Security & privacy
What we log — and what we never will
An RPC provider sees every call your app or agent makes. That is a lot of trust to hand over. NodeFlare is built to need as little of your data as possible — here is exactly what that means, in plain terms.
We never log
- ✕Request bodies — we do not store the JSON-RPC calls you make, their parameters, or the addresses you look up. One exception, described below: a transaction you broadcast is read in memory to classify its size and kind, and is not stored either
- ✕Response bodies — the balances, logs, traces or any blockchain data you read
- ✕Wallet addresses or transaction hashes from your queries
- ✕Any correlation between your IP address and the data you request
We keep (minimally)
- ✓Per-chain, per-month usage counters keyed to your API key for billing, plus a bounded account activity marker used to distinguish dashboard tests from external RPC activation
- ✓Aggregate gateway quality counters by chain, method and outcome, with latency buckets — no RPC payloads or API keys
- ✓IP address — processed transiently for per-IP rate limiting and DDoS protection, never written to a log of ours
- ✓Account email (via Clerk) and payment-method type + last-4 for card payers (via Stripe)
- ✓For transactions you broadcast through us: a value band (one of seven ranges) and a coarse kind (transfer, swap, approve, other) — derived in memory and counted per chain per day. Never the amount, the destination, the sender or the hash
Own infrastructure, and where its limits are
NodeFlare owns and operates its nodes on bare metal in Frankfurt, Falkenstein, London, Singapore, Ashburn, New York, Chicago and Los Angeles. We are not an aggregator reselling Alchemy, Infura or a pool of anonymous backends, and we do not buy the capacity we sell.
Regional coverage differs by chain. Our own nodes are the primary upstreams; most supported chains also have a public third-party backstop after those nodes, including multi-region chains such as Base and Ethereum. Robinhood Chain, Zircuit and Arc have no public backstop configured. Failover can change method support and historical depth, so confirm the block ranges and methods your application needs. Availability commitments are described in the Uptime & SLA section.
Access, custody and incidents
We never hold your private keys, seed phrases or funds — NodeFlare reads and relays blockchain data and broadcasts the transactions you sign yourself. Node hosts are reachable only over key-based SSH from an allow-listed set of addresses, with password authentication disabled. API keys are stored so that our dashboard and worker can resolve them; they are never exposed to browsers, because keyed endpoints are deliberately not CORS-enabled.
Automated health checks monitor availability and block progress. Additional gateway checks compare finalized block hashes where enough independent nodes are available; missing comparison coverage is not proof of correctness. Health and recent incidents are public on our status page. For procurement or vendor-review purposes, contact us about our security overview, upstream routing and data handling at [email protected].
Pay without identifying yourself
The public endpoint needs no key and no account. Paid plans and CU top-ups accept crypto — no card and no KYC. Autonomous agents can pay per call in USDC over x402 with no account at all. Card payers go through Stripe; NodeFlare never stores full card numbers.
FAQ
Do you log the RPC calls I make?
No. We never store request or response bodies. We keep per-account billing counters and a bounded activation marker, plus aggregate quality counters by chain, method, outcome and latency. Quality counters contain no API keys, addresses or payloads. For broadcasts, added in September 2026 and stated here rather than buried: when you broadcast a transaction, we read the signed transaction as it passes to classify it into a value band and a coarse kind, then increment a per-chain daily counter. The transaction itself is not stored, and neither is the amount, the destination, the sender nor the hash — only which of seven bands and which of four kinds it fell into.
Is my IP linked to what I query?
No. IP addresses are processed transiently for per-IP rate limiting and DDoS protection, and are never correlated with your API key, wallet addresses, or request data. We do not write them to a log of our own. Cloudflare processes them as our edge provider under its own retention policy.
Can I use NodeFlare without an account or a card?
Yes. The public endpoint needs no key and no account. Paid plans and top-ups can be paid in USDC, USDT, native ETH or SOL — no card and no KYC. Agents can pay per call in USDC over x402 with no account at all.
Who else sees my traffic?
Cloudflare processes traffic at our edge. NodeFlare-operated nodes are the primary RPC upstreams. Most chains, including Base and other multi-region chains, also have a public third-party RPC backstop configured after our own nodes. If it serves a request, that external provider receives the forwarded RPC request. Public backstop providers operate independently; their supported methods, historical depth and data handling may differ. Contact [email protected] for routing and data-handling questions.
Do all requests stay on NodeFlare nodes?
No. Multi-region coverage does not exclude third-party fallback. Robinhood Chain, Zircuit and Arc have no public third-party RPC backstop configured; the other supported chains do. All endpoints still pass through our edge infrastructure. Any custom restriction on upstream routing requires a separate agreement and confirmed configuration before use.
Can I see whether an external backstop answered?
On successful HTTP RPC responses, nf-region: fallback means a public third-party backstop served the request. A region value identifies the upstream routing region, which need not be the physical city. nf-region: cache means a cached response and does not identify its original upstream. Authentication, quota and other gateway errors may carry the gateway region even though no node answered.
How is my API key protected?
Keyed endpoints are not CORS-enabled for browsers, so your key is never meant to sit in front-end code — route keyed requests through your backend. You can rotate your key any time from the dashboard, which immediately invalidates the old one.
How do I report a vulnerability?
Email [email protected] with details and steps to reproduce. We respond to security reports first, and we won't pursue good-faith research that respects user data and avoids service disruption.
See also the full Privacy Policy (GDPR) and Terms. Security questions or disclosures: [email protected].