Security & privacy
What we log — and what we never will
An RPC provider sees every call your app or agent makes. That is a lot of trust to hand over. NodeFlare is built to need as little of your data as possible — here is exactly what that means, in plain terms.
We never log
- ✕Request bodies — the JSON-RPC calls you make, the parameters, the addresses you look up
- ✕Response bodies — the balances, logs, traces or any blockchain data you read
- ✕Wallet addresses or transaction hashes from your queries
- ✕Any correlation between your IP address and the data you request
We keep (minimally)
- ✓Per-chain, per-month request counts keyed to your API key — for billing only
- ✓IP address, user-agent and timestamp — kept 7 days, only for abuse/DDoS protection, then deleted
- ✓Account email (via Clerk) and payment-method type + last-4 for card payers (via Stripe)
Own infrastructure, no middleman
NodeFlare runs its own bare-metal nodes across multiple regions on the major chains — we are not an aggregator reselling Alchemy, Infura or a pool of anonymous third-party backends. Your traffic reaches our machines and stops there. The young chains (Robinhood, Plasma, Ink, Zircuit and more) run on dedicated single-region nodes we operate directly.
Pay without identifying yourself
The public endpoint needs no key and no account. Paid plans and CU top-ups accept crypto — no card and no KYC. Autonomous agents can pay per call in USDC over x402 with no account at all. Card payers go through Stripe; NodeFlare never stores full card numbers.
FAQ
Do you log the RPC calls I make?
No. We never store request or response bodies. We count how many requests you made per chain per month (for billing), but not what you called, which addresses you touched, or what came back.
Is my IP linked to what I query?
No. IP addresses are processed transiently only for per-IP rate limiting and DDoS protection, and are never correlated with your API key, wallet addresses, or request data. Security logs (IP, user-agent, timestamp) are kept for 7 days and then deleted.
Can I use NodeFlare without an account or a card?
Yes. The public endpoint needs no key and no account. Paid plans and top-ups can be paid in crypto (USDC or 100+ coins, no card and no KYC). Agents can pay per call in USDC over x402 with no account at all.
Who else sees my traffic?
No one. NodeFlare runs its own bare-metal nodes — we are not a reseller routing your calls through Alchemy, Infura or a pool of third-party backends. Your requests reach our machines and no one else's.
How is my API key protected?
Keyed endpoints are not CORS-enabled for browsers, so your key is never meant to sit in front-end code — route keyed requests through your backend. You can rotate your key any time from the dashboard, which immediately invalidates the old one.
How do I report a vulnerability?
Email [email protected] with details and steps to reproduce. We respond to security reports first, and we won't pursue good-faith research that respects user data and avoids service disruption.
See also the full Privacy Policy (GDPR) and Terms. Security questions or disclosures: [email protected].