_notice":"U.S. government work (trade.gov)."}],"source_url":"https://www.treasury.gov/ofac/downloads/sdn.xml","coverage_limits":["Recommendation follows fixed written rules (RULES), not an opinion."],"refused_before_payment":[{"status":503,"when":"the sanctions core is missing or its OFAC SDN check time is older than 48 hours","constant":"payee_check.js header, sanctions.js STALE_HOURS","charged":false},{"status":400,"when":"the address or url is malformed or not allowed","charged":false}]},{"id":"lei_changes","path":"/lei/changes","answers":"Changes in GLEIF LEI records since a date.","sources":[{"list":"GLEIF Global LEI Index","licence_notice":"LEI reference data: GLEIF (Global Legal Entity Identifier Foundation), api.gleif.org, CC0 1.0. This service is not provided, supported or endorsed by GLEIF or any LOU."}],"source_url":"https://www.gleif.org/","coverage_limits":["since at most 400 days back (MAX_DAYS).","Answers may be served from a shared copy up to 900 seconds old (CACHE_TTL_S)."],"refused_before_payment":[{"status":400,"when":"since is missing, in the future or more than 400 days back, or country, status, limit or page is malformed","constant":"lei_changes.js MAX_DAYS","charged":false}]},{"id":"bank_us","path":"/bank/us","answers":"US bank status from FDIC BankFind: certificate, assets, offices, history events.","sources":[{"list":"FDIC BankFind Suite API","licence_notice":"Source: Federal Deposit Insurance Corporation (FDIC), BankFind Suite API (https://api.fdic.gov/banks/), free at source: https://banks.data.fdic.gov/bankfind-suite/. A work of the U.S. Government (17 U.S.C. 105); not endorsed by the FDIC. Values as published, total assets converted from thousands of dollars."}],"source_url":"https://banks.data.fdic.gov/bankfind-suite/","coverage_limits":["FDIC data is published daily or quarterly; answers may come from a copy up to 6 hours old (TTL_S)."],"refused_before_payment":[{"status":400,"when":"name or cert is missing, both are given, or one is malformed","charged":false}]},{"id":"sec_filings","path":"/sec/filings","answers":"SEC EDGAR filings and XBRL facts by ticker or CIK.","sources":[{"list":"SEC EDGAR (data.sec.gov submissions and XBRL company concepts), U.S. Securities and Exchange Commission","licence_notice":"Public data of the U.S. Securities and Exchange Commission"}],"source_url":"https://www.sec.gov/search-filings/edgar-application-programming-interfaces","coverage_limits":["A fact whose latest period ended more than 548 days ago is marked stale (STALE_DAYS)."],"refused_before_payment":[{"status":400,"when":"ticker or cik is missing, both are given, or one is malformed","charged":false}]},{"id":"eu_fx","path":"/eu/fx","answers":"ECB euro reference rates (also /eu/fx/history).","sources":[{"list":"ECB euro foreign exchange reference rates","licence_notice":"ECB data is available free of charge on the ECB website."}],"source_url":"https://www.ecb.europa.eu/stats/policy_and_exchange_rates/euro_reference_exchange_rates/html/index.en.html","coverage_limits":["Marked stale after 2 business days (STALE_BUSINESS_DAYS)."],"refused_before_payment":[{"status":503,"when":"the newest rate is more than 5 business days old","constant":"eu_fx.js HARD_STALE_BUSINESS_DAYS","charged":false}]}],"freshness_rule_in_one_line":"A route whose data is older than its limit answers 503 with charged:false before any payment is taken; the limit for each route is in its refused_before_payment list. On the sanctions products the 48-hour limit applies to the OFAC SDN check time (checked_at). The other lists are served from their last good copy; each answer states their date and fresh per list in lists[], and they are not refused when older.","data_handling":{"screened_input":"P0's code does not write a screened name or address to a log line, a database row or a storage key on /sanctions/check, /sanctions/check/batch and /check/payee. On /check/counterparty the normalised company name and country are kept as the lookup key of a shared copy of the public answer: 3600 seconds for the LEI step (company_registry.js LEI_CACHE_TTL_S) and 6 hours for the FDIC step (bank_us.js TTL_S). The key holds the name, not who asked.","in_the_url":"Name and address screening on the GET routes puts the input in the request URL. The hosting provider (Cloudflare Workers; this worker has its logs switched on) may keep that URL in its own request logs under its own retention rules. To keep addresses out of URLs, use the POST route /sanctions/check/batch. A POST route for names does not exist yet.","own_logs":"P0's own log lines carry the route path, never the query string. An MCP call is logged as method, tool name and the first 80 characters of the user agent, with no arguments and no network address; on initialize the line also carries the client name the client reports (first 40 characters) and its kind from a closed list. Payment lines are logged with the transaction hash, and the paying wallet address where the payment network reports one (paid, prepaid), network