{
  "$schema": "https://trustvice.com/schemas/fraud-providers/v1.json",
  "x-trustvice-policy": "https://github.com/99industries/trustvice-audit/blob/main/docs/audit/38-fraud-detection-legal-override-policy.md",
  "x-trustvice-status": "none-active",
  "x-trustvice-note": "No third-party fraud provider processes any Trustvice data today. This document previously listed seven — Stripe Radar, Sift, Castle, Sardine, Persona, MaxMind, IPQualityScore — each with a past activeSince date, under the note 'Active providers in production'. None was ever integrated: no code in the platform calls any of them. The list is empty because the true answer is zero, and a sub-processor disclosure naming recipients who receive nothing is worse than none — it tells a reader their data has been shared when it has not. Any provider will appear here BEFORE it processes anything, per audit policy 38.",
  "providers": [],
  "x-trustvice-in-house": [
    {
      "control": "disposable-email-blocklist",
      "displayName": "Disposable-email blocklist",
      "domain": "Signup abuse (throwaway-address registration)",
      "triggers": [
        "Signup"
      ],
      "howItWorks": "A daily cron refreshes the public disposable-email-domains list into our own store, and signup refuses a registration whose domain is on it. The check runs entirely inside Trustvice: the feed is data we download, not a service we call, so no address, IP or device fingerprint leaves the platform and there is no sub-processor to disclose.",
      "dataShared": "none",
      "activeSince": "2026-07-01"
    }
  ],
  "x-trustvice-customer-visible": "/app/account/fraud-status"
}