Top 7 Ethereum RPC providers for forensics and compliance analytics in 2026

Ethereum is the world’s leading programmable blockchain and the primary evidentiary record for on-chain financial forensics. Over $3 trillion in cumulative DeFi volume, the majority of regulated stablecoins, and virtually every major tokenized asset program run on Ethereum — making it the chain that compliance teams, blockchain analytics firms, and law enforcement investigators most frequently need to interrogate.

Choosing an RPC provider for this workload is different from choosing one for trading or general dApp development. You are not competing for block inclusion or chasing sub-millisecond latency. You are running sustained, archive-depth queries: replaying historical transaction execution with debug_traceTransaction, reconstructing years of token flows via eth_getLogs, querying account state at specific historical block heights, and building reproducible audit trails that hold up under legal or regulatory scrutiny.

This guide compares 7 Ethereum RPC providers for forensics and compliance analytics: archive and trace access, compliance certifications, pricing for debug-heavy workloads, dedicated throughput options, and data sovereignty.

💡 Already using Chainstack? Jump straight to the Ethereum tooling documentation or deploy your archive endpoint in the Chainstack console in minutes.

Forensics and compliance analytics on Ethereum: RPC requirements

Latency requirements

Forensics and compliance workloads are primarily batch-tolerant. You are not competing with MEV bots for a 10ms advantage — what matters is throughput consistency: a provider that handles 200 concurrent archive reads without rate-limiting is more useful than one with an impressive eth_blockNumber benchmark.

The exception is real-time sanctions screening: systems that monitor the mempool or watch incoming blocks for flagged addresses need stable WebSocket subscriptions with reliable reconnection. For that component, a p95 latency under 200ms and a subscription that doesn’t silently drop are reasonable targets.

Throughput requirements

• Sustained historical indexing: 50–300 RPS of archive reads across multiple block ranges simultaneously
• Batch reconstruction jobs: bursts of 500–1,000+ debug_traceTransaction calls when replaying a contract’s full history
• Real-time monitoring: moderate (roughly 10–50 RPS) but continuous, 24/7

Shared public endpoints collapse under sustained indexing load. Reconstructing a token’s full transfer history or tracing a wallet cluster over multiple years needs a dedicated node, an Unlimited Node add-on, or a self-hosted deployment.

Key RPC methods for forensics and compliance analytics

Method	What it does	Archive required
debug_traceTransaction	Full EVM execution trace of a transaction — every internal call, storage read/write, gas step, and revert path	Yes, for transactions older than ~128 blocks
debug_traceBlockByNumber	Traces every transaction in a block in one call — more efficient than tracing transaction-by-transaction for bulk reconstruction	Yes, for historical blocks
trace_transaction	Parity/Erigon-format call tree, reward, and state diff — less verbose than debug_* output, faster for simple call tracing	Yes, for historical blocks
trace_filter	Filters traces by from-address, to-address, or block range — the efficient way to find every interaction involving a flagged address	Yes, for historical blocks
trace_block	Retrieves every trace for a given block, for systematic block-by-block reconstruction	Yes, for historical blocks
eth_getLogs	Event log scanning by address, topic, and block range — the primary method for tracking ERC-20/721/1155 transfers	No — full nodes serve this within their retention window; archive only matters past that depth
eth_getTransactionByHash	Transaction parameters: sender, receiver, value, input data, nonce — the first lookup in almost every investigation	No
eth_getTransactionReceipt	Execution result, full event logs, gas used, revert reason, deployed contract address	No
eth_getBalance at a past block	Account balance at a specific historical point — establishing what a wallet held before or after a suspected exploit	Yes, at a past block number
eth_getStorageAt at a past block	A specific contract storage slot at a historical block — verifying state before/after an incident	Yes, at a past block number
eth_call at a past block	Replays a contract read against historical chain state	Yes, at a past block number

eth_getLogs with a wide block range does not require an archive node — it works on full nodes. Archive access is required only for historical state reads (eth_call, eth_getBalance, eth_getStorageAt at a past block) and the debug_* / trace_* namespaces. → Full method reference: Ethereum API overview.

