# P0 vendor due-diligence facts

Facts about how P0 works, not legal advice, not a compliance statement, not a certification.

Operator: dev Mike. P0 is run by a self-developing ecosystem of AI agents on behalf of P0's dev Mike. More: https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/about

## Products, sources and refusals

### /sanctions/check
Screens a wallet address (exact match) or a Latin-script name (scored match) against the sanctions lists below.

Sources and licence notices:
- OFAC SDN: U.S. government work (17 U.S.C. 105).
- UK Sanctions List: Contains public sector information licensed under the Open Government Licence v3.0.
- EU Financial Sanctions: Source: European Commission, Financial Sanctions Files, CC BY 4.0; indexed and normalised by P0.
- Canada Consolidated Autonomous Sanctions: Contains information licensed under the Open Government Licence - Canada.
- US Consolidated Screening List: U.S. government work (trade.gov).
Limits:
- The UK and Canadian lists are screened for organisations, vessels and wallet addresses only: their entries for individuals are not included because their open licences do not cover personal data, and a wallet address in such an entry is matched without the person's details.
- Names must be Latin script; transliterate other scripts first.
- The UN Security Council consolidated list is not covered (UN Security Council consolidated list).
Refused before payment (charged: false):
- 503: the OFAC SDN check time of the index (checked_at) is older than 48 hours, or the index is not loaded; the other lists are not refused for age: each answer states their date and fresh in lists[], and fresh:false means the last good copy (sanctions.js STALE_HOURS)
- 422: a name made only of words that are very common in the SDN list (too_generic) (sanctions.js precheck)
- 400: the address or name is malformed

### /sanctions/check/batch
The same screening for up to 25 addresses in one POST body (MAX_ADDRESSES), so no name or address travels in a URL.

Sources and licence notices:
- OFAC SDN: U.S. government work (17 U.S.C. 105).
- UK Sanctions List: Contains public sector information licensed under the Open Government Licence v3.0.
- EU Financial Sanctions: Source: European Commission, Financial Sanctions Files, CC BY 4.0; indexed and normalised by P0.
- Canada Consolidated Autonomous Sanctions: Contains information licensed under the Open Government Licence - Canada.
- US Consolidated Screening List: U.S. government work (trade.gov).
Limits:
- Addresses only.
Refused before payment (charged: false):
- 503: same freshness rule as /sanctions/check (48 hours) (sanctions.js STALE_HOURS via SANCT.ready())
- 400: the body is not valid, too large (20000 bytes at most) or has more than 25 addresses (sanctions_batch.js MAX_BODY_BYTES, MAX_ADDRESSES)

### /sanctions/changes
What was added, removed or amended between successive list files P0 compared, with the list version date of each change.

Sources and licence notices:
- OFAC SDN: U.S. government work (17 U.S.C. 105).
- UK Sanctions List: Contains public sector information licensed under the Open Government Licence v3.0.
- EU Financial Sanctions: Source: European Commission, Financial Sanctions Files, CC BY 4.0; indexed and normalised by P0.
- Canada Consolidated Autonomous Sanctions: Contains information licensed under the Open Government Licence - Canada.
- US Consolidated Screening List: U.S. government work (trade.gov).
Limits:
- History kept: 90 days (RETENTION_DAYS).
- Not covered: UN Security Council consolidated list.
Refused before payment (charged: false):
- 503: the change feed was not refreshed in the last 48 hours (sanctions_changes.js STALE_HOURS)
- 400: since is missing, not a real date, in the future, or more than 366 days back

### /check/counterparty
One call for a company name: sanctions screening, GLEIF LEI record, and US bank status (FDIC), each section with its own status, source and as-of.

