Compliance & Security

What GriffNode is

GriffNode is software for merchants who accept cryptocurrency. It derives a receiving address for each payment from the merchant's extended public key (xPub), watches the blockchain and notifies the merchant when the payment arrives. The service is operated by Emil Dąbrowski (EBD Systems), a sole proprietorship registered in Poland (CEIDG), NIP 8513356309.

What GriffNode never does

• Hold, store or control merchant or customer funds
• Hold private keys or seed phrases. An xPub can derive addresses but cannot spend anything
• Initiate, sign, broadcast, stop or reverse any transaction
• Exchange cryptocurrency for money or for other cryptocurrency
• Keep balances for merchants or pay anything out to them
• Take any part of a payment. Payments go straight from the customer's wallet to the merchant's wallet

GriffNode earns a flat subscription fee for the software. The fee does not depend on the value or number of payments. Subscriptions are paid by bank payment or in cryptocurrency to GriffNode's own wallet.

Merchant responsibilities

Each merchant runs its own business and is responsible for the obligations that apply to it, including:

• Anti-money-laundering and customer verification rules, where they apply to the merchant
• Tax reporting of cryptocurrency income and keeping records
• Consumer law, refunds and customer service for its own customers
• Selling only lawful goods and services, as set out in the Terms of Service

Sanctions and prohibited use

• GriffNode may not be used by persons on EU or UN sanctions lists or for business in jurisdictions under comprehensive EU sanctions
• Prohibited business categories are listed in the Terms of Service
• We close accounts that break these rules and answer lawful requests from authorities

Data protection (GDPR)

• The controller of merchant account data is Emil Dąbrowski (EBD Systems). Details are in the Privacy Policy
• For data about a merchant's own customers (for example a customer email on a recurring payment), GriffNode acts as a processor on the merchant's behalf. A data processing agreement is available on request
• We collect only what the service needs. We never sell personal data
• Where the law requires it, we notify the supervisory authority of a personal data breach within 72 hours and inform affected users
• Privacy requests: [email protected]

Security

• Own full nodes for Bitcoin, Litecoin, Dogecoin, Dash and Ethereum, so payment detection does not depend on third-party blockchain APIs
• Servers we run ourselves, behind Cloudflare for DDoS protection
• TLS for all traffic
• Passwords stored as bcrypt hashes
• Two-factor authentication (TOTP) and passkeys. Two-factor is required before live payments
• Extra confirmation for changing the receiving wallet or webhooks when two-factor authentication is on
• API rate limiting

Tax records

Merchants can export their payment history (CSV) for their accountant. GriffNode does not give tax advice and does not report merchant transactions to tax authorities.