Archive node access: non-negotiable

Every forensics workflow targeting historical Ethereum data needs archive access. Without it, debug_traceTransaction fails for transactions older than roughly 128 blocks, historical eth_call/eth_getBalance/eth_getStorageAt queries fail, and trace_* methods fail outside the node’s retained state window.

Archive nodes store complete historical state from genesis. Full Ethereum archive storage runs into multiple terabytes and grows continuously — the direct reason archive access costs more to run, and the reason some “archive” offerings in the market are partial or throttled rather than complete. Confirm your provider’s archive coverage includes the debug_* and trace_* namespaces, not just historical log access — see Chainstack’s archive data page for what a complete archive offering looks like.

Infrastructure requirements

• Archive node with debug and trace APIs enabled
• WebSocket endpoint for real-time monitoring and eth_subscribe
• High RPS allowance or a dedicated endpoint — shared infrastructure throttles under sustained indexing
• A contractual SLA — regulatory reporting often requires a documented uptime guarantee for the infrastructure it depends on
• SOC 2 Type II and, increasingly, ISO 27001 — the auditable attestations most compliance teams require before onboarding a vendor

Provider comparison

The table below summarizes public positioning as of August 2026.

Provider	Pricing model	Free tier	Dedicated nodes	Archive & trace	SOC 2 / ISO 27001
Chainstack	1 RU/request, 2 RU for archive/debug/trace	Permanent, 3M RU/month	Yes (paid plans)	Yes — debug_* and trace_* enabled	Yes / Yes
OnFinality	Per-request API tier + Dedicated Node option	Free API tier	Yes (Dedicated Node)	Routes to underlying providers with archive support	Verify per engagement
Uniblock	Unified JSON-RPC across 55+ providers	Free developer tier	Via underlying providers	Depends on the underlying provider it routes to	Verify per engagement
Blockdaemon	Custom/institutional pricing	No	Yes (archival nodes)	Yes — archival nodes with event streaming	Yes / Yes
Infura	API credits (method-weighted)	3M credits/day	No standard option	Archive: yes; debug/trace: yes on paid plans	Not published standalone
Alchemy	CU-based (method-weighted)	Permanent free tier	No standard option	Archive: yes; debug/trace: expensive per call	Yes / Not published
Quicknode	Credit-based (method-weighted)	1-month trial only	Dedicated clusters	Archive: yes; trace: yes on paid plans	Yes / Yes

Chainstack

Chainstack addresses forensics and compliance analytics by pairing archive-depth Ethereum RPC access — full debug_* and trace_* namespace coverage at 2 RU per call, the same rate as eth_blockNumber for standard reads — with the compliance certifications regulated teams actually check for, without gating either behind a separate enterprise negotiation.

Archive and debug pricing: every Chainstack plan above Developer includes archive access with both namespaces enabled, billed at a flat 2 RU regardless of how expensive the underlying trace computation is. A debug_traceTransaction call on a 500-internal-call DeFi transaction costs the same 2 RU as a call on a simple transfer. Chainstack’s own cost comparison puts method-weighted competitors at roughly 40–60× the cost of a standard call for debug_traceTransaction and eth_getLogs respectively — at forensics scale, that difference compounds fast.

Deployment tiers: Dedicated Nodes remove shared-infrastructure rate limits for bulk historical reconstruction pipelines. The Unlimited Node add-on converts billing to a flat monthly fee at 25–500 RPS ($149–$3,199/month) so sustained indexing doesn’t accumulate per-request cost. Global Nodes provide geo-routed, load-balanced access with a documented uptime SLA. For organizations that cannot route forensic data through any third-party cloud — law enforcement agencies, custodians under MiCA or GENIUS Act data-residency obligations — Chainstack Self-Hosted deploys the same Reth execution client and Prysm consensus client stack (Ethereum Mainnet, Sepolia, and Hoodi are all supported) inside your own perimeter.

