Sources

Every claim names the source that asserted it, the fetch it came from and the licence that lets us repeat it. No external source is ingested without a completed checklist and the owner's sign-off, recorded in the codex; the database enforces it — a source cannot be active without a sign-off date. The live list, with cadence and last fetch, is at /sources; each source page carries its legal basis.

What a claim tells you about its source

source.id, source.name, source.kind — who asserted it and what kind of source it is (sanctions list, crime intel, pool catalogue, threat-actor knowledge base).
source.attribution — the attribution text the licence requires; render it wherever you show the claim.
fetch.url, fetch.fetched_at, fetch.sha256 — the exact download the claim was parsed from: where, when, and the hash of the bytes. Files are not stored; the fetch record is.
confidence.class — how the source knows: authority_data for a list of record, trusted_provider for a curated third party, heuristic for a rule. Each source has a default class and a reliability prior; the level is copied from the class and never blended across sources (Semantics).

Licences and attribution

A source enters only if its licence permits our use and the redistribution of derived claims. When it does not, the source is marked non-redistributable and never appears in an export. Attribution text is captured per source and rendered on the web, in the API and over MCP. Terms of service are reviewed for automated collection before the first fetch.

Source	Legal basis	Personal data	Signed off
`ofac-sdn`	US government work, public domain in the United States (17 U.S.C. § 105); redistributable; automated download of the published file is the intended use.	yes — natural persons are named; a claim names the party by its OFAC listing only	2026-09-22, owner
`ransomwhere`	CC BY 4.0 (ransomwhe.re); redistributable with attribution; the API export is public.	no — addresses and family names	2026-09-22, owner
`pool-catalog-mempool`	MIT (mempool/mining-pools); redistributable with attribution.	no	2026-09-22, owner
`pool-catalog-bitcoin-data`	MIT (bitcoin-data/mining-pools); redistributable with attribution.	no	2026-09-22, owner
`mitre-attack`	MITRE ATT&CK® terms of use — © The MITRE Corporation, used under its terms; redistributable with attribution; produces entities and relations, never claims on subjects.	no — groups and software	2026-09-22, owner
`misp-galaxy-ransomware`	CC0 1.0 (MISP Galaxy); one registered source per cluster file; entities attach to existing ones by name or alias.	no	2026-09-22, owner
`misp-galaxy-threat-actor`	CC0 1.0 (MISP Galaxy); one registered source per cluster file; entities attach to existing ones by name or alias.	no	2026-09-22, owner

Exchange proof-of-reserves disclosures (por:<exchange>) are signed off per exchange under the disclosure page's terms. The registry of record, with every row and its notes, is legal/data-sources.md in the codex.

The checklist a source passes

Licence permits our use and redistribution of derived claims; otherwise non-redistributable.
Attribution text captured and rendered wherever the licence requires it.
Terms of service reviewed for automated collection.
Personal-data assessment: are natural persons named, is there GDPR exposure? The answer is recorded per source.
Update cadence defined and a parser named.
Fetch citation: every fetch records URL, time, SHA-256 and size; files are never stored.
Reliability prior and default confidence class set; whether an agent may publish imports from it decided (only registered, reviewed sources).
Owner sign-off row added to the registry — the date the database checks.

What is not a source

Stealer-log wallet lists: personal data of stolen-data provenance, never ingested.
A Nostr relay or a pubkey: transport and identity, not sources. Community notes are their own band and never enter the Curated tables.
Link-out only until licensed: OpenSanctions, Malpedia, ransomware.live's free tier (non-commercial terms), Arkham, WalletExplorer, Chainabuse (terms not published). Claims may cite them as evidence URLs; nothing is imported from them.
OSINT: one source per platform and per named researcher, low reliability prior, quotes and links only; handles are personal data and the takedown route applies.

When a source is wrong

Sources may contradict each other; btcintel returns the set and marks disputes, never a merged verdict. A claim a source withdraws is retracted with a reason, keeping its versions and citations. Something wrong or missing on a page? The feedback sheet at the bottom of every subject page, or the send_feedback tool, reaches the people who curate the sources.