Strict read profile

PRIVACY_READ_PROFILE selects the read privacy policy for transactions, receipts and events. It applies deployment-wide, to JSON-RPC and to the Explorer Data API (proxy mode) alike, and is fixed at startup.

Any other value, including a value of only spaces, refuses to start. When the environment variable is empty, the CONFIG_FILE value applies, and without one the profile is standard.

What strict enforces

A participant is a viewer whose linked address is the transaction's from or to. Nothing else counts as participation: an address in the calldata, in an event, or in a token transfer does not.

The event rule

Under strict an event is returned only when all of these hold:

1. The emitting contract has a registered ABI (a custom upload, or a metadata.token_type of the built-in registry), and it declares the event's signature (topic0) as a standard, non-anonymous event.
2. One of the event's indexed address parameters equals one of the viewer's linked addresses.
3. The viewer holds a contract grant on the emitting contract whose event rules allow the event. For an org admin or a contract admin, admin authority stands in for the event rules. It never stands in for condition 2.
4. The dynamic-payload gate passes. See events_allow_dynamic_payload in Response Filtering.

The event is hidden when any of the following holds:

• the ABI is unknown or does not declare the event;
• the event is anonymous;
• the topics do not match the declared indexed parameters;
• an address topic is not canonically padded;
• the data has undeclared bytes or does not decode exactly against the ABI;
• multiple event layouts in the ABI fit the same log, leaving its fields ambiguous.

Addresses of other users embedded in an admitted event stay masked, as under standard.

What strict switches off

Approved selective disclosure grants apply only through dedicated grant endpoints. They add no access to regular JSON-RPC or Explorer reads. The Explorer UI combines regular transactions with scoped grant transactions.

Residual surfaces the profile does not govern

The read profile covers transactions, receipts, events and traces. It does not change:

• Address state. eth_getBalance, eth_getTransactionCount (an account's nonce), eth_getStorageAt, eth_getProof and eth_call are governed by the method allowlist and the per-address checks. Org admins also keep access to historical-state queries.
• debug_traceCall. This simulates a call the caller composes and is governed by the method allowlist and trace validation.
• Operator-added RPC namespaces. Methods enabled through EXTRA_RPC_NAMESPACES_FILE are not covered by the profile's response filters. Do not enable methods that return transactions, receipts, logs or traces (for example trace_* or ots_*) on a deployment that must run strict.
• Block position of a receipt. A participant's receipt carries transactionIndex and cumulativeGasUsed, which reflect how many transactions, and how much gas, precede it in the block.
• Compliance records. Compliance decision logs and travel-rule records in the admin API remain readable by org admins.
• Access-log parameters. With AUDIT_LOG_PARAMS=true, the access log records redacted request parameters, which can include transaction hashes and addresses.

Assess these separately when a deployment must meet the strict requirement end to end.

Enabling and proving the profile

1. Set PRIVACY_READ_PROFILE=strict in the proxy environment and redeploy. If ORG_ADMIN_VIEW_USER_TXS=true is also set, it has no effect.

2. Check the startup log for read privacy profile profile=strict.

3. Query the effective profile. The endpoint accepts any admin credential:

   curl -s -H "X-Admin-Token: $ADMIN_API_TOKEN" http://<proxy>/api/v1/admin/system/read-profile
   # {"profile":"strict","org_admin_view_user_txs":false,"org_admin_view_user_txs_configured":false}
   

4. Run the smoke probe against the running deployment. Use the token of a viewer who is not a participant of a known transaction, such as an admin of the contract it called:

   PROXY_URL=http://<proxy> ADMIN_AUTH="X-Admin-Token: $ADMIN_API_TOKEN" \
   VIEWER_JWT=<non-participant token> TX_HASH=<transaction hash> \
   EXPLORER_URL=http://<proxy> scripts/check-strict-read-profile.sh
   

   The probe checks four things:

   • the reported profile;
   • that eth_getTransactionByHash and eth_getTransactionReceipt return null to that viewer;
   • that debug_traceTransaction returns no trace;
   • optionally, that the Explorer Data API answers 404.

   It exits non-zero on any failure.

5. Run the block explorer in proxy mode (PRIVACY_PROXY_URL), and make sure clients cannot reach the node or the chain indexer directly.

Changing the profile back

The profile is applied when data is read, not when it is written. A switch from strict to standard immediately applies the standard policy to all existing data again: admin reads, the per-contract unlock, and so on. Treat a downgrade as a disclosure event. It needs change-management approval and an audit record, and the startup log records the profile each deployment runs with.