Compliance posture: Chainstack holds both SOC 2 Type II (certified December 2025) and ISO 27001 (certified July 2026) — the two most commonly requested attestations in vendor security questionnaires. Chainstack for Enterprise adds SSO, RBAC, a dedicated account team, and a contractual uptime SLA with service credits; Enterprise support commits to sub-1-hour response on SEV1/SEV2 issues on the Professional and Premium tiers.

Limitations: the Developer free plan (3M RU/month, 25 RPS) exhausts within hours of sustained archive scanning, and Dedicated Nodes require a paid plan. On raw HTTP latency, compare.chainstack.com currently ranks Chainstack third on Ethereum p95 (689ms) behind Alchemy (330ms) and Quicknode (454ms), though all three hold the same 99.98% availability — a gap that matters more for latency-sensitive trading than for the batch-tolerant archive reads this use case is built around.

Fit by workload:

• Bulk historical trace indexing: Excellent — flat debug/trace pricing at 2 RU, Unlimited Node for sustained RPS, both namespaces on by default
• Real-time sanctions monitoring: Strong — WebSocket subscriptions and a documented SLA, though raw p95 latency trails the top two on the current benchmark
• Regulated compliance infrastructure: Excellent — dual SOC 2 Type II and ISO 27001 certification, contractual SLA, Self-Hosted for data-sovereignty requirements

OnFinality

OnFinality is a multi-chain node service spanning 130+ networks, offering an API tier and a Dedicated Node option for Ethereum alongside managed SubQuery indexer hosting — a real fit for compliance teams whose forensics pipeline is fundamentally an indexing problem (reconstructing years of token flows into a queryable dataset).

For teams building a custom compliance data pipeline rather than calling raw RPC methods one at a time, OnFinality’s managed SubQuery hosting handles the indexing infrastructure directly: define the events and contracts to track, and let OnFinality run the indexer rather than standing up your own. That’s a different product shape from plain archive RPC access, and it’s worth evaluating specifically if your forensics workload already looks like an indexing project rather than a series of ad hoc trace calls.

Limitations: OnFinality’s own published documentation doesn’t detail a standalone SOC 2 Type II or ISO 27001 certification for its Ethereum product — confirm current compliance status directly if a vendor questionnaire requires it. Debug and trace namespace depth on the API tier depends on the underlying node configuration rather than a documented flat guarantee.

Fit by workload:

• Bulk historical trace indexing: Good — the SubQuery indexing path is a genuine shortcut for teams building structured compliance datasets rather than raw trace pipelines
• Real-time sanctions monitoring: Moderate — API tier supports standard subscriptions; no published SLA specific to monitoring workloads
• Regulated compliance infrastructure: Limited — no confirmed standalone certification for the Ethereum offering

Uniblock

Uniblock is a managed infrastructure layer routing across 300+ blockchains and 55+ underlying RPC providers, with three product tiers: Unified JSON-RPC for raw method calls, Unified APIs for higher-level token/NFT/market data and webhooks, and Direct Provider APIs for pass-through access to a specific backend.

The webhook layer in Unified APIs is the part worth evaluating for compliance workloads specifically: building an automated alert system around a flagged address is naturally a webhook problem, and Uniblock’s pooled 55+ provider backend gives that alerting layer rate-limit headroom that a single upstream provider might not. Customers on the platform include Plume Network, Stellar, and Hypernative — over 4,000 developers and 3,000 projects at last count.

Limitations: because requests route through whichever underlying provider Uniblock selects, archive and trace depth for a given call depends on that backend’s own capability rather than a single documented guarantee from Uniblock itself. No standalone SOC 2 or ISO 27001 certification is published for the platform — confirm directly if your vendor questionnaire requires one.

