Note⚠️ DRAFT, NOT YET REVIEWED BY A LAWYER. Written by an AI assistant on 2026-11-02 as step L7 of the legal plan, from each vendor's own legal pages read that day, and published at netofi.net/vendors before counsel's review. The nightly legal phase checks it weekly (refresh item R1).
Last checked: 2026-11-02
NetoFi uses the vendors below to run parts of the service. Each one receives only what its job needs. This page lists who they are, where they are, and what protects your data when it leaves Israel or the European Union. Our privacy policy says what we collect and why.
Terms used here. A data processing agreement is the contract in which a vendor promises to use the data only for NetoFi and to protect it. The Data Privacy Framework is the arrangement under which a certified US company may receive data from the EU, the UK and Switzerland. Standard contractual clauses are the EU's model contract terms for sending data to a country without an EU adequacy decision. Israel has one, so data may move between Israel and the EU freely.
Vendors that run the service#
| Vendor | What it receives | Why | Where | Agreement | Safeguard for transfers |
|---|---|---|---|---|---|
| Google Cloud (Google Cloud EMEA Limited, Ireland) | Everything NetoFi holds | Hosting, in Belgium; backups; history queries for a few networks | EU | Cloud Data Processing Addendum, part of Google's terms | Data Privacy Framework (Google LLC), with standard contractual clauses as fallback, for any access from the US |
| Google Workspace (Google Cloud EMEA Limited, Ireland) | Form fields, our email with you | Forms and support mail | not stated | the same addendum | the same |
| Cloudflare (Cloudflare, Inc., US) | All traffic to netofi.net, visit records, product telemetry, mail routing | Delivering the site, security, monitoring | US, EU | Customer DPA, part of Cloudflare's terms | Data Privacy Framework; standard contractual clauses and the UK addendum as fallback |
| Clerk (Clerk, Inc., US) | Email, name and picture from Google or Microsoft, sign-in records, network address | Sign-in | US | DPA, part of Clerk's terms | Data Privacy Framework; standard contractual clauses and the UK addendum as fallback |
| GitHub (GitHub, Inc., US) | The text of bug reports, without your email; in an automatic report, your own wallet address | Tracking fixes, in a private repository | US | Data Protection Agreement [whether it covers NetoFi's plan: L7] | Data Privacy Framework; standard contractual clauses and the UK addendum |
| Anthropic (Anthropic, PBC, US) | A copy of a portfolio you send with a bug report, read by our AI coding assistant while it fixes the bug | Fixing bugs | US | Data Processing Addendum, part of Anthropic's commercial terms | Standard contractual clauses and the UK addendum |
| Arkham Intelligence (Arkham Intelligence, Inc., US) | Counterparty wallet addresses, when you buy address labels | Address labels | US | none offered [L7] | none stated [L7] |
Blockchain data providers#
To read your history, NetoFi asks blockchain data services about your wallet addresses. They receive the addresses and our server's network address, never your name or email.
| Provider | Company, country | Agreement |
|---|---|---|
| Alchemy | Alchemy Insights, Inc., US | DPA, part of its terms; standard contractual clauses and the UK addendum |
| NOWNodes | Tech Castle OÜ, Estonia | none published |
| Blockfrost | Five Binaries OÜ, Estonia | none published |
| Etherscan | Singapore law; company not named | none published |
| Subscan | Helixbox Labs, Singapore | none published |
| Tronscan, TronGrid | Singapore | none published |
| TonAPI | Scalable Data Solutions Inc, United Arab Emirates | none published |
| Mintscan | Cosmostation, South Korea | none published |
| FastNEAR | Fastnear Inc., US | none published |
| Stellar Horizon | Stellar Development Foundation, US | none; public service |
| Hyperliquid API, Relay | not stated | none found |
Public endpoints that need no account, such as mempool.space, Blockstream and PublicNode, also receive the addresses being read. Price sources such as CoinGecko and DefiLlama receive no personal data.
Exchanges you connect#
When you connect an exchange, NetoFi uses the read-only key you give it to read your account there. The exchange already holds that data under your own contract with it.
Changes#
We update this page when we add or replace a vendor. An accounting firm that signed our data agreement is told before a new vendor receives its clients' data, and may object.