{"data":{"slug":"trezor","name":"Trezor","domain":"trezor.io","url":"https://trezor.io/","kyc":"none","kycLevel":2,"kycNote":"Wallet use does not require an identity account. Shop orders collect name, phone, email and delivery address. Brazil orders also require CPF and Korean orders PCC; payment and trading providers have their own requirements.","fee":"Hardware purchase; current price depends on model and region.","categories":["Wallet"],"countries":["GLOBAL"],"bestFor":["Cold storage","Multi-coin self-custody","Buying hardware without an account"],"features":["Hardware signer","Open source firmware","On-device transaction confirmation","Trezor Suite for desktop and mobile","Bitcoin and crypto checkout"],"tagline":"Multi-coin hardware signer with an open source firmware and crypto checkout.","status":"ok","updatedAt":"2026-10-25","description":"Czech hardware wallet vendor offering self-custody devices and Trezor Suite, with crypto and conventional shop payments.","cardSummary":"Multi-coin hardware signer, crypto checkout.","networks":["BTC","ETH","LTC"],"checkedAt":"2026-10-25","lastReviewed":"2026-10-25","reviewSource":"official_source_review_2026-10-25","jurisdictionConfidence":"verified","kycLastChecked":"2026-08-07","trending":false,"jurisdiction":"CZ","evidenceStatus":"verified","riskLevel":"caution","privacyWarning":"Trezor reports 347,149 email contacts exported through Brevo and 80,689 customers affected by ShipMonk order-data exposure. The groups may overlap. Trezor says wallet systems were unaffected; neither disclosure establishes that all consequences are resolved. Shop and payment partners also process buyer information.","auditedBy":[],"corporate":{"entityType":{"value":"company","citation":"https://data.trezor.io/legal/privacy-policy.html","note":"Current privacy policy and shop terms identify Trezor Company s.r.o.; no new registry-status or incorporation-date claim."},"legalEntity":{"value":"Trezor Company s.r.o.","citation":"https://data.trezor.io/legal/privacy-policy.html"},"registrationNumber":{"value":"02440032","citation":"https://data.trezor.io/legal/privacy-policy.html"},"registryUrl":{"value":"unknown","citation":"unknown"},"incorporationJurisdiction":{"value":"Czech Republic","citation":"https://data.trezor.io/legal/privacy-policy.html"},"incorporationDate":{"value":"unknown","citation":"unknown"},"registeredAddress":{"value":"Kundratka 2359/17a, Libeň, 180 00 Prague 8, Czech Republic","citation":"https://data.trezor.io/legal/privacy-policy.html"},"officers":{"value":[],"citation":"unknown"},"priorEntities":{"value":[],"citation":"unknown"},"source":"Cited provider and public identity sources","reviewedAt":"2026-10-25"},"twitter":"https://x.com/Trezor","incidents":[{"title":"Brevo newsletter export and fraudulent STM32 email","status":"active","severity":"high","startedAt":"2026-09-09","summary":"Trezor's September 17, 2026 update reports 347,149 newsletter email addresses exported through Brevo. The September 9 message headed 'Critical Security Alert: STM32 Entropy Vulnerability' was phishing: its app requested a wallet backup, not a genuine hardware repair. Trezor says no product, wallet or account system was affected and no passwords or wallet data were held in this list. Brevo says the messages passed email authentication, and attacker access is closed; active here means residual phishing exposure. Do not follow the email links or disclose a backup; delete the message. If a backup was entered, Trezor directs an immediate transfer to a new wallet using its official guide. A firmware update does not undo contact-data exposure. Sources checked September 21, 2026.","directUserHarm":true,"customerDataOrAssetsCompromised":true,"disclosure":"proactive","remediation":"partial","sources":[{"label":"Trezor disclosure, updated September 17, 2026","href":"https://trezor.io/blog/news/security-incident-at-brevo-our-third-party-email-provider"},{"label":"Brevo September 10 postmortem","href":"https://status.brevo.com/incidents/01M266V1CZKJQNGZRNEGFD5CQE/write-up"},{"label":"Trezor: moving funds after backup exposure (checked September 21)","href":"https://trezor.io/guides/backups-recovery/general-standards/move-crypto-to-a-wallet-with-a-new-wallet-backup"}]},{"title":"ShipMonk shipping data and historical-order exposure","status":"active","severity":"high","startedAt":"2026-08-10","summary":"Trezor's September 4, 2026 update reports 80,689 affected customers in the ShipMonk incident, including approximately 67,000 additional US customers with November 2019 to August 2021 orders. Exposed fields include names, emails, phone numbers, shipping addresses and order numbers; 1,947 customers had partial name/city/email exposure. Trezor says old data remained despite written deletion assurances, its own systems and devices were not compromised, and ShipMonk secured its systems. Active here means residual data exposure, not a continuing intrusion. Address exposure can support fraudulent calls, letters and physical targeting; accurate order details do not authenticate a message. Never share a wallet backup and verify communications through the official site. This population may overlap with Brevo's contacts: do not add the totals. Sources checked September 21, 2026.","directUserHarm":true,"customerDataOrAssetsCompromised":true,"disclosure":"proactive","remediation":"partial","sources":[{"label":"Trezor ShipMonk disclosure, updated September 4, 2026","href":"https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incident"}]},{"title":"Unauthorized newsletter email","status":"resolved","severity":"high","startedAt":"2024-01-24","resolvedAt":"2024-01-24","summary":"An unauthorized actor used a separate third-party email service to send Trezor newsletter subscribers an unauthorized newsletter email asking for recovery seeds. Trezor said the event affected newsletter email addresses only, deactivated the link, and restricted unauthorized access. No device, recovery seed, wallet, or funds compromise was reported.","directUserHarm":true,"customerDataOrAssetsCompromised":true,"disclosure":"proactive","remediation":"complete","sources":[{"label":"Trezor newsletter security alert","href":"https://blog.trezor.io/trezor-security-alert-stay-vigilant-against-an-unauthorized-email-and-continued-phishing-attacks-1b4982c2f53c"}]},{"title":"Third-party support portal contact exposure","status":"resolved","severity":"high","startedAt":"2024-01-17","resolvedAt":"2024-01-17","summary":"Unauthorized access to Trezor's third-party support-ticket portal may have exposed the name/nickname and email address of up to 66,000 support contacts. Phishing followed: the actor emailed 41 users asking for recovery-seed information. No device, recovery seed, wallet, or funds compromise was reported.","directUserHarm":true,"customerDataOrAssetsCompromised":true,"disclosure":"proactive","remediation":"complete","sources":[{"label":"Trezor support portal security update","href":"https://blog.trezor.io/trezor-security-update-stay-vigilant-against-potential-phishing-attack-bb05015a21f8"},{"label":"Trezor newsletter security alert","href":"https://blog.trezor.io/trezor-security-alert-stay-vigilant-against-an-unauthorized-email-and-continued-phishing-attacks-1b4982c2f53c"}]}],"agentUsability":{"status":"hard-blocked","evidence":"No reviewed programmatic agent-payment profile is recorded; this dataset treats the service as hard-blocked until a control surface is documented.","derivedFrom":["agentMoney.compatible"]},"details_url":"https://cunicula.com/en/provider/trezor","canonical_score":26,"score_status":"rated","score_evidence":"limited","score_version":"4.0","score_breakdown":{"privacy":6,"control":0,"transparency":0,"security":12,"accountability":8},"applied_caps":[{"key":"active-high-incident","maximum":39,"reason":"An unresolved high-severity incident limits the score to 39."},{"key":"unresolved-material-compromise","maximum":49,"reason":"An unresolved customer-data or asset compromise limits the score to 49."},{"key":"resolved-high-data-compromise-five-years","maximum":79,"reason":"A resolved high-severity customer-data compromise within five years limits the score to 79."},{"key":"closed-critical-core-without-audit","maximum":69,"reason":"A closed or unknown critical core without current audit evidence limits the score to 69."}],"score_rationale":["privacy: 6 of 25 points.","control: 0 of 20 points.","transparency: 0 of 20 points.","security: 12 of 25 points.","accountability: 8 of 10 points.","Limited evidence: operatorDataExposure, controlModel, sourceModel scored zero.","An unresolved high-severity incident limits the score to 39.","An unresolved customer-data or asset compromise limits the score to 49.","A resolved high-severity customer-data compromise within five years limits the score to 79.","A closed or unknown critical core without current audit evidence limits the score to 69."],"last_scored":"2026-10-25","not_rated_reasons":[],"score_assessment":{"operatorDataExposure":"unknown","controlModel":"unknown","sourceModel":"unknown"},"score_review":{"outcome":"HOLD","checkedAt":"2026-08-25","inputs":{"operatorDataExposure":{"value":"unknown","sourceUrls":["https://trezor.io/","https://data.trezor.io/legal/privacy-policy.html","https://trezor.io/terms-of-use","https://api.github.com/repos/trezor/trezor-suite/releases/latest","https://medium.com/@trezor/security-incident-update-january-2024-66c1bdd37d2e","https://web.archive.org/web/20240123150319/https://blog.trezor.io/security-incident-update-january-2024-66c1bdd37d2e"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"controlModel":{"value":"unknown","sourceUrls":["https://trezor.io/","https://data.trezor.io/legal/privacy-policy.html","https://trezor.io/terms-of-use","https://api.github.com/repos/trezor/trezor-suite/releases/latest","https://medium.com/@trezor/security-incident-update-january-2024-66c1bdd37d2e","https://web.archive.org/web/20240123150319/https://blog.trezor.io/security-incident-update-january-2024-66c1bdd37d2e"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"sourceModel":{"value":"unknown","sourceUrls":["https://trezor.io/","https://data.trezor.io/legal/privacy-policy.html","https://trezor.io/terms-of-use","https://api.github.com/repos/trezor/trezor-suite/releases/latest","https://medium.com/@trezor/security-incident-update-january-2024-66c1bdd37d2e","https://web.archive.org/web/20240123150319/https://blog.trezor.io/security-incident-update-january-2024-66c1bdd37d2e"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."