Fit by workload:

• Bulk historical trace indexing: Moderate — works, but trace availability depends on which underlying provider handles the request
• Real-time sanctions monitoring: Good — the Unified API webhook layer is a natural fit for automated address-flagging alerts
• Regulated compliance infrastructure: Limited — no confirmed standalone certification

Blockdaemon

Blockdaemon is an institutional blockchain infrastructure provider offering Ethereum RPC access, archival nodes, and event streaming alongside its custody and staking business — built for the exact buyer profile (banks, custodians, regulated funds) that forensics and compliance tooling usually serves.

Both SOC 2 Type II and ISO 27001 are published certifications for Blockdaemon, matching the compliance bar this use case requires. The bundled positioning — archival data infrastructure sitting next to custody and staking in the same platform — suits organizations that already run other Blockdaemon institutional products and want their forensics data pipeline on the same vendor relationship, though it’s a heavier commercial engagement than a self-serve RPC signup.

Limitations: pricing is custom/quote-based rather than published, so there’s no free tier or self-serve trial to evaluate before committing. The product is explicitly positioned for institutional buyers rather than individual developers or small compliance teams, which shows up in onboarding friction if you just need an archive endpoint quickly.

Fit by workload:

• Bulk historical trace indexing: Strong — archival nodes and event streaming built for exactly this kind of reconstruction work
• Real-time sanctions monitoring: Good — event streaming infrastructure supports flagged-address alerting, though implementation requires a direct sales engagement
• Regulated compliance infrastructure: Excellent — dual certification and an institutional support model built around regulated buyers specifically

Infura

Infura, owned by ConsenSys, is the original managed Ethereum RPC provider and carries institutional name recognition that matters specifically in forensics contexts — compliance teams building chains of evidence and regulators reviewing analytics vendor lists are more likely to already know Infura as a decade-old known quantity than any provider newer to the space.

Archive access is available starting at the Developer paid tier ($50/month), with debug_* namespace access on paid plans; trace_* namespace availability depends on the specific plan configuration, so confirm it for your tier before building a pipeline around it. The free tier provides roughly 3 million credits per day at a 2,000 credits/second cap — workable for prototyping, not for a production forensics pipeline running sustained archive scans.

Limitations: Infura’s credit-based, method-weighted pricing makes bulk debug_traceTransaction and trace_* workloads more expensive than flat-rate alternatives at volume. No standalone Infura or ConsenSys SOC 2 Type II or ISO 27001 certification is published — verify directly if a vendor questionnaire specifically requires one. No standard dedicated node option outside enterprise sales.

Fit by workload:

• Bulk historical trace indexing: Good — archive and debug access confirmed on paid plans, though method-weighted credits scale cost with volume
• Real-time sanctions monitoring: Good — WebSocket support and a long operating track record
• Regulated compliance infrastructure: Moderate — strong institutional name recognition, but standalone certification documentation needs direct confirmation

Alchemy

Alchemy is the most widely recognized Ethereum RPC provider by developer mindshare, with archive node access and the debug_* namespace available on paid plans and a permanent free tier — no time-limited trial, unlike some competitors in this comparison.

The compute unit (CU) pricing model is the real friction point for forensics at scale: Chainstack’s cost comparison puts Alchemy’s eth_getLogs at roughly 60× and debug_traceTransaction at roughly 40× the cost of a standard call, versus Chainstack’s flat 1×/2× structure. A pipeline running thousands of trace calls a day burns through CU allowances fast, and the effective per-call cost for a forensics-heavy workload can run well above what the headline pricing suggests. Alchemy’s proprietary enhanced APIs (alchemy_getAssetTransfers, Notify webhooks) are genuinely useful for general development, but proprietary methods raise a reproducibility question for compliance audit trails that need to hold up against standard Ethereum RPC.

Limitations: CU method multipliers make debug/trace-heavy workloads expensive at forensics volume. No standard dedicated node offering. No published ISO 27001 certification alongside SOC 2 Type II.

