Compliance Statement

StableOps' compliance boundary, non-custodial posture, and operational control commitments.

Last updated: 2026-10-09

Non-custodial boundary

StableOps monitors blockchain events and routes operational webhooks. It does not hold customer assets, control private keys, pool funds, settle fiat, or execute payouts.
Customers remain the merchant of record or payment operator for their own products and are responsible for wallet governance and user-facing disclosures.

Risk controls

The platform supports audit logs, scoped API keys, webhook signing, secret rotation, event idempotency, replay protection, confirmation thresholds, blockchain reorganization detection, tenant isolation, and operational event history.
The dashboard provides sanctions list and address risk label notices for recorded deposits. Additional customer-selected transaction risk analysis, screening, retention, and export workflows may be agreed separately for enterprise use.

Shared responsibility

StableOps is responsible for platform availability, infrastructure security, and payment-event processing.
Customers are responsible for wallets and private keys, order fulfillment, accounting, and regulatory compliance in the jurisdictions where they operate.

Scope of this statement

This page is a product-facing statement of StableOps' compliance posture and the controls available on the platform. It describes how the service is designed to operate, not the obligations of any individual customer.
It is not legal advice and not a substitute for customer-specific compliance review. Customers should evaluate their own regulatory, sanctions, tax, and data protection obligations for the jurisdictions in which they operate.
Nothing in this statement should be interpreted as certification, regulatory approval, legal opinion, or a representation that use of the platform alone satisfies applicable regulatory requirements.

Sanctions and AML posture

StableOps is a non-custodial payment event infrastructure platform and is not a regulated AML or compliance service provider.
Address screening notices are operational reference information, not compliance determinations made by StableOps. Any broader transaction monitoring or risk analysis is subject to the expressly agreed service scope.
These capabilities do not replace a customer's legal or regulatory obligations, nor do they determine whether a transaction should ultimately be accepted, rejected, refunded, or reported.
Customers operating regulated payment activities remain solely responsible for establishing and maintaining their own KYC, KYT, AML, sanctions compliance, reporting, and other regulatory programs applicable to their jurisdictions.
We prohibit use of the platform by or on behalf of sanctioned persons, entities, or jurisdictions, and reserve the right to suspend access where credible evidence of abuse, fraud, security threats, or legal risk arises.

Address screening scope and limitations

For recorded deposits shown in order and chain-event details, StableOps checks the direct sender addresses. Public OFAC SDN digital currency addresses are matched exactly, while GoPlus address risk labels are queried separately for the transaction network. A GoPlus sanctions label is not the same evidence as an OFAC list match.
Coverage varies by network and risk category. Screening does not cover all sanctions lists, identify beneficial owners or the actual payer, scan full wallet histories, or trace indirect connections or cross-chain fund movements. Test environments are not screened against real addresses, and unsupported networks do not use results from another network.
No match means only that the available data did not return a match within the stated scope. It is not a safety guarantee, compliance approval, or permission to transact. Matches and labels require review against transaction context and supporting records and do not themselves establish unlawful conduct.
Lists update periodically and label results may be cached. Review publication, retrieval, and query times. Expired lists cannot support a current no-match conclusion. Unavailable, incomplete, or not-applicable results are not no match. Known matches may remain visible with a warning when data is outdated or other checks are incomplete.
Notices do not change chain confirmation status or automatically block transfers, freeze funds, refund deposits, or stop fulfillment. Customers must independently assess any applicable investigation, blocking, reporting, or other obligations and must not use notices as a substitute for their own compliance program.

Prohibited businesses and activities

The platform may not be used for mixers or tumblers, ransomware, darknet markets, fraud, unlicensed money transmission, or any activity prohibited by the terms of service.
Customers in higher-risk categories may be required to provide additional disclosures or contractual controls before production access.

Data residency and infrastructure

Event ingestion, confirmations, and webhook delivery run on infrastructure scoped by (organization, environment, chain, address) so tenant data stays isolated.
Enterprise deployments can negotiate region, retention, export, and sub-processor terms; default infrastructure regions are documented during onboarding.

Incident response and disclosure

We monitor service health with metrics and error reporting, and investigate security or availability incidents through an internal response process.
Where an incident materially affects customer data or payment-event processing, we aim to notify affected customers and coordinate remediation per applicable law and contract terms.
Operational audit records are retained according to the customer's plan and may be exported where supported.

Compliance contact

For compliance, sanctions, or security questions, contact [email protected].
Responsible disclosure of suspected vulnerabilities is welcome; please avoid testing that disrupts other tenants or accesses data you are not authorized to view.