}},"audit":{"scoreEligible":false,"reason":"No dated, scoped, current audit citation was normalized in the reviewed packet; legacy auditedBy labels receive no score credit."}},"privacy_observations":{"identity_exposure_level":2,"identity_requirement":"none","hosted_operator_data":null,"jurisdiction":"CZ","jurisdiction_confidence":"verified","jurisdiction_context":"other"},"scoring_source_url":"https://cunicula.com/methodology#cunicula-score","jurisdiction_exposure":"other","primary_category":"Wallet","primary_bucket":"Wallet","corporate_identity":{"entity_type":"company","entity_type_note":"Current privacy policy and shop terms identify Trezor Company s.r.o.; no new registry-status or incorporation-date claim.","governance_model":null,"repository_url":null,"legal_entity":"Trezor Company s.r.o.","registration_number":"02440032","registry_url":null,"incorporation_jurisdiction":"Czech Republic","incorporation_date":null,"registered_address":"Kundratka 2359/17a, Libeň, 180 00 Prague 8, Czech Republic","parent_entity":null,"ultimate_owner":null,"prior_entities":[],"officers":[],"citations":{"legalEntity":{"url":"https://data.trezor.io/legal/privacy-policy.html","note":null,"agent_verified":false},"registrationNumber":{"url":"https://data.trezor.io/legal/privacy-policy.html","note":null,"agent_verified":false},"incorporationJurisdiction":{"url":"https://data.trezor.io/legal/privacy-policy.html","note":null,"agent_verified":false},"registeredAddress":{"url":"https://data.trezor.io/legal/privacy-policy.html","note":null,"agent_verified":false},"entityType":{"url":"https://data.trezor.io/legal/privacy-policy.html","note":null,"agent_verified":false}},"basis":"registry-sourced, not audited","agent_verified":false,"source":"Cited provider and public identity sources","reviewed_at":"2026-10-25"},"evidence_provenance":{"strongest_tier":"third-party-reported","tiers":["third-party-reported","self-reported"],"counts":{"directly-tested":0,"independent-audit":0,"third-party-reported":1,"self-reported":12},"total_sources":13},"privacy_score":60,"privacy_score_version":"3.1","privacy_factors":[{"key":"baseline","label":"Baseline","value":100,"detail":"Starting privacy exposure score"},{"key":"identity","label":"Identity exposure","value":-40,"detail":"Persistent contact, billing, or delivery data recorded (level 2 of 4)"},{"key":"operator-context","label":"Operator context","value":0,"detail":"Hosted operator; recorded jurisdiction: CZ"}],"evidence_confidence":87,"evidence_confidence_status":"deprecated","evidence_confidence_sunset_on":"2027-02-26","evidence_score_version":"3.1","evidence_factors":[{"key":"source-coverage","label":"Source coverage","value":70,"detail":"Material claims checked against current sources"},{"key":"freshness","label":"Review age","value":17,"detail":"Oldest recorded check is 91 days old"}],"score_computed_at":"2026-11-06T05:10:37.999Z","score_inputs":{"kycLevel":2,"noOperatorData":false,"jurisdiction":"CZ","jurisdictionConfidence":"verified","evidenceStatus":"verified","checkedAt":"2026-10-25","lastReviewed":"2026-10-25","kycLastChecked":"2026-08-07"},"citation":{"canonical_url":"https://cunicula.com/en/provider/trezor","api_url":"https://cunicula.com/api/v1/services/trezor","schema_version":"1.1.0","publisher":"Cunicula","reviewed":"2026-10-25","retrieved":"2026-11-06","attribution":"Cunicula, \"Trezor\", cunicula.com, reviewed 2026-10-25, retrieved 2026-11-06, https://cunicula.com/en/provider/trezor","attribution_template":"Cunicula, \"{name}\", cunicula.com, reviewed {reviewed}, retrieved {retrieved}, {url}","license":"LicenseRef-Cunicula-Attribution-1.0","license_url":"https://cunicula.com/en/cite","cite_guide_url":"https://cunicula.com/en/cite"},"edit_history":[{"changed_at":"2026-10-25T16:29:26+11:00","action":"updated","why":"fix: refresh overdue sources and recover publication pipeline","source":{"commit":"5705a0837a385381243c579d4f1331a89843169e","url":"https://cunicula.com/en/provider/trezor#history-5705a0837a38","review_source":"official_source_review_2026-10-25"},"changes":[{"field":"checkedAt","operation":"changed","before":"2026-08-23","after":"2026-10-25"},{"field":"corporate.entityType.note","operation":"changed","before":"Registry-sourced corporate record established in pass 1 via legalEntity.","after":"Current privacy policy and shop terms identify Trezor Company s.r.o.; no new registry-status or incorporation-date claim."},{"field":"corporate.incorporationDate.citation","operation":"changed","before":"https://www.lei-lookup.com/record/3157009C7CTD3LVQLV28/","after":"unknown"},{"field":"corporate.incorporationDate.value","operation":"changed","before":"2013-12-12","after":"unknown"},{"field":"corporate.registryUrl.citation","operation":"changed","before":"https://www.podnikatel.cz/rejstrik/trezor-company-s-r-o-02440032/","after":"unknown"},{"field":"corporate.registryUrl.value","operation":"changed","before":"https://or.justice.cz/ias/ui/rejstrik (file C 219483, Městský soud v Praze)","after":"unknown"},{"field":"corporate.reviewedAt","operation":"changed","before":"2026-08-08","after":"2026-10-25"},{"field":"corporate.source","operation":"changed","before":"registry research 2026-08-08, task t_047dfd90","after":"Cited provider and public identity sources"},{"field":"description","operation":"changed","before":"Czech hardware wallet vendor. The shop accepts Bitcoin, Litecoin, and Ethereum alongside cards and PayPal, and ships worldwide.","after":"Czech hardware wallet vendor offering self-custody devices and Trezor Suite, with crypto and conventional shop payments."},{"field":"features","operation":"changed","before":["Multi-coin hardware signer","Bitcoin-only firmware option","Open source firmware","Secure Element on Safe models","PIN and passphrase","On-device confirmation","Coin control in Trezor Suite","Tor support in Trezor Suite","Bitcoin and crypto checkout"],"after":["Hardware signer","Open source firmware","On-device transaction confirmation","Trezor Suite for desktop and mobile","Bitcoin and crypto checkout"]},{"field":"fee","operation":"changed","before":"From EUR 47 (one-time hardware)","after":"Hardware purchase; current price depends on model and region."},{"field":"kycNote","operation":"changed","before":"No document identity check is required to buy a device. The shop states it supports Google Pay, Apple Pay, debit and credit card, Bitcoin, and selected cryptocurrencies. Paying with Bitcoin removes the card trail but a delivery address is still recorded, and the shop ships to over 200 countries and territories.","after":"Wallet use does not require an identity account. Shop orders collect name, phone, email and delivery address. Brazil orders also require CPF and Korean orders PCC; payment and trading providers have their own requirements."},{"field":"lastReviewed","operation":"changed","before":"2026-08-23","after":"2026-10-25"},{"field":"privacyWarning","operation":"changed","before":"Trezor reports 347,149 newsletter email addresses exported through Brevo (September 17, 2026 update) and, separately, 80,689 customers affected by ShipMonk order-data exposure (September 4 update). These populations may overlap. The STM32 security email was phishing, not evidence of compromised wallet hardware. Trezor says its devices and wallet systems were unaffected. Shipping addresses add physical-security risk; never disclose a wallet backup in response to a message. Earlier 2024 support and newsletter incidents remain recorded separately.","after":"Trezor reports 347,149 email contacts exported through Brevo and 80,689 customers affected by ShipMonk order-data exposure. The groups may overlap. Trezor says wallet systems were unaffected; neither disclosure establishes that all consequences are resolved. Shop and payment partners also process buyer information."},{"field":"reviewSource","operation":"changed","before":"Incident-only review 2026-09-21: Trezor Brevo disclosure updated September 17, ShipMonk disclosure updated September 4, and Brevo postmortem. General product, KYC, corporate and score reviews were not refreshed.","after":"official_source_review_2026-10-25"},{"field":"updatedAt","operation":"changed","before":"2026-09-21","after":"2026-10-25"}]},{"changed_at":"2026-09-21T07:29:55+10:00","action":"updated","why":"fix(content): separate Trezor supplier incidents [skip render]","source":{"commit":"40a3cbaccb3eb75aa7870422efb56197f3a175ef","url":"https://cunicula.com/en/provider/trezor#history-40a3cbaccb3e","review_source":"Incident-only review 2026-09-21: Trezor Brevo disclosure updated September 17, ShipMonk disclosure updated September 4, and Brevo postmortem. General product, KYC, corporate and score reviews were not refreshed."