Fit by workload:

• Bulk historical trace indexing: Moderate — archive access is there, but CU costs climb fast on trace-heavy pipelines
• Real-time sanctions monitoring: Good — Notify webhooks and consistently low latency (currently ranked #1 on Ethereum at compare.chainstack.com, 330ms p95)
• Regulated compliance infrastructure: Good — SOC 2 Type II certified, though the CU model limits cost predictability for debug-intensive audit work

Quicknode

Quicknode holds both SOC 2 Type II and ISO 27001 certification, with archive access, debug_*/trace_* namespaces, and dedicated clusters all available on paid plans — a technically complete option for teams whose vendor questionnaire specifically checks both boxes.

Dedicated clusters (rather than only shared endpoints) remove the rate-limit uncertainty that a forensics pipeline can’t afford mid-investigation. The credit-based, method-weighted pricing carries the same scaling problem as Alchemy’s CU model here: Chainstack’s cost comparison puts Quicknode’s eth_getLogs at roughly 60× and debug_traceTransaction at roughly 40× a standard call. Teams scaling past the entry tiers often find credit consumption on trace-heavy pipelines outpaces what the headline pricing suggested — worth modeling against your actual call mix before committing to a plan.

Limitations: no permanent free tier — the entry offering is a one-month trial (10M credits, 15 RPS) rather than an ongoing plan, unlike Chainstack, Alchemy, or Infura. Method-weighted credits make sustained trace workloads harder to forecast than flat-rate billing.

Fit by workload:

• Bulk historical trace indexing: Strong — dedicated clusters remove rate-limit risk, archive and trace both confirmed, though credit costs scale with volume
• Real-time sanctions monitoring: Excellent — the lowest p95 latency of the direct competitors on the current Ethereum benchmark (454ms) and dedicated cluster options
• Regulated compliance infrastructure: Excellent — dual SOC 2 Type II and ISO 27001 certification, matching Chainstack and Blockdaemon as the only three providers here with both

Code example: tracing a transaction for forensics analysis

from web3 import Web3

RPC_URL = "YOUR_CHAINSTACK_ENDPOINT"
w3 = Web3(Web3.HTTPProvider(RPC_URL))

tx_hash = "YOUR_TRANSACTION_HASH"

# Full execution trace — requires an archive node with the debug namespace
trace = w3.manager.request_blocking(
    "debug_traceTransaction",
    [tx_hash, {"tracer": "callTracer"}]
)

print(f"Top-level call type: {trace['type']}")
print(f"From: {trace['from']}")
print(f"To:   {trace['to']}")
print(f"Internal calls: {len(trace.get('calls', []))}")

🔒 Archive requirement: debug_traceTransaction requires an archive node with the debug namespace enabled. All Chainstack paid-plan endpoints include this at a flat 2 RU per call, regardless of trace complexity.

Real-world performance benchmark

Ethereum is tracked on both compare.chainstack.com and the Chainstack performance dashboard, alongside Arbitrum, Base, BNB, Solana, and other major chains. As of this writing, compare.chainstack.com’s Ethereum ranking shows Alchemy first (99.98% availability, 330ms p95), Quicknode second (99.98%, 454ms), Chainstack third (99.98%, 689ms), and dRPC fourth (99.77%, 1.10s).

That ranking matters more for latency-sensitive trading than for the workload this article covers — forensics and compliance pipelines are batch-tolerant by design, and the number that actually predicts whether a bulk trace job finishes on schedule is sustained throughput under rate limits, not single-call p95. For the real-time sanctions-monitoring component specifically, where subscription stability does matter, weigh the latency numbers above alongside each provider’s WebSocket reliability and SLA terms rather than in isolation.

⚡ Benchmark before committing: For forensics-specific methods like debug_traceTransaction, real-world latency varies by node client, archive depth, and whether you’re on a shared or dedicated endpoint. Run a targeted benchmark from your own region — a Python loop or k6 script against your candidate endpoints — before committing to a provider; it will surface