Reference
Network and privacy
Holdings contacts outside services only when you use a feature that needs them. This page lists every host it can reach, grouped by feature, so you can see where each request goes.
How requests work#
- Wallet, exchange, Zerion and security reads start only when you ask for them.
- The market strip refreshes about once a minute while the Holdings window is visible.
- Alert watch and the weekly briefing run only after you turn them on. Alert watch checks about every 5 minutes while Hermes is open.
- Holdings sends no telemetry, runs no background account sync, never updates itself and does not run shell commands.
Pacing and rate limits#
Reads to one provider run one at a time and are spaced to stay under its published rate limit, or 10 requests per second where the provider publishes none.
A rate-limit error pauses only that provider. Other providers keep working. The paused wallet shows that balances are unavailable, and you can try again after the pause.
Wallet balances and history#
| Host | Used for | What it receives |
|---|---|---|
ethereum-rpc.publicnode.com | Ethereum balances and swap receipts | The public address you entered |
base-rpc.publicnode.com | Base balances | The public address you entered |
arbitrum-one-rpc.publicnode.com | Arbitrum One balances | The public address you entered |
bsc-rpc.publicnode.com | BNB Chain balances | The public address you entered |
robinhood-rpc.publicnode.com | Robinhood Chain balances | The public address you entered |
api.mainnet-beta.solana.com | Solana balances | The public address you entered |
api.etherscan.io | Ethereum history and keyed Ethereum balances | The address, the block range and your Etherscan key, which Etherscan expects in the request |
eth.drpc.org | Uniswap v3 pool lookups when Holdings checks a swap | Public pool and token contracts |
rpc.mevblocker.io | Backup for the Uniswap v3 pool lookups | Public pool and token contracts |
Prices and market charts#
| Host | Used for | What it receives |
|---|---|---|
coins.llama.fi | Prices for the keyless token list | Public token contracts on each chain |
api.kraken.com | Public quotes and charts for BTC, SOL, BNB and USDC against the US dollar | Fixed public market names |
api.geckoterminal.com | The WETH and USDC chart for one Ethereum Uniswap v3 pool, and the WETH rate used for ETH when DefiLlama has no usable price | The fixed pool address |
stablecoins.llama.fi | Stablecoin peg warnings | Nothing about you |
Zerion data and images#
| Host | Used for | What it receives |
|---|---|---|
api.zerion.io | Tokens, DeFi positions, NFTs, wallet charts and profit and loss | The public address and your Zerion key |
token-icons.s3.amazonaws.com | Token and NFT thumbnails that Zerion points to | A request for the image |
nft2-cdn.alchemy.com | NFT thumbnails that Zerion points to | A request for the image |
Holdings loads thumbnails only from these two image hosts. Any other image shows a local placeholder tile.
Exchange accounts#
| Host | Used for | What it receives |
|---|---|---|
api.kraken.com | Kraken Spot balances, history, system status and public prices for your balances | Requests signed with your Kraken key, or nothing for prices and status |
api.binance.com | Binance.com Spot balances, history, system status and public prices for your balances | Requests signed with your Binance.com key, or nothing for prices and status |
api.bybit.com | Bybit key permissions and Spot history | Requests signed with your Bybit key |
api.bytick.com | Bybit balances, system status and public prices for your balances | Requests signed with your Bybit key, or nothing for prices and status |
Signed requests go only to read endpoints. The status checks and price lists are public and carry no account data.
Security checks and alerts#
| Host | Used for | What it receives |
|---|---|---|
api.gopluslabs.io | Scam token, approval and risky address checks | The wallet address and the token contracts being checked |
api.llama.fi | Hack alerts for DeFi positions you have loaded | Nothing about you |
www.federalreserve.gov | Federal Reserve press releases for market alerts | Nothing about you |
Links Holdings shows but does not open#
Some screens show links that you can copy or open yourself. Holdings never fetches these pages.
revoke.cashis suggested when a token approval looks risky, so you can review it yourself.defillama.com/hacksis the source page for hack alerts.- The Federal Reserve meeting calendar page is shown as a label next to a bundled list of dates.
Your Hermes model#
Holdings does not pick or host a model. When you use chat, Hermes sends the request to the model provider you configured, and a hosted provider may keep prompts and results under its own policy.
Support questions include your question, up to two earlier help questions and the relevant help articles. Hermes chat tools return fictional or public results unless you turn on private data sharing for that profile.
What stays on your computer#
Saved reviews and decisions are encrypted with AES-GCM before they are written to plugin-data/holdings in your Hermes home folder. A wrong or missing vault key keeps them locked. Exports and clipboard copies are plain text, so save them to a private folder.