},"changes":[{"field":"privacyWarning","operation":"changed","before":"Hardware-wallet keys remain self-custodied, but Trezor's 2024 third-party support portal incident exposed email/name and limited support data for 66,000 users; 41 received recovery-seed phishing contacts. Treat support/shipping messages as phishing-sensitive and never enter a recovery seed outside the device flow.","after":"Trezor reports 347,149 newsletter email addresses exported through Brevo (September 17, 2026 update) and, separately, 80,689 customers affected by ShipMonk order-data exposure (September 4 update). These populations may overlap. The STM32 security email was phishing, not evidence of compromised wallet hardware. Trezor says its devices and wallet systems were unaffected. Shipping addresses add physical-security risk; never disclose a wallet backup in response to a message. Earlier 2024 support and newsletter incidents remain recorded separately."},{"field":"reviewSource","operation":"changed","before":"official_trezor_support_and_newsletter_incidents_2026-08-23","after":"Incident-only review 2026-09-21: Trezor Brevo disclosure updated September 17, ShipMonk disclosure updated September 4, and Brevo postmortem. General product, KYC, corporate and score reviews were not refreshed."},{"field":"updatedAt","operation":"changed","before":"2026-08-23","after":"2026-09-21"}]},{"changed_at":"2026-08-27T08:50:11+10:00","action":"updated","why":"fix: reconcile score 4.0 evidence","source":{"commit":"18e788afe003dcb0febe08a578aaf9cb087161b2","url":"https://cunicula.com/en/provider/trezor#history-18e788afe003","review_source":"official_trezor_support_and_newsletter_incidents_2026-08-23"},"changes":[{"field":"scoreAssessment.controlModel","operation":"changed","before":"local-self-custody","after":"unknown"},{"field":"scoreAssessment.operatorDataExposure","operation":"changed","before":"moderate","after":"unknown"},{"field":"scoreAssessment.sourceModel","operation":"changed","before":"open","after":"unknown"},{"field":"scoreReview","operation":"added","before":null,"after":{"outcome":"HOLD","checkedAt":"2026-08-25","inputs":{"operatorDataExposure":{"value":"unknown","sourceUrls":["https://trezor.io/","https://data.trezor.io/legal/privacy-policy.html","https://trezor.io/terms-of-use","https://api.github.com/repos/trezor/trezor-suite/releases/latest","https://medium.com/@trezor/security-incident-update-january-2024-66c1bdd37d2e","https://web.archive.org/web/20240123150319/https://blog.trezor.io/security-incident-update-january-2024-66c1bdd37d2e"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"controlModel":{"value":"unknown","sourceUrls":["https://trezor.io/","https://data.trezor.io/legal/privacy-policy.html","https://trezor.io/terms-of-use","https://api.github.com/repos/trezor/trezor-suite/releases/latest","https://medium.com/@trezor/security-incident-update-january-2024-66c1bdd37d2e","https://web.archive.org/web/20240123150319/https://blog.trezor.io/security-incident-update-january-2024-66c1bdd37d2e"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"sourceModel":{"value":"unknown","sourceUrls":["https://trezor.io/","https://data.trezor.io/legal/privacy-policy.html","https://trezor.io/terms-of-use","https://api.github.com/repos/trezor/trezor-suite/releases/latest","https://medium.com/@trezor/security-incident-update-january-2024-66c1bdd37d2e","https://web.archive.org/web/20240123150319/https://blog.trezor.io/security-incident-update-january-2024-66c1bdd37d2e"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."}},"audit":{"scoreEligible":false,"reason":"No dated, scoped, current audit citation was normalized in the reviewed packet; legacy auditedBy labels receive no score credit."}}}]},{"changed_at":"2026-08-26T16:27:32+10:00","action":"updated","why":"feat: apply full-service rereview and score 4.0","source":{"commit":"faa73ed3ef3cfbd8ae2fbc31753e0d1ddc6b11cf","url":"https://cunicula.com/en/provider/trezor#history-faa73ed3ef3c","review_source":"official_trezor_support_and_newsletter_incidents_2026-08-23"},"changes":[{"field":"incidents","operation":"removed","before":[{"title":"Third-party support portal contact exposure","status":"resolved","severity":"high","startedAt":"2024-01-17","resolvedAt":"2024-01-17","summary":"Unauthorized access to Trezor's third-party support-ticket portal may have exposed the name/nickname and email address of up to 66,000 support contacts. Phishing followed: the actor emailed 41 users asking for recovery-seed information. No device, recovery seed, wallet, or funds compromise was reported.","sources":[{"label":"Trezor support portal security update","href":"https://blog.trezor.io/trezor-security-update-stay-vigilant-against-potential-phishing-attack-bb05015a21f8"}]},{"title":"Unauthorized newsletter email","status":"resolved","severity":"high","startedAt":"2024-01-24","resolvedAt":"2024-01-24","summary":"An unauthorized actor used a separate third-party email service to send Trezor newsletter subscribers an unauthorized newsletter email asking for recovery seeds. Trezor said the event affected newsletter email addresses only, deactivated the link, and restricted unauthorized access. No device, recovery seed, wallet, or funds compromise was reported.","sources":[{"label":"Trezor newsletter security alert","href":"https://blog.trezor.io/trezor-security-alert-stay-vigilant-against-an-unauthorized-email-and-continued-phishing-attacks-1b4982c2f53c"}]}],"after":null},{"field":"privacyWarning","operation":"changed","before":"Trezor is a physical product. Ordering from the shop creates an order and delivery record even when payment is made in Bitcoin, and the shop recommends buying only from official channels. Coin control and Tor are features of the Trezor Suite app, not of the device on its own.","after":"Hardware-wallet keys remain self-custodied, but Trezor's 2024 third-party support portal incident exposed email/name and limited support data for 66,000 users; 41 received recovery-seed phishing contacts. Treat support/shipping messages as phishing-sensitive and never enter a recovery seed outside the device flow."},{"field":"scoreAssessment","operation":"added","before":null,"after":{"operatorDataExposure":"moderate","controlModel":"local-self-custody","sourceModel":"open"}}]},{"changed_at":"2026-08-25T05:05:17+10:00","action":"updated","why":"fix: update current service records","source":{"commit":"476c8e458688cc521bb0264b50c0b90175377366","url":"https://cunicula.com/en/provider/trezor#history-476c8e458688","review_source":"official_trezor_support_and_newsletter_incidents_2026-08-23"},"changes":[{"field":"checkedAt","operation":"changed","before":"2026-08-07","after":"2026-08-23"},{"field":"incidents","operation":"added","before":null,"after":[{"title":"Third-party support portal contact exposure","status":"resolved","severity":"high","startedAt":"2024-01-17","resolvedAt":"2024-01-17","summary":"Unauthorized access to Trezor's third-party support-ticket portal may have exposed the name/nickname and email address of up to 66,000 support contacts. Phishing followed: the actor emailed 41 users asking for recovery-seed information. No device, recovery seed, wallet, or funds compromise was reported.","sources":[{"label":"Trezor support portal security update","href":"https://blog.trezor.io/trezor-security-update-stay-vigilant-against-potential-phishing-attack-bb05015a21f8"}]},{"title":"Unauthorized newsletter email","status":"resolved","severity":"high","startedAt":"2024-01-24","resolvedAt":"2024-01-24","summary":"An unauthorized actor used a separate third-party email service to send Trezor newsletter subscribers an unauthorized newsletter email asking for recovery seeds. Trezor said the event affected newsletter email addresses only, deactivated the link, and restricted unauthorized access. No device, recovery seed, wallet, or funds compromise was reported.","sources":[{"label":"Trezor newsletter security alert","href":"https://blog.trezor.io/trezor-security-alert-stay-vigilant-against-an-unauthorized-email-and-continued-phishing-attacks-1b4982c2f53c"}]}]},{"field":"lastReviewed","operation":"changed","before":"2026-08-07","after":"2026-08-23"},{"field":"reviewSource","operation":"changed","before":"official_trezor_faqs_company_shop_intake_2026-08-07","after":"official_trezor_support_and_newsletter_incidents_2026-08-23"},{"field":"riskLevel","operation":"changed","before":"standard","after":"caution"},{"field":"updatedAt","operation":"changed","before":"2026-08-07","after":"2026-08-23"}]},{"changed_at":"2026-08-09T15:02:38+10:00","action":"updated","why":"Schema coherence: make \"no legal entity\" a statable answer","source":{"commit":"075c50f012e80ede7c8cdaf232ba498568a04276","url":"https://cunicula.com/en/provider/trezor#history-075c50f012e8","review_source":"official_trezor_faqs_company_shop_intake_2026-08-07"},"changes":[{"field":"corporate.entityType","operation":"added","before":null,"after":{"value":"company","citation":"https://data.trezor.io/legal/privacy-policy.html","note":"Registry-sourced corporate record established in pass 1 via legalEntity."