Sources and licence notices:
- Sanctions lists as for /sanctions/check: see above
- GLEIF Global LEI Index: LEI reference data: GLEIF (Global Legal Entity Identifier Foundation), api.gleif.org, CC0 1.0. This service is not provided, supported or endorsed by GLEIF or any LOU.
- FDIC BankFind Suite API: Source: Federal Deposit Insurance Corporation (FDIC), BankFind Suite API (https://api.fdic.gov/banks/), free at source: https://banks.data.fdic.gov/bankfind-suite/. A work of the U.S. Government (17 U.S.C. 105); not endorsed by the FDIC. Values as published, total assets converted from thousands of dollars.
Limits:
- Name at most 100 characters (MAX_NAME).
- The answer is not a clearance.
Refused before payment (charged: false):
- 503: the sanctions core is missing or its OFAC SDN check time is older than 48 hours; the other sections may come back marked unavailable (check_bundles.js header comment, sanctions.js STALE_HOURS)
- 422: the name is made only of words that are very common in the SDN list (too_generic) (check_bundles.js sanctionsSection via sanctions.js precheck)
- 400: the name is missing or too long

### /check/payee
For a wallet that is about to be paid: sanctions match, wallet risk label, whether it is a listed x402 seller, and with url= whether the endpoint asks for payment to that address.

Sources and licence notices:
- OFAC SDN: U.S. government work (17 U.S.C. 105).
- UK Sanctions List: Contains public sector information licensed under the Open Government Licence v3.0.
- EU Financial Sanctions: Source: European Commission, Financial Sanctions Files, CC BY 4.0; indexed and normalised by P0.
- Canada Consolidated Autonomous Sanctions: Contains information licensed under the Open Government Licence - Canada.
- US Consolidated Screening List: U.S. government work (trade.gov).
Limits:
- Recommendation follows fixed written rules (RULES), not an opinion.
Refused before payment (charged: false):
- 503: the sanctions core is missing or its OFAC SDN check time is older than 48 hours (payee_check.js header, sanctions.js STALE_HOURS)
- 400: the address or url is malformed or not allowed

### /lei/changes
Changes in GLEIF LEI records since a date.

Sources and licence notices:
- GLEIF Global LEI Index: LEI reference data: GLEIF (Global Legal Entity Identifier Foundation), api.gleif.org, CC0 1.0. This service is not provided, supported or endorsed by GLEIF or any LOU.
Limits:
- since at most 400 days back (MAX_DAYS).
- Answers may be served from a shared copy up to 900 seconds old (CACHE_TTL_S).
Refused before payment (charged: false):
- 400: since is missing, in the future or more than 400 days back, or country, status, limit or page is malformed (lei_changes.js MAX_DAYS)

### /bank/us
US bank status from FDIC BankFind: certificate, assets, offices, history events.

Sources and licence notices:
- FDIC BankFind Suite API: Source: Federal Deposit Insurance Corporation (FDIC), BankFind Suite API (https://api.fdic.gov/banks/), free at source: https://banks.data.fdic.gov/bankfind-suite/. A work of the U.S. Government (17 U.S.C. 105); not endorsed by the FDIC. Values as published, total assets converted from thousands of dollars.
Limits:
- FDIC data is published daily or quarterly; answers may come from a copy up to 6 hours old (TTL_S).
Refused before payment (charged: false):
- 400: name or cert is missing, both are given, or one is malformed

### /sec/filings
SEC EDGAR filings and XBRL facts by ticker or CIK.

Sources and licence notices:
- SEC EDGAR (data.sec.gov submissions and XBRL company concepts), U.S. Securities and Exchange Commission: Public data of the U.S. Securities and Exchange Commission
Limits:
- A fact whose latest period ended more than 548 days ago is marked stale (STALE_DAYS).
Refused before payment (charged: false):
- 400: ticker or cik is missing, both are given, or one is malformed

### /eu/fx
ECB euro reference rates (also /eu/fx/history).

Sources and licence notices:
- ECB euro foreign exchange reference rates: ECB data is available free of charge on the ECB website.
Limits:
- Marked stale after 2 business days (STALE_BUSINESS_DAYS).
Refused before payment (charged: false):
- 503: the newest rate is more than 5 business days old (eu_fx.js HARD_STALE_BUSINESS_DAYS)

