How Factline screens, what it stores, and who processes data
For compliance and security reviews. Questions: hello@factline.dev. A data processing agreement template is at /dpa.
List freshness, live
| Dataset | Refresh | Current version |
|---|---|---|
| EU consolidated financial sanctions list (European Commission) | weekly (Monday night) | list dated 2026-09-22 |
| UN Security Council consolidated sanctions list | weekly (Monday night) | list dated 2026-10-10 |
| UK Sanctions List (FCDO/OFSI) | weekly (Monday night) | list dated 2026-10-08 |
| US OFAC Specially Designated Nationals (SDN) list | weekly (Monday night) | current list, loaded with the set below |
| Sanctions lists merged (25,681 persons, companies and vessels) | weekly | loaded 2026-10-12 |
| Politically exposed persons, from Wikidata (41,999 people) | rebuilt weekly, changes synced nightly | built 2026-10-09, loaded 2026-10-10 |
| Company registers (GLEIF, Companies House, CRO, SIRENE, Brønnøysund, PRH, ARES, RPO, e-Business Register, VAT whitelist) | queried live, cached up to 7 days | live |
| Dutch insolvency register (CIR), EU VIES | queried live | live |
Source uptime is checked every 10 minutes: status page. If a source is down, the check returns an error and nobody is charged.
How name matching works
- Normalise. Accents and punctuation are removed and names are lower-cased, so "Müller" and "Mueller" compare closely and "PUTIN, Vladimir" equals "Vladimir Putin".
- Find candidates. Each name word is reduced to its consonant skeleton to catch transliteration variants (Sergei / Sergey, Lavrov / Lavrof). Very common words such as "Ltd", "Group" or "van der" are ignored.
- Score. Every name and alias of each candidate is compared word by word with Jaro-Winkler similarity, in any word order. Every word you send must match something well, so a shared first name alone does not produce a hit.
- Threshold. Matches scoring 85 or more (out of 100) are returned as possible matches. You can set the threshold from 70 (more recall) to 100 (exact). A birth year, when sent, raises or lowers the score.
A result is a possible match for human review, not a decision. Confirm identity with date of birth, nationality and the official list entry before acting. The lists cover targeted (asset-freeze / SDN) sanctions; sectoral and export-control measures are out of scope.
What Factline stores
- Names you screen are not stored. Sanctions and PEP screening run inside Factline; the name is used for the request and then discarded.
- Usage counts per day and endpoint, without the query. For paid calls: endpoint, amount, payment network and wallet, and the postcode area (first 4 digits) for address endpoints. Never names, house numbers, plates or emails.
- Monitoring (/v1/watch and /v1/watch/new) stores the names, companies or plates you ask Factline to watch, until you delete the watch or, for 30-day watches, until it ends.
- Receipts for paid calls store the route, time, payment (wallet and transaction, or key id) and a SHA-256 hash of the answer. Never the query or the names screened. Public key: factline-receipts.json.
- API keys are stored as a SHA-256 hash; the key itself is shown once.
- Cache: answers from public registers (companies, addresses) are cached up to 7 days to spare the registers. Insolvency register answers are purged as soon as they expire.
Who processes data
- Cloudflare: hosting, database and network (Workers, D1).
- Coinbase (CDP facilitator): settles pay-per-call payments in USDC (x402); sees the payment, not the query.
- Dodo Payments: merchant of record for plans and reports (iDEAL, card).
- Public registers: receive the identifier you look up (company name or number, VAT number, KvK number) to answer the check.
No advertising or analytics trackers on the site or the API. Data sources and licences per endpoint: license provenance.