}}]},{"changed_at":"2026-08-08T20:39:10+10:00","action":"updated","why":"data: registry-sourced corporate identity for 79 services","source":{"commit":"e6b09ff769a03b6bcda957c24e2cfd447d7b6c46","url":"https://cunicula.com/en/provider/trezor#history-e6b09ff769a0","review_source":"official_trezor_faqs_company_shop_intake_2026-08-07"},"changes":[{"field":"corporate","operation":"added","before":null,"after":{"legalEntity":{"value":"Trezor Company s.r.o.","citation":"https://data.trezor.io/legal/privacy-policy.html"},"registrationNumber":{"value":"02440032","citation":"https://data.trezor.io/legal/privacy-policy.html"},"registryUrl":{"value":"https://or.justice.cz/ias/ui/rejstrik (file C 219483, Městský soud v Praze)","citation":"https://www.podnikatel.cz/rejstrik/trezor-company-s-r-o-02440032/"},"incorporationJurisdiction":{"value":"Czech Republic","citation":"https://data.trezor.io/legal/privacy-policy.html"},"incorporationDate":{"value":"2013-12-12","citation":"https://www.lei-lookup.com/record/3157009C7CTD3LVQLV28/"},"registeredAddress":{"value":"Kundratka 2359/17a, Libeň, 180 00 Prague 8, Czech Republic","citation":"https://data.trezor.io/legal/privacy-policy.html"},"officers":{"value":[],"citation":"unknown"},"priorEntities":{"value":[],"citation":"unknown"},"source":"registry research 2026-08-08, task t_047dfd90","reviewedAt":"2026-08-08"}}]},{"changed_at":"2026-08-08T07:39:06+10:00","action":"updated","why":"feat(directory): intake Obtainium and KeePassXC","source":{"commit":"554c3edcf2c09a7be602ce79dd3d1edd04b2880a","url":"https://cunicula.com/en/provider/trezor#history-554c3edcf2c0","review_source":"official_trezor_faqs_company_shop_intake_2026-08-07"},"changes":[{"field":"description","operation":"changed","before":"Czech hardware wallet from Trezor Company s.r.o. with open source firmware, on-device confirmation, and a shop that takes Bitcoin and selected cryptocurrencies alongside card, Apple Pay, Google Pay, and PayPal.","after":"Czech hardware wallet vendor. The shop accepts Bitcoin, Litecoin, and Ethereum alongside cards and PayPal, and ships worldwide."}]},{"changed_at":"2026-08-08T07:02:00+10:00","action":"created","why":"feat(directory): intake Trezor and BitBox02 hardware wallets","source":{"commit":"1e9decc8209331886c52c53d3ac6ff36a1a87136","url":"https://cunicula.com/en/provider/trezor#history-1e9decc82093","review_source":"official_trezor_faqs_company_shop_intake_2026-08-07"},"changes":[{"field":"record","operation":"added","before":null,"after":"created"}]}],"history_scope":{"schema_version":"1.0.0","source_path":"data/services.json","source_repository":"https://cunicula.com/en/methodology#record-history","source_commit":"656629f3a2cfd1544249be7a37a0b0526c6bbe7e","record_identity":"id","scope":"Committed public record changes. Creation events are summarized; later events contain field-level before/after values. Internal affiliate and numeric identity fields are excluded, and unsupported public claims remain redacted.","event_count":9},"related_services":[{"slug":"bitbox02","name":"BitBox02","domain":"bitbox.swiss","url":"https://bitbox.swiss/","kyc":"none","kycLevel":2,"kycNote":"No document identity check is required to buy a device. The payment policy lists two processors: BTCPay for on-chain Bitcoin and Lightning, and Stripe for cards, bank transfers, PayPal, Apple Pay, and Google Pay. Available methods vary by country, so the checkout page decides which rails apply.","fee":"One-time hardware purchase","categories":["Wallet"],"countries":["GLOBAL"],"bestFor":["Cold storage","Bitcoin-only self-custody","Paying for hardware in Bitcoin"],"features":["Bitcoin-only edition","Multi-coin edition","Open source firmware","Swiss operator","On-chain Bitcoin checkout","Lightning checkout","microSD backup","BitBoxApp companion"],"tagline":"Swiss hardware signer with Bitcoin-only firmware and Lightning checkout.","status":"ok","updatedAt":"2026-08-07","description":"Swiss hardware wallet from Shift Crypto. The shop takes on-chain Bitcoin and Lightning through BTCPay, plus cards via Stripe.","cardSummary":"Swiss hardware signer taking BTC and Lightning.","networks":["BTC","LN"],"checkedAt":"2026-08-07","lastReviewed":"2026-08-07","reviewSource":"official_bitbox_payment_shipping_policy_intake_2026-08-07","jurisdictionConfidence":"verified","kycLastChecked":"2026-08-07","trending":false,"jurisdiction":"CH","evidenceStatus":"verified","riskLevel":"standard","privacyWarning":"BitBox02 is a physical product. Shift Crypto AG holds order and shipping data even when payment settles in Bitcoin or over Lightning. Orders ship from Swiss and German warehouses, and duties and taxes are prepaid on some routes, which adds a customs record.","auditedBy":[],"corporate":{"entityType":{"value":"company","citation":"https://bitbox.swiss/imprint/","note":"Official imprint, terms of service, and privacy policy state that BitBox is created and the website operated by Shift Crypto AG, a Swiss Aktiengesellschaft selling hardware wallets."},"governanceModel":{"value":"company-sponsored","citation":"https://bitbox.swiss/dev/"},"repositoryUrl":{"value":"https://github.com/BitBoxSwiss","citation":"https://github.com/BitBoxSwiss"},"legalEntity":{"value":"Shift Crypto AG","citation":"https://bitbox.swiss/imprint/"},"registrationNumber":{"value":"CHE-498.818.196 (commercial register CH-020.3.048.536-0; imprint also lists CH-498.818.196)","citation":"https://www.uid.admin.ch/Detail.aspx?uid_id=CHE-498.818.196"},"registryUrl":{"value":"https://www.uid.admin.ch/Detail.aspx?uid_id=CHE-498.818.196","citation":"https://www.uid.admin.ch/Detail.aspx?uid_id=CHE-498.818.196"},"incorporationJurisdiction":{"value":"Switzerland (Canton of Zurich)","citation":"https://bitbox.swiss/imprint/"},"incorporationDate":{"value":"2020-04-01","citation":"https://www.moneyhouse.ch/en/company/shift-crypto-ag-2790108461"},"registeredAddress":{"value":"Soodmattenstrasse 4, 8134 Adliswil, Switzerland","citation":"https://bitbox.swiss/imprint/"},"officers":{"value":["Douglas Bakkum (Member of the Board, CEO)"],"citation":"https://bitbox.swiss/imprint/"},"priorEntities":{"value":["Shift Cryptosecurity AG in Liquidation (formerly Shift Devices AG), UID CHE-149.201.586, commercial register CH-280.3.019.469-1; trademarks/domains/assets transferred into Shift Crypto AG on foundation"],"citation":"https://www.uid.admin.ch/Detail.aspx?uid_id=CHE-149.201.586"},"source":"corporate identity pass 2 (t_d7269d23), cited web research via grok web search","reviewedAt":"2026-08-09"},"twitter":"https://x.com/BitBoxSwiss","agentUsability":{"status":"hard-blocked","evidence":"No reviewed programmatic agent-payment profile is recorded; this dataset treats the service as hard-blocked until a control surface is documented.","derivedFrom":["agentMoney.compatible"]},"details_url":"https://cunicula.com/en/provider/bitbox02","canonical_score":39,"score_status":"rated","score_evidence":"limited","score_version":"4.0","score_breakdown":{"privacy":6,"control":0,"transparency":0,"security":25,"accountability":8},"applied_caps":[{"key":"closed-critical-core-without-audit","maximum":69,"reason":"A closed or unknown critical core without current audit evidence limits the score to 69."}],"score_rationale":["privacy: 6 of 25 points.","control: 0 of 20 points.","transparency: 0 of 20 points.","security: 25 of 25 points.","accountability: 8 of 10 points.","Limited evidence: operatorDataExposure, controlModel, sourceModel scored zero.","A closed or unknown critical core without current audit evidence limits the score to 69."],"last_scored":"2026-10-25","not_rated_reasons":[],"score_assessment":{"operatorDataExposure":"unknown","controlModel":"unknown","sourceModel":"unknown"},"score_review":{"outcome":"PASS","checkedAt":"2026-08-25","inputs":{"operatorDataExposure":{"value":"unknown","sourceUrls":["https://bitbox.swiss/","https://bitbox.swiss/policies/payment-policy/","https://bitbox.swiss/policies/privacy-policy","https://bitbox.swiss/policies/privacy-policy/","https://bitbox.swiss/imprint","https://bitbox.swiss/imprint/","https://github.com/BitBoxSwiss/bitbox02-firmware/releases"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"controlModel":{"value":"unknown","sourceUrls":["https://bitbox.swiss/","https://bitbox.swiss/policies/payment-policy/","https://bitbox.swiss/policies/privacy-policy","https://bitbox.swiss/policies/privacy-policy/","https://bitbox.swiss/imprint","https://bitbox.swiss/imprint/","https://github.com/BitBoxSwiss/bitbox02-firmware/releases"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"sourceModel":{"value":"unknown","sourceUrls":["https://bitbox.swiss/","https://bitbox.swiss/policies/payment-policy/","https://bitbox.swiss/policies/privacy-policy","https://bitbox.swiss/policies/privacy-policy/","https://bitbox.swiss/imprint","https://bitbox.swiss/imprint/","https://github.com/BitBoxSwiss/bitbox02-firmware/releases"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."}},"audit":{"scoreEligible":false,"reason":"No dated, scoped, current audit citation was normalized in the reviewed packet; legacy auditedBy labels receive no score credit."