and amount; a request that is answered 402 is logged with the route and the first 80 characters of the user agent. Payment events in the database hold time, event, route, facilitator and reason, not the wallet.","forwarded_to":"A company name on /check/counterparty is sent to GLEIF (api.gleif.org) and FDIC (api.fdic.gov). On /check/payee the wallet address is sent to public EVM RPC nodes (drpc.org) for the wallet-risk read, and with url= P0 requests that URL from the host named. Those services keep their own logs.","free_call_ledger":"One-way hashes of network address and user agent, with the route, for 24 hours (freemium.js FREE_TTL_S).","call_to_payment_link":"A one-way hash of day, network address and user agent with the tool and route, for 40 days (mcp_attr.js KEEP_DAYS).","full_policy":"https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/privacy"},"security":{"policy_file":"https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/.well-known/security.txt","contact":"chebotarev.mike@gmail.com","vulnerability_disclosure_policy":"not published yet"},"uptime":{"published":false,"statement":"Uptime evidence is not published yet. GET /health answers ok, the catalog size, the snapshot hash and time, the scoring revision, the version and the settlement facilitator list; it keeps no history."},"change_record":{"feed":"https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/feed.xml","statement":"An Atom feed of data updates. A separate changelog is not published."},"payment":{"protocols":["x402","MPP"],"networks_and_assets":"eip155:8453, eip155:42161, eip155:137 (USDC); stacks:1 (sBTC); eip155:43114, eip155:10, eip155:42220 (USDC via UltravioletaDAO); eip155:42161 (USDT0), eip155:1 (USDC) via UltravioletaDAO","direct_transfer":"USDC on Base, Arbitrum, Polygon, Avalanche, Optimism, Celo, Ethereum; USDT0 on Arbitrum; sBTC on Stacks on most routes (each 402 lists its own options)","price_in_every_402":true},"not_available":["P0 offers no signed contract. The only terms are the public Terms of Use (/terms).","P0 offers no service-level agreement and no penalties. No availability percentage is published.","P0 holds and publishes no certification (for example SOC 2 or ISO 27001) and offers no audit or inspection rights.","P0 publishes no insurance cover.","P0 publishes no legal-entity identifier (LEI) for its operator.","P0 publishes no country of headquarters and no location of data at rest.","P0 takes no fiat payment: payment is in crypto only.","Coverage gaps: the UN Security Council consolidated list, and names in non-Latin scripts."],"framework_map":[{"topic":"Due diligence on the provider","reference":"DORA Art. 28(4)(d), CELEX:32022R2554","quoted":"undertake all due diligence on prospective ICT third-party service providers","answered_in":"this page"},{"topic":"Data protection: availability, authenticity, integrity, confidentiality","reference":"DORA Art. 30(2)(c)","quoted":"availability, authenticity, integrity and confidentiality in relation to the protection of data","answered_in":"data_handling, products[].refused_before_payment"},{"topic":"Service level descriptions","reference":"DORA Art. 30(2)(e)","quoted":"service level descriptions, including updates and revisions thereof","answered_in":"not_available (no service-level agreement); freshness limits in products[]"},{"topic":"Provider's country of headquarters","reference":"ITS (EU) 2024/2956, B_05.01.0080, CELEX:32024R2956","quoted":"Country of the ICT third-party service provider's headquarters","answered_in":"not_available (not published)"},{"topic":"Location of the data at rest","reference":"ITS (EU) 2024/2956, B_02.02.0150","quoted":"Location of the data at rest (storage)","answered_in":"not_available (not published)"},{"topic":"Legal entity identifier","reference":"ITS (EU) 2024/2956, Art. 3(5)","quoted":"valid and active legal entity identifier (LEI)","answered_in":"not_available (none published)"},{"topic":"Information security and incident reporting","reference":"US interagency third-party guidance, SR 23-4 attachment, due-diligence topics","quoted":"information security","answered_in":"security, data_handling"},{"topic":"Proportionality","reference":"SR 23-4 attachment","quoted":"commensurate with the level of risk and complexity","answered_in":"left to the bank's own classification"}],"framework_map_note":"Quoted words are the documents' own, read by P0 on 07.11.2026. The map shows where this page answers a topic or that P0 does not publish it. It does not say that P0 meets any requirement.","links":{"terms":"https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/terms","privacy":"https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/privacy","refunds":"https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/refunds","openapi":"https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/openapi.json","tools":"https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/tools","llms":"https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/llms.txt"}}