## What is logged and kept

- Screened input: P0's code does not write a screened name or address to a log line, a database row or a storage key on /sanctions/check, /sanctions/check/batch and /check/payee. On /check/counterparty the normalised company name and country are kept as the lookup key of a shared copy of the public answer: 3600 seconds for the LEI step (company_registry.js LEI_CACHE_TTL_S) and 6 hours for the FDIC step (bank_us.js TTL_S). The key holds the name, not who asked.
- In the URL: Name and address screening on the GET routes puts the input in the request URL. The hosting provider (Cloudflare Workers; this worker has its logs switched on) may keep that URL in its own request logs under its own retention rules. To keep addresses out of URLs, use the POST route /sanctions/check/batch. A POST route for names does not exist yet.
- Own logs: P0's own log lines carry the route path, never the query string. An MCP call is logged as method, tool name and the first 80 characters of the user agent, with no arguments and no network address; on initialize the line also carries the client name the client reports (first 40 characters) and its kind from a closed list. Payment lines are logged with the transaction hash, and the paying wallet address where the payment network reports one (paid, prepaid), network and amount; a request that is answered 402 is logged with the route and the first 80 characters of the user agent. Payment events in the database hold time, event, route, facilitator and reason, not the wallet.
- Sent on to other services: A company name on /check/counterparty is sent to GLEIF (api.gleif.org) and FDIC (api.fdic.gov). On /check/payee the wallet address is sent to public EVM RPC nodes (drpc.org) for the wallet-risk read, and with url= P0 requests that URL from the host named. Those services keep their own logs.
- Free-call ledger: One-way hashes of network address and user agent, with the route, for 24 hours (freemium.js FREE_TTL_S).
- Call-to-payment link: A one-way hash of day, network address and user agent with the tool and route, for 40 days (mcp_attr.js KEEP_DAYS).
- Full policy: https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/privacy

## Security

- Policy file: https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/.well-known/security.txt
- Contact: chebotarev.mike@gmail.com
- Vulnerability disclosure policy: not published yet

## Uptime and changes

- Uptime evidence is not published yet. GET /health answers ok, the catalog size, the snapshot hash and time, the scoring revision, the version and the settlement facilitator list; it keeps no history.
- An Atom feed of data updates. A separate changelog is not published. https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/feed.xml

## Payment

- Protocols: x402, MPP
- Networks and assets: eip155:8453, eip155:42161, eip155:137 (USDC); stacks:1 (sBTC); eip155:43114, eip155:10, eip155:42220 (USDC via UltravioletaDAO); eip155:42161 (USDT0), eip155:1 (USDC) via UltravioletaDAO

## Not available

- P0 offers no signed contract. The only terms are the public Terms of Use (/terms).
- P0 offers no service-level agreement and no penalties. No availability percentage is published.
- P0 holds and publishes no certification (for example SOC 2 or ISO 27001) and offers no audit or inspection rights.
- P0 publishes no insurance cover.
- P0 publishes no legal-entity identifier (LEI) for its operator.
- P0 publishes no country of headquarters and no location of data at rest.
- P0 takes no fiat payment: payment is in crypto only.
- Coverage gaps: the UN Security Council consolidated list, and names in non-Latin scripts.

## Mapping to published frameworks

Quoted words are the documents' own, read by P0 on 07.11.2026. The map shows where this page answers a topic or that P0 does not publish it. It does not say that P0 meets any requirement.

- Due diligence on the provider (DORA Art. 28(4)(d), CELEX:32022R2554): "undertake all due diligence on prospective ICT third-party service providers" -> this page
- Data protection: availability, authenticity, integrity, confidentiality (DORA Art. 30(2)(c)): "availability, authenticity, integrity and confidentiality in relation to the protection of data" -> data_handling, products[].refused_before_payment
- Service level descriptions (DORA Art. 30(2)(e)): "service level descriptions, including updates and revisions thereof" -> not_available (no service-level agreement); freshness limits in products[]
- Provider's country of headquarters (ITS (EU) 2024/2956, B_05.01.0080, CELEX:32024R2956): "Country of the ICT third-party service provider's headquarters" -> not_available (not published)
- Location of the data at rest (ITS (EU) 2024/2956, B_02.02.0150): "Location of the data at rest (storage)" -> not_available (not published)
- Legal entity identifier (ITS (EU) 2024/2956, Art. 3(5)): "valid and active legal entity identifier (LEI)" -> not_available (none published)
- Information security and incident reporting (US interagency third-party guidance, SR 23-4 attachment, due-diligence topics): "information security" -> security, data_handling
- Proportionality (SR 23-4 attachment): "commensurate with the level of risk and complexity" -> left to the bank's own classification

Machine-readable twin: /trust.json