}},"privacy_observations":{"identity_exposure_level":2,"identity_requirement":"none","hosted_operator_data":null,"jurisdiction":"CH","jurisdiction_confidence":"verified","jurisdiction_context":"other"},"scoring_source_url":"https://cunicula.com/methodology#cunicula-score","jurisdiction_exposure":"other","primary_category":"Wallet","primary_bucket":"Wallet","corporate_identity":{"entity_type":"company","entity_type_note":"Official imprint, terms of service, and privacy policy state that BitBox is created and the website operated by Shift Crypto AG, a Swiss Aktiengesellschaft selling hardware wallets.","governance_model":"company-sponsored","repository_url":"https://github.com/BitBoxSwiss","legal_entity":"Shift Crypto AG","registration_number":"CHE-498.818.196 (commercial register CH-020.3.048.536-0; imprint also lists CH-498.818.196)","registry_url":"https://www.uid.admin.ch/Detail.aspx?uid_id=CHE-498.818.196","incorporation_jurisdiction":"Switzerland (Canton of Zurich)","incorporation_date":"2020-04-01","registered_address":"Soodmattenstrasse 4, 8134 Adliswil, Switzerland","parent_entity":null,"ultimate_owner":null,"prior_entities":[{"name":"Shift Cryptosecurity AG in Liquidation (formerly Shift Devices AG), UID CHE-149.201.586, commercial register CH-280.3.019.469-1; trademarks/domains/assets transferred into Shift Crypto AG on foundation","detail":null}],"officers":[{"name":"Douglas Bakkum (Member of the Board, CEO)","role":null}],"citations":{"legalEntity":{"url":"https://bitbox.swiss/imprint/","note":null,"agent_verified":false},"registrationNumber":{"url":"https://www.uid.admin.ch/Detail.aspx?uid_id=CHE-498.818.196","note":null,"agent_verified":false},"incorporationJurisdiction":{"url":"https://bitbox.swiss/imprint/","note":null,"agent_verified":false},"incorporationDate":{"url":"https://www.moneyhouse.ch/en/company/shift-crypto-ag-2790108461","note":null,"agent_verified":false},"registeredAddress":{"url":"https://bitbox.swiss/imprint/","note":null,"agent_verified":false},"priorEntities":{"url":"https://www.uid.admin.ch/Detail.aspx?uid_id=CHE-149.201.586","note":null,"agent_verified":false},"officers":{"url":"https://bitbox.swiss/imprint/","note":null,"agent_verified":false},"entityType":{"url":"https://bitbox.swiss/imprint/","note":null,"agent_verified":false},"governanceModel":{"url":"https://bitbox.swiss/dev/","note":null,"agent_verified":false}},"basis":"registry-sourced, not audited","agent_verified":false,"source":"corporate identity pass 2 (t_d7269d23), cited web research via grok web search","reviewed_at":"2026-08-09"},"evidence_provenance":{"strongest_tier":"third-party-reported","tiers":["third-party-reported","self-reported"],"counts":{"directly-tested":0,"independent-audit":0,"third-party-reported":5,"self-reported":7},"total_sources":12},"privacy_score":60,"privacy_score_version":"3.1","privacy_factors":[{"key":"baseline","label":"Baseline","value":100,"detail":"Starting privacy exposure score"},{"key":"identity","label":"Identity exposure","value":-40,"detail":"Persistent contact, billing, or delivery data recorded (level 2 of 4)"},{"key":"operator-context","label":"Operator context","value":0,"detail":"Hosted operator; recorded jurisdiction: CH"}],"evidence_confidence":87,"evidence_confidence_status":"deprecated","evidence_confidence_sunset_on":"2027-02-26","evidence_score_version":"3.1","evidence_factors":[{"key":"source-coverage","label":"Source coverage","value":70,"detail":"Material claims checked against current sources"},{"key":"freshness","label":"Review age","value":17,"detail":"Oldest recorded check is 91 days old"}],"score_computed_at":"2026-11-06T05:10:38.002Z","score_inputs":{"kycLevel":2,"noOperatorData":false,"jurisdiction":"CH","jurisdictionConfidence":"verified","evidenceStatus":"verified","checkedAt":"2026-08-07","lastReviewed":"2026-08-07","kycLastChecked":"2026-08-07"}},{"slug":"cake-wallet","name":"Cake Wallet","domain":"cakewallet.com","url":"https://cakewallet.com/","kyc":"none","kycLevel":0,"kycNote":"Wallet keys stay on your device. Swap and purchase providers may request personal information; their identity rules are separate from base wallet use.","fee":"Free app; network and third-party service fees apply.","categories":["Wallet"],"countries":["GLOBAL"],"features":["XMR, ZEC, BTC and LTC","Self-custody","Third-party swaps","Open source","iOS and Android"],"status":"warning","updatedAt":"2026-10-25","description":"Self-custodial wallet for XMR, ZEC, BTC and LTC with built-in third-party swaps.","cardSummary":"Multi-coin wallet with built-in swaps.","networks":[],"checkedAt":"2026-10-25","lastReviewed":"2026-10-25","reviewSource":"official_source_review_2026-10-25","jurisdictionConfidence":"inferred","kycLastChecked":"2026-10-25","trending":true,"jurisdiction":"US","noOperatorData":false,"evidenceStatus":"partial","riskLevel":"standard","privacyWarning":"Cake Labs nodes may transiently receive IP address, wallet sync height, and submitted transactions/channels but state they do not retain them. Optional third-party buy/sell and swap services have separate privacy/KYC practices and may request personal information.","auditedBy":null,"corporate":{"entityType":{"value":"company","citation":"https://cakewallet.com/terms/","note":"Official Terms of Use state the apps are provided by Cake Labs LLC, a limited liability company formed under the laws of Nevis; security page and copyright also name Cake Labs LLC as developer."},"governanceModel":{"value":"company-sponsored","citation":"https://cakelabs.com/"},"repositoryUrl":{"value":"https://github.com/cake-tech/cake_wallet","citation":"https://github.com/cake-tech/cake_wallet"},"legalEntity":{"value":"Cake Labs LLC","citation":"https://cakewallet.com/terms/"},"incorporationJurisdiction":{"value":"Nevis (Saint Kitts and Nevis)","citation":"https://cakewallet.com/terms/"},"officers":{"value":[{"name":"Vikrant Sharma","role":"CEO / Founder"},{"name":"Seth For Privacy","role":"COO"}],"citation":"https://cakewallet.com/about/"},"priorEntities":{"value":[],"citation":"unknown"},"source":"corporate identity pass 2 (t_d7269d23), cited web research via grok web search","reviewedAt":"2026-08-09"},"publicClaims":{"followTheMoney":{"value":"Cake Wallet\n────────────────────────\nFounder and CEO: Vikrant Sharma\nCake Wallet founded: 2018\nCake Labs founded: 2017\nSoftware: open source","reviewedAt":"2026-07-15","sources":[{"label":"Cake Wallet - About","href":"https://cakewallet.com/about/","type":"official"}]}},"followTheMoney":"Cake Wallet\n────────────────────────\nFounder and CEO: Vikrant Sharma\nCake Wallet founded: 2018\nCake Labs founded: 2017\nSoftware: open source","agentUsability":{"status":"hard-blocked","evidence":"No reviewed programmatic agent-payment profile is recorded; this dataset treats the service as hard-blocked until a control surface is documented.","derivedFrom":["agentMoney.compatible"]},"details_url":"https://cunicula.com/en/provider/cake-wallet","canonical_score":43,"score_status":"rated","score_evidence":"limited","score_version":"4.0","score_breakdown":{"privacy":12,"control":0,"transparency":0,"security":25,"accountability":6},"applied_caps":[{"key":"closed-critical-core-without-audit","maximum":69,"reason":"A closed or unknown critical core without current audit evidence limits the score to 69."}],"score_rationale":["privacy: 12 of 25 points.","control: 0 of 20 points.","transparency: 0 of 20 points.","security: 25 of 25 points.","accountability: 6 of 10 points.","Limited evidence: operatorDataExposure, controlModel, sourceModel scored zero.","A closed or unknown critical core without current audit evidence limits the score to 69."],"last_scored":"2026-10-25","not_rated_reasons":[],"score_assessment":{"operatorDataExposure":"unknown","controlModel":"unknown","sourceModel":"unknown"},"score_review":{"outcome":"HOLD","checkedAt":"2026-08-25","inputs":{"operatorDataExposure":{"value":"unknown","sourceUrls":["https://cakewallet.com/","https://cakewallet.com/terms/","https://cakewallet.com/privacy/","https://cakewallet.com/security/","https://github.com/cake-tech/cake_wallet/releases/tag/v6.4.1","https://status.cakewallet.com/api/status-page/cake/badge","https://status.cakewallet.com/api/status-page/cake"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"controlModel":{"value":"unknown","sourceUrls":["https://cakewallet.com/","https://cakewallet.com/terms/","https://cakewallet.com/privacy/","https://cakewallet.com/security/","https://github.com/cake-tech/cake_wallet/releases/tag/v6.4.1","https://status.cakewallet.com/api/status-page/cake/badge","https://status.cakewallet.com/api/status-page/cake"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"sourceModel":{"value":"unknown","sourceUrls":["https://cakewallet.com/","https://cakewallet.com/terms/","https://cakewallet.com/privacy/","https://cakewallet.com/security/","https://github.com/cake-tech/cake_wallet/releases/tag/v6.4.1","https://status.cakewallet.com/api/status-page/cake/badge","https://status.cakewallet.com/api/status-page/cake"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."}},"audit":{"scoreEligible":false,"reason":"No dated, scoped, current audit citation was normalized in the reviewed packet; legacy auditedBy labels receive no score credit."