Trust Center

What we do, what we hold, and what we do not have.

Most trust pages are a wall of badges. This one starts with the badges we do not have, because that is the first thing a procurement team needs to know and the last thing they are usually told.

Certifications

We hold none today.

Phantrium Chain has no ISO/IEC 27001 certification and no SOC 2 report. We are not "in the process", we are not "audit ready", and there is no logo on this site suggesting otherwise.

What exists instead is written on this page: the controls we actually run, in plain language, so you can judge them yourself or send them to whoever must sign off. Formal certification starts when a customer needs it, and this section changes on the day it is issued — not before.

If a certification is a hard requirement for you today, we are not yet the right supplier, and we will tell you that on the first call.

Data and location

Where it runs

Servers in the European Union. No customer data is processed or stored outside the EU by us.

What we store about you

Account details (name, work email, company), API keys in hashed form, and billing records.

We do not store card details. Payments run through our payment provider, which holds those.

What we log about your traffic

Per request: timestamp, chain, method name, response status, latency and weighted-unit cost. This is what your usage page and your invoice are built from.

Request parameters and response bodies are not retained. Blockchain calls contain addresses, and keeping them would create a dataset neither of us wants us to have.

Retention

Usage records are kept for as long as your account is active plus the period required for invoicing and tax. Operational logs are rotated on a fixed schedule. Delete your account and the usage detail goes with it, minus what the tax authority requires us to keep.

Data processing agreement

Available on request before you sign anything, not after. Ask through the contact form and it comes back the same day.

Access and secrets

Two-factor authentication: Mandatory on every account, ours and yours. A device stays trusted for 30 days; a login from a new IP requires a fresh code and triggers an email showing the IP and location.
Roles: Owner, developer and read-only. A developer can create and revoke keys but cannot see or change billing. Every account is a named person — no shared logins, ever.
API keys: Stored hashed, shown once at creation, revocable instantly, and bindable to your domains or IP ranges. A leaked key can be killed by you without contacting us.
Administrative access: Limited to the engineers who operate the systems. Access is by key, not password, and every administrative session is logged.
Signing keys (future validator work): When validator operations begin, signing keys are held outside the node on a separate signer with anti-slashing protection. This is written here now so it can be held against us later.

Operations

Monitoring

We test the service, not the health page. A monitor that only asks a system whether it feels well will report green while every real request fails — we have seen it happen, and we build against it.

Real RPC calls against every endpoint we serve
Block-height lag compared to the network, not to ourselves
Email to the on-call address on the first confirmed failure, once per incident and once when it clears
A separate watchdog checks the monitor itself every ten minutes, restarts it, and escalates if that does not help
No pager or SMS channel yet: if nobody reads email at 03:00, nobody is woken. We would rather write that here than imply otherwise

Backups and restore

Account and usage data is backed up daily, and every copy is checked by opening it and counting its rows against the live database. Restore is rehearsed monthly, because a backup nobody has restored is a hope, not a control.

Daily backup using SQLite's online-backup API, not a file copy — a copy of a database that is being written to is not a backup
Restore rehearsed monthly against the live row counts and written to a log with a date you may ask for
Kept on the same machine as the service. There is no offsite copy yet, so one disk failure would take both — that is the open item, and it is ours, not yours
Our Ethereum light client holds no chain state (12 kB on disk) and re-syncs from a checkpoint, so there is nothing on that node to lose. That changes the day a full node exists

Incident response

What happens when something breaks, written down before it does.

Step	What happens	Target
Detection	Automated monitoring alerts an engineer; customer reports go to the same place	continuous
Acknowledgement	A human confirms and takes ownership of the incident	≤ 30 min
Public status	The status page shows the incident, in plain language, while it is still unresolved	≤ 60 min
Customer notice	Affected customers are emailed directly if their traffic is impacted	≤ 2 h
Written follow-up	Cause, impact and the change we made, published on the status page	≤ 5 working days

A security incident affecting personal data is reported to the supervisory authority within 72 hours, and to you without undue delay. That is the law, and it is also what we would want as a customer.

Reporting a vulnerability

[email protected]

Send us what you found. Include enough detail to reproduce it. We acknowledge within two working days and tell you what we intend to do and roughly when.

Safe harbour: if you act in good faith, stay within scope, do not access or modify data that is not yours, and give us reasonable time before publishing, we will not pursue legal action and we will credit you if you want the credit.

Out of scope: denial of service, social engineering of our staff or customers, physical attacks, and reports produced by an automated scanner with no verification. We do not currently run a paid bounty.

Subprocessors

The third parties involved in delivering the service. This list is kept current; ask to be notified of changes and you will be.

Function	What they see	Status
Hosting	All service data, in the EU	in use
DNS and edge protection	Request metadata and IP addresses in transit	in use
Payment processing	Billing details and payment instruments; we never see card data	in use
Email delivery	Your address and the content of service emails	in use — our own infrastructure
Upstream RPC providers	The content of RPC calls we route to them, without your identity	named per contract at beta start

Named entities are provided in the data processing agreement rather than published here, so that this page never lags behind a contract change.

Availability commitments

No SLA is offered yet.

An uptime percentage means something only when there is a measurement behind it and a credit attached to missing it. Since 8 September 2026 the measurement exists and is public: a real call to every service every minute, published unedited on the status page, including the failures we could not reproduce. The credit does not exist yet.

So read the numbers on the status page as a measurement, not as a promise: they say what happened, not what we owe you if it happens again. Contractual targets are agreed per engagement, in writing.

Open the status page Request the DPA

Changes to this page

Date	Change
2026-09-08	API keys are no longer written to our access logs. The path form of the endpoint put the key in nginx's log in plain text; the log now masks it, the existing entries were rewritten, and the one key that had been exposed was rotated. The header form was never logged.
2026-09-08	Backup and restore corrected: daily backup and a monthly, logged restore rehearsal now exist. Removed the claim that backups are kept off the serving machine — they are not, and there is no offsite copy yet.
2026-09-08	Alerting corrected: we alert by email and by a watchdog on the monitor. Removed the claim of a phone channel with a second fallback, which we do not have.
2026-09-08	Monitoring live: every service is called for real every minute from two vantage points, and the measurement — including its blind spot — is published on the status page.
2026-09-08	Own Ethereum node in the serving path (Helios light client); answers carry X-Chain-Verified.
2026-09-08	First publication. No certifications held; no SLA offered; subprocessor categories listed.

Every material change to our security posture is added to this table, including the ones that are not flattering.