}},"privacy_observations":{"identity_exposure_level":0,"identity_requirement":"none","hosted_operator_data":true,"jurisdiction":"US","jurisdiction_confidence":"inferred","jurisdiction_context":"five_eyes"},"scoring_source_url":"https://cunicula.com/methodology#cunicula-score","jurisdiction_exposure":"five_eyes","primary_category":"Wallet","primary_bucket":"Wallet","corporate_identity":{"entity_type":"company","entity_type_note":"Official Terms of Use state the apps are provided by Cake Labs LLC, a limited liability company formed under the laws of Nevis; security page and copyright also name Cake Labs LLC as developer.","governance_model":"company-sponsored","repository_url":"https://github.com/cake-tech/cake_wallet","legal_entity":"Cake Labs LLC","registration_number":null,"registry_url":null,"incorporation_jurisdiction":"Nevis (Saint Kitts and Nevis)","incorporation_date":null,"registered_address":null,"parent_entity":null,"ultimate_owner":null,"prior_entities":[],"officers":[{"name":"Vikrant Sharma","role":"CEO / Founder"},{"name":"Seth For Privacy","role":"COO"}],"citations":{"legalEntity":{"url":"https://cakewallet.com/terms/","note":null,"agent_verified":false},"incorporationJurisdiction":{"url":"https://cakewallet.com/terms/","note":null,"agent_verified":false},"officers":{"url":"https://cakewallet.com/about/","note":null,"agent_verified":false},"entityType":{"url":"https://cakewallet.com/terms/","note":null,"agent_verified":false},"governanceModel":{"url":"https://cakelabs.com/","note":null,"agent_verified":false}},"basis":"registry-sourced, not audited","agent_verified":false,"source":"corporate identity pass 2 (t_d7269d23), cited web research via grok web search","reviewed_at":"2026-08-09"},"evidence_provenance":{"strongest_tier":"third-party-reported","tiers":["third-party-reported","self-reported"],"counts":{"directly-tested":0,"independent-audit":0,"third-party-reported":2,"self-reported":6},"total_sources":8},"privacy_score":100,"privacy_score_version":"3.1","privacy_factors":[{"key":"baseline","label":"Baseline","value":100,"detail":"Starting privacy exposure score"},{"key":"identity","label":"Identity exposure","value":0,"detail":"No required account or identity data recorded (level 0 of 4)"},{"key":"operator-context","label":"Operator context","value":0,"detail":"Hosted operator; inferred jurisdiction: US"}],"evidence_confidence":72,"evidence_confidence_status":"deprecated","evidence_confidence_sunset_on":"2027-02-26","evidence_score_version":"3.1","evidence_factors":[{"key":"source-coverage","label":"Source coverage","value":42,"detail":"Some material claims still need confirmation"},{"key":"freshness","label":"Review age","value":30,"detail":"All recorded checks are within 30 days"}],"score_computed_at":"2026-11-06T05:10:38.003Z","score_inputs":{"kycLevel":0,"noOperatorData":false,"jurisdiction":"US","jurisdictionConfidence":"inferred","evidenceStatus":"partial","checkedAt":"2026-10-25","lastReviewed":"2026-10-25","kycLastChecked":"2026-10-25"}},{"slug":"coldcard","name":"Coldcard","domain":"coldcard.com","url":"https://coldcard.com/","kyc":"none","kycLevel":0,"kycNote":"No account, no KYC for firmware use. Hardware purchase may expose shipping address.","fee":"Mk5 USD 189; Q USD 289","categories":["Wallet","Privacy Tools"],"countries":["GLOBAL"],"bestFor":["Cold storage","Air-gapped Bitcoin signing","Maximum self-custody"],"features":["Air-gapped signing","Bitcoin-only","Verifiable firmware source","Duress PIN","PSBT via MicroSD","Sparrow compatible","No companion app required","Dual secure elements","Mk5 and Q models"],"tagline":null,"status":"ok","updatedAt":"2026-09-05","description":"Bitcoin-only air-gapped hardware signer by Coinkite with PSBT signing over MicroSD or QR and duress PIN support.","cardSummary":"Bitcoin-only air-gapped hardware signer.","networks":["BTC"],"checkedAt":"2026-08-25","lastReviewed":"2026-09-05","reviewSource":"https://coldcard.com/security/status","jurisdictionConfidence":"verified","kycLastChecked":"2026-09-05","trending":false,"jurisdiction":"CA","evidenceStatus":"verified","riskLevel":"danger","privacyWarning":"A July 2026 firmware random-number-generator defect weakened seeds generated on affected Coldcard versions and was exploited offline to steal funds. Devices were not remotely hacked. Installing fixed firmware does not repair an existing weak seed. Users who generated a seed on an affected version must follow Coinkite's migration procedure and move funds to a new seed unless the documented dice-roll exception applies.","auditedBy":[],"corporate":{"entityType":{"value":"company","citation":"https://coldcard.com/about","note":"Official Coldcard about page and Coinkite terms state Coldcard is made by Coinkite Inc., a real operating Canadian vendor/shop."},"governanceModel":{"value":"company-sponsored","citation":"https://coldcard.com/about"},"repositoryUrl":{"value":"https://github.com/Coldcard/firmware","citation":"https://github.com/Coldcard/firmware"},"legalEntity":{"value":"Coinkite Inc.","citation":"https://coldcard.com/about"},"incorporationJurisdiction":{"value":"Ontario, Canada","citation":"https://coinkite.com/terms-of-use"},"registeredAddress":{"value":"3219 Yonge St., Unit 376, Toronto, ON M4N 3S1, Canada","citation":"https://coinkite.com/terms-of-use"},"source":"corporate identity pass 2 (t_d7269d23), cited web research via grok web search","reviewedAt":"2026-08-09"},"twitter":"https://x.com/COLDCARDwallet","incidents":[{"title":"2021-2026 firmware RNG entropy defect and Bitcoin theft","status":"monitoring","severity":"critical","startedAt":"2026-07-30","summary":"Affected firmware could generate wallet seeds through a deterministic software fallback rather than the hardware RNG. Affected releases include Mk2 and Mk3 4.0.1 through 4.1.9, Mk4 and Mk5 before 5.6.0, Q before 1.5.0Q, and Edge before 6.6.0X or 6.6.0QX. Current recommended standard releases are Mk4 and Mk5 5.6.2 and Q 1.5.2Q. Updating firmware prevents newly affected seeds but does not repair an existing affected seed. A BIP-39 passphrase does not repair the seed; users must migrate under the official guidance unless its exact independent-dice condition applies. The formal technical postmortem remains unpublished.","directUserHarm":true,"customerDataOrAssetsCompromised":true,"disclosure":"delayed","remediation":"partial","sources":[{"label":"Coinkite security advisory","href":"https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/"},{"label":"Coinkite technical backgrounder","href":"https://blog.coinkite.com/entropy-technical-backgrounder/"},{"label":"Coldcard firmware changelog","href":"https://github.com/Coldcard/firmware/blob/master/releases/ChangeLog.md"},{"label":"Block Engineering independent analysis","href":"https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware"},{"label":"COLDCARD current security status and release guidance","href":"https://coldcard.com/security/status"},{"label":"COLDCARD affected-seed migration guide","href":"https://coldcard.com/security/migrate"}]}],"agentUsability":{"status":"hard-blocked","evidence":"No reviewed programmatic agent-payment profile is recorded; this dataset treats the service as hard-blocked until a control surface is documented.","derivedFrom":["agentMoney.compatible"]},"details_url":"https://cunicula.com/en/provider/coldcard","canonical_score":19,"score_status":"rated","score_evidence":"limited","score_version":"4.0","score_breakdown":{"privacy":12,"control":0,"transparency":0,"security":0,"accountability":7},"applied_caps":[{"key":"active-critical-incident","maximum":20,"reason":"An unresolved critical incident limits the score to 20."},{"key":"unresolved-material-compromise","maximum":49,"reason":"An unresolved customer-data or asset compromise limits the score to 49."},{"key":"closed-critical-core-without-audit","maximum":69,"reason":"A closed or unknown critical core without current audit evidence limits the score to 69."}],"score_rationale":["privacy: 12 of 25 points.","control: 0 of 20 points.","transparency: 0 of 20 points.","security: 0 of 25 points.","accountability: 7 of 10 points.","Limited evidence: operatorDataExposure, controlModel, sourceModel scored zero.","An unresolved critical incident limits the score to 20.","An unresolved customer-data or asset compromise limits the score to 49.","A closed or unknown critical core without current audit evidence limits the score to 69."],"last_scored":"2026-10-25","not_rated_reasons":[],"score_assessment":{"operatorDataExposure":"unknown","controlModel":"unknown","sourceModel":"unknown"},"score_review":{"outcome":"HOLD","checkedAt":"2026-08-25","inputs":{"operatorDataExposure":{"value":"unknown","sourceUrls":["https://coldcard.com/security/status","https://x.com/COLDCARDwallet/status/2083155034762621425","https://x.com/Coinkite/status/2084630256296624637","https://x.com/COLDCARDwallet/status/2090459345301488071","https://coldcard.com/"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"controlModel":{"value":"unknown","sourceUrls":["https://coldcard.com/security/status","https://x.com/COLDCARDwallet/status/2083155034762621425","https://x.com/Coinkite/status/2084630256296624637","https://x.com/COLDCARDwallet/status/2090459345301488071","https://coldcard.com/"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"sourceModel":{"value":"unknown","sourceUrls":["https://coldcard.com/security/status","https://x.com/COLDCARDwallet/status/2083155034762621425","https://x.com/Coinkite/status/2084630256296624637","https://x.com/COLDCARDwallet/status/2090459345301488071","https://coldcard.com/"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."}},"audit":{"scoreEligible":false,"reason":"No dated, scoped, current audit citation was normalized in the reviewed packet; legacy auditedBy labels receive no score credit."}},"privacy_observations":{"identity_exposure_level":0,"identity_requirement":"none","hosted_operator_data":null,"jurisdiction":"CA","jurisdiction_confidence":"verified","jurisdiction_context":"five_eyes"},"scoring_source_url":"https://cunicula.com/methodology#cunicula-score","jurisdiction_exposure":"five_eyes","primary_category":"Wallet","primary_bucket":"Wallet","corporate_identity":{"entity_type":"company","entity_type_note":"Official Coldcard about page and Coinkite terms state Coldcard is made by Coinkite Inc., a real operating Canadian vendor/shop.","governance_model":"company-sponsored","repository_url":"https://github.com/Coldcard/firmware","legal_entity":"Coinkite Inc.","registration_number":null,"registry_url":null,"incorporation_jurisdiction":"Ontario, Canada","incorporation_date":null,"registered_address":"3219 Yonge St., Unit 376, Toronto, ON M4N 3S1, Canada","parent_entity":null,"ultimate_owner":null,"prior_entities":[],"officers":[],"citations":{"legalEntity":{"url":"https://coldcard.com/about","note":null,"agent_verified":false},"incorporationJurisdiction":{"url":"https://coinkite.com/terms-of-use","note":null,"agent_verified":false},"registeredAddress":{"url":"https://coinkite.com/terms-of-use","note":null,"agent_verified":false},"entityType":{"url":"https://coldcard.com/about","note":null,"agent_verified":false},"governanceModel":{"url":"https://coldcard.com/about","note":null,"agent_verified":false}},"basis":"registry-sourced, not audited","agent_verified":false,"source":"corporate identity pass 2 (t_d7269d23), cited web research via grok web search","reviewed_at":"2026-08-09"},"evidence_provenance":{"strongest_tier":"third-party-reported","tiers":["third-party-reported","self-reported"],"counts":{"directly-tested":0,"independent-audit":0,"third-party-reported":7,"self-reported":5},"total_sources":12},"privacy_score":100,"privacy_score_version":"3.1","privacy_factors":[{"key":"baseline","label":"Baseline","value":100,"detail":"Starting privacy exposure score"},{"key":"identity","label":"Identity exposure","value":0,"detail":"No required account or identity data recorded (level 0 of 4)"},{"key":"operator-context","label":"Operator context","value":0,"detail":"Hosted operator; recorded jurisdiction: CA (Five Eyes context)"}],"evidence_confidence":94,"evidence_confidence_status":"deprecated","evidence_confidence_sunset_on":"2027-02-26","evidence_score_version":"3.1","evidence_factors":[{"key":"source-coverage","label":"Source coverage","value":70,"detail":"Material claims checked against current sources"},{"key":"freshness","label":"Review age","value":24,"detail":"Oldest recorded check is 73 days old"}],"score_computed_at":"2026-11-06T05:10:38.003Z","score_inputs":{"kycLevel":0,"noOperatorData":false,"jurisdiction":"CA","jurisdictionConfidence":"verified","evidenceStatus":"verified","checkedAt":"2026-08-25","lastReviewed":"2026-09-05","kycLastChecked":"2026-09-05"}},{"slug":"electrum","name":"Electrum","domain":"electrum.org","url":"https://electrum.org/","kyc":"none","kycLevel":0,"kycNote":"Local wallet use needs no account or identity check. Connected servers still receive wallet queries and connection data.","fee":"Free","categories":["Wallet"],"countries":["GLOBAL"],"bestFor":["Bitcoin self-custody","Cold storage and multisig","Running against your own node"],"features":["Bitcoin only","No account and no signup","Keys stay on the device","Seed phrase recovery","Reproducible builds","Multisig wallets","Cold storage and watch-only","Hardware wallet support","Tor and custom server support"],"tagline":"Long-running Bitcoin wallet with no account and locally held keys.","status":"warning","updatedAt":"2026-10-25","description":"Bitcoin desktop and Android wallet running since 2011. No account, keys stay local, and releases are reproducible and signed.","cardSummary":"Bitcoin wallet, no account, reproducible builds.","networks":[],"checkedAt":"2026-10-25","lastReviewed":"2026-10-25","reviewSource":"official_source_review_2026-10-25","jurisdictionConfidence":"verified","kycLastChecked":"2026-08-07","trending":false,"jurisdiction":"DE","noOperatorData":true,"evidenceStatus":"verified","riskLevel":"caution","privacyWarning":"Public Electrum servers can link queried wallet addresses and see connection IPs. The developer reports a fee-bump attack affecting versions before 4.8.3, including a reported loss; 4.8.3 includes the fix. Tor hides the connection IP, not wallet queries. Optional public crash reports can include device and connection details.","auditedBy":[],"corporate":{"entityType":{"value":"company","citation":"https://electrum.org/","note":"Publisher and Berlin address are disclosed in official imprint. A site-stated 2013 founding is not an independently verified legal incorporation date."},"governanceModel":{"value":"company-sponsored","citation":"https://electrum.org/"},"repositoryUrl":{"value":"https://github.com/spesmilo/electrum","citation":"https://github.com/spesmilo/electrum"},"legalEntity":{"value":"Electrum Technologies GmbH","citation":"https://electrum.org/"},"registrationNumber":{"value":"unknown","citation":"unknown"},"registryUrl":{"value":"unknown","citation":"unknown"},"incorporationJurisdiction":{"value":"Germany, per publisher imprint","citation":"https://electrum.org/"},"incorporationDate":{"value":"unknown","citation":"unknown"},"registeredAddress":{"value":"Paul-Lincke-Ufer 8 D, 10999 Berlin, Germany","citation":"https://electrum.org/"},"parentEntity":{"value":"unknown","citation":"unknown"},"officers":{"value":[],"citation":"unknown"},"source":"Cited provider and public identity sources","reviewedAt":"2026-10-25"},"publicClaims":{"followTheMoney":{"value":"Electrum is free MIT-licensed Bitcoin wallet software created by Thomas Voegtlin in 2011. Its website names Electrum Technologies GmbH as publisher and says the company was founded in 2013.","reviewedAt":"2026-10-25","sources":[{"label":"Electrum - About and Impressum","href":"https://electrum.org/#about","type":"official"},{"label":"Electrum source repository (MIT licence)","href":"https://github.com/spesmilo/electrum","type":"official"}]}},"followTheMoney":"Electrum is free MIT-licensed Bitcoin wallet software created by Thomas Voegtlin in 2011. Its website names Electrum Technologies GmbH as publisher and says the company was founded in 2013.","incidents":[{"title":"Malicious-server transaction replacement and fee-bump loss","status":"monitoring","severity":"high","startedAt":"2026-10-11","summary":"Electrum's October 24 advisory reports exploitation of versions before 4.8.3: a malicious server can replace a just-broadcast transaction in wallet history with an invalid transaction paying an attacker. Manually fee-bumping that transaction can sign the attacker payment. The developers report two user reports, including one loss. Version 4.8.3 includes signature checks for wallet-owned inputs; the patch is not evidence that lost funds were recovered.","directUserHarm":true,"customerDataOrAssetsCompromised":true,"disclosure":"proactive","remediation":"partial","sources":[{"label":"Electrum developer security advisory GHSA-6jp4-8v48-cc5v","href":"https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v"}]}],"agentUsability":{"status":"hard-blocked","evidence":"No reviewed programmatic agent-payment profile is recorded; this dataset treats the service as hard-blocked until a control surface is documented.","derivedFrom":["agentMoney.compatible"]},"details_url":"https://cunicula.com/en/provider/electrum","canonical_score":31,"score_status":"rated","score_evidence":"limited","score_version":"4.0","score_breakdown":{"privacy":12,"control":0,"transparency":0,"security":12,"accountability":7},"applied_caps":[{"key":"active-high-incident","maximum":39,"reason":"An unresolved high-severity incident limits the score to 39."},{"key":"unresolved-material-compromise","maximum":49,"reason":"An unresolved customer-data or asset compromise limits the score to 49."},{"key":"closed-critical-core-without-audit","maximum":69,"reason":"A closed or unknown critical core without current audit evidence limits the score to 69."}],"score_rationale":["privacy: 12 of 25 points.","control: 0 of 20 points.","transparency: 0 of 20 points.","security: 12 of 25 points.","accountability: 7 of 10 points.","Limited evidence: operatorDataExposure, controlModel, sourceModel scored zero.","An unresolved high-severity incident limits the score to 39.","An unresolved customer-data or asset compromise limits the score to 49.","A closed or unknown critical core without current audit evidence limits the score to 69."],"last_scored":"2026-10-25","not_rated_reasons":[],"score_assessment":{"operatorDataExposure":"unknown","controlModel":"unknown","sourceModel":"unknown"},"score_review":{"outcome":"HOLD","checkedAt":"2026-08-25","inputs":{"operatorDataExposure":{"value":"unknown","sourceUrls":["https://electrum.org/","https://github.com/spesmilo/electrum/blob/master/RELEASE-NOTES","https://github.com/spesmilo/electrum/security/advisories/GHSA-vw94-r84p-66qf","https://github.com/spesmilo/electrum","https://github.com/spesmilo/electrum/security/advisories/GHSA-q7m2-785w-r585"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"controlModel":{"value":"unknown","sourceUrls":["https://electrum.org/","https://github.com/spesmilo/electrum/blob/master/RELEASE-NOTES","https://github.com/spesmilo/electrum/security/advisories/GHSA-vw94-r84p-66qf","https://github.com/spesmilo/electrum","https://github.com/spesmilo/electrum/security/advisories/GHSA-q7m2-785w-r585"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"sourceModel":{"value":"unknown","sourceUrls":["https://electrum.org/","https://github.com/spesmilo/electrum/blob/master/RELEASE-NOTES","https://github.com/spesmilo/electrum/security/advisories/GHSA-vw94-r84p-66qf","https://github.com/spesmilo/electrum","https://github.com/spesmilo/electrum/security/advisories/GHSA-q7m2-785w-r585"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."}},"audit":{"scoreEligible":false,"reason":"No dated, scoped, current audit citation was normalized in the reviewed packet; legacy auditedBy labels receive no score credit."}},"privacy_observations":{"identity_exposure_level":0,"identity_requirement":"none","hosted_operator_data":false,"jurisdiction":"DE","jurisdiction_confidence":"verified","jurisdiction_context":"other"},"scoring_source_url":"https://cunicula.com/methodology#cunicula-score","jurisdiction_exposure":"other","primary_category":"Wallet","primary_bucket":"Wallet","corporate_identity":{"entity_type":"company","entity_type_note":"Publisher and Berlin address are disclosed in official imprint. A site-stated 2013 founding is not an independently verified legal incorporation date.","governance_model":"company-sponsored","repository_url":"https://github.com/spesmilo/electrum","legal_entity":"Electrum Technologies GmbH","registration_number":null,"registry_url":null,"incorporation_jurisdiction":"Germany, per publisher imprint","incorporation_date":null,"registered_address":"Paul-Lincke-Ufer 8 D, 10999 Berlin, Germany","parent_entity":null,"ultimate_owner":null,"prior_entities":[],"officers":[],"citations":{"legalEntity":{"url":"https://electrum.org/","note":null,"agent_verified":false},"incorporationJurisdiction":{"url":"https://electrum.org/","note":null,"agent_verified":false},"registeredAddress":{"url":"https://electrum.org/","note":null,"agent_verified":false},"entityType":{"url":"https://electrum.org/","note":null,"agent_verified":false},"governanceModel":{"url":"https://electrum.org/","note":null,"agent_verified":false}},"basis":"registry-sourced, not audited","agent_verified":false,"source":"Cited provider and public identity sources","reviewed_at":"2026-10-25"},"evidence_provenance":{"strongest_tier":"third-party-reported","tiers":["third-party-reported","self-reported"],"counts":{"directly-tested":0,"independent-audit":0,"third-party-reported":3,"self-reported":7},"total_sources":10},"privacy_score":100,"privacy_score_version":"3.1","privacy_factors":[{"key":"baseline","label":"Baseline","value":100,"detail":"Starting privacy exposure score"},{"key":"identity","label":"Identity exposure","value":0,"detail":"No required account or identity data recorded (level 0 of 4)"},{"key":"operator-context","label":"Operator context","value":0,"detail":"Local software or protocol with no hosted operator data"}],"evidence_confidence":87,"evidence_confidence_status":"deprecated","evidence_confidence_sunset_on":"2027-02-26","evidence_score_version":"3.1","evidence_factors":[{"key":"source-coverage","label":"Source coverage","value":70,"detail":"Material claims checked against current sources"},{"key":"freshness","label":"Review age","value":17,"detail":"Oldest recorded check is 91 days old"}],"score_computed_at":"2026-11-06T05:10:38.003Z","score_inputs":{"kycLevel":0,"noOperatorData":true,"jurisdiction":"DE","jurisdictionConfidence":"verified","evidenceStatus":"verified","checkedAt":"2026-10-25","lastReviewed":"2026-10-25","kycLastChecked":"2026-08-07"}},{"slug":"feather-wallet","name":"Feather Wallet","domain":"featherwallet.org","url":"https://featherwallet.org/","kyc":"none","kycLevel":0,"kycNote":"Advertises No-KYC, but strictly adhere to OPSEC rules. Access via Tor, pay with XMR.","fee":"Free","categories":["Wallet"],"countries":["GLOBAL"],"features":["XMR only","Electrum-like","Tor built-in","Tails OS support","Coin control"],"status":"ok","updatedAt":"2026-08-27","changedAt":"2026-08-27","description":"A free, open-source Monero wallet for desktop. Connects via Tor by default, heavily optimized for privacy and power users.","cardSummary":"Monero desktop wallet that connects over Tor.","networks":[],"checkedAt":"2026-08-27","lastReviewed":"2026-08-27","reviewSource":"Primary-source review 2026-08-27","jurisdictionConfidence":"unknown","kycLastChecked":"2026-08-27","trending":false,"jurisdiction":null,"evidenceStatus":"verified","riskLevel":"caution","privacyWarning":"Feather bundles Tor, but by default routes all network traffic over Tor except wallet synchronization. Synchronization contacts a node, while websocket features fetch fiat price, CCS and block-height data and the updater contacts featherwallet.org; users with stronger threat models should configure always-over-Tor or a local node.","auditedBy":[],"corporate":{"entityType":{"value":"project-no-legal-entity","citation":"https://docs.featherwallet.org/guides/about","note":"Official docs state Feather Wallet was created by individuals dsc, tobtoht, and contributors as free open-source software funded solely via Monero CCS and donations, with no company or legal entity referenced on the site, GitHub, or license."},"governanceModel":{"value":"maintainer-group","citation":"https://docs.featherwallet.org/guides/about"},"repositoryUrl":{"value":"https://github.com/feather-wallet/feather","citation":"https://github.com/feather-wallet/feather"},"source":"corporate identity pass 2 (t_d7269d23), cited web research via grok web search","reviewedAt":"2026-08-09"},"twitter":null,"telegram":"https://t.me/featherwallet","agentUsability":{"status":"hard-blocked","evidence":"No reviewed programmatic agent-payment profile is recorded; this dataset treats the service as hard-blocked until a control surface is documented.","derivedFrom":["agentMoney.compatible"]},"details_url":"https://cunicula.com/en/provider/feather-wallet","canonical_score":76,"score_status":"rated","score_evidence":"reviewed","score_version":"4.0","score_breakdown":{"privacy":21,"control":20,"transparency":12,"security":17,"accountability":6},"applied_caps":[],"score_rationale":["privacy: 21 of 25 points.","control: 20 of 20 points.","transparency: 12 of 20 points.","security: 17 of 25 points.","accountability: 6 of 10 points."],"last_scored":"2026-10-25","not_rated_reasons":[],"score_assessment":{"operatorDataExposure":"limited","controlModel":"local-self-custody","sourceModel":"open"},"score_review":{"outcome":"PASS","checkedAt":"2026-08-27","inputs":{"operatorDataExposure":{"value":"limited","sourceUrls":["https://docs.featherwallet.org/guides/network-traffic","https://docs.featherwallet.org/guides/tor-support"],"reviewedAt":"2026-08-27","note":"The local wallet does not require an operator account, but remote-node synchronization and optional direct-clearnet traffic expose limited network metadata."},"controlModel":{"value":"local-self-custody","sourceUrls":["https://docs.featherwallet.org/guides/about","https://github.com/feather-wallet/feather"],"reviewedAt":"2026-08-27","note":"Seeds and signing remain on the user device; the user controls the wallet and can connect a local node."},"sourceModel":{"value":"open","sourceUrls":["https://docs.featherwallet.org/guides/about","https://github.com/feather-wallet/feather"],"reviewedAt":"2026-08-27","note":"The official documentation identifies the BSD-3 repository; no reproducible-build evidence was located."}},"audit":{"scoreEligible":false,"reason":"No dated, scoped independent audit of the score-critical core was evidenced in the reopened first-party source family."}},"privacy_observations":{"identity_exposure_level":0,"identity_requirement":"none","hosted_operator_data":null,"jurisdiction":null,"jurisdiction_confidence":"unknown","jurisdiction_context":"unknown"},"scoring_source_url":"https://cunicula.com/methodology#cunicula-score","jurisdiction_exposure":"unknown","primary_category":"Wallet","primary_bucket":"Wallet","corporate_identity":{"entity_type":"project-no-legal-entity","entity_type_note":"Official docs state Feather Wallet was created by individuals dsc, tobtoht, and contributors as free open-source software funded solely via Monero CCS and donations, with no company or legal entity referenced on the site, GitHub, or license.","governance_model":"maintainer-group","repository_url":"https://github.com/feather-wallet/feather","legal_entity":null,"registration_number":null,"registry_url":null,"incorporation_jurisdiction":null,"incorporation_date":null,"registered_address":null,"parent_entity":null,"ultimate_owner":null,"prior_entities":[],"officers":[],"citations":{"entityType":{"url":"https://docs.featherwallet.org/guides/about","note":null,"agent_verified":false},"governanceModel":{"url":"https://docs.featherwallet.org/guides/about","note":null,"agent_verified":false}},"basis":"registry-sourced, not audited","agent_verified":false,"source":"corporate identity pass 2 (t_d7269d23), cited web research via grok web search","reviewed_at":"2026-08-09"},"evidence_provenance":{"strongest_tier":"third-party-reported","tiers":["third-party-reported","self-reported"],"counts":{"directly-tested":0,"independent-audit":0,"third-party-reported":1,"self-reported":2},"total_sources":3},"privacy_score":100,"privacy_score_version":"3.1","privacy_factors":[{"key":"baseline","label":"Baseline","value":100,"detail":"Starting privacy exposure score"},{"key":"identity","label":"Identity exposure","value":0,"detail":"No required account or identity data recorded (level 0 of 4)"},{"key":"operator-context","label":"Operator context","value":0,"detail":"Hosted operator with unknown jurisdiction"}],"evidence_confidence":94,"evidence_confidence_status":"deprecated","evidence_confidence_sunset_on":"2027-02-26","evidence_score_version":"3.1","evidence_factors":[{"key":"source-coverage","label":"Source coverage","value":70,"detail":"Material claims checked against current sources"},{"key":"freshness","label":"Review age","value":24,"detail":"Oldest recorded check is 71 days old"}],"score_computed_at":"2026-11-06T05:10:38.003Z","score_inputs":{"kycLevel":0,"noOperatorData":false,"jurisdiction":null,"jurisdictionConfidence":"unknown","evidenceStatus":"verified","checkedAt":"2026-08-27","lastReviewed":"2026-08-27","kycLastChecked":"2026-08-27"}}]},"meta":{"total":1,"api_version":"1.3","powered_by":"cunicula.com","documentation_url":"https://cunicula.com/en/api-docs","machine_index_url":"https://cunicula.com/llms.txt","license":"LicenseRef-Cunicula-Attribution-1.0","license_url":"https://cunicula.com/en/cite","attribution":"Cunicula, \"{name}\", cunicula.com, reviewed {reviewed}, retrieved {retrieved}, {url}","cite_guide_url":"https://cunicula.com/en/cite","dataset_url":"https://cunicula.com/api/v1/dataset","schema_version":"1.1.0","related_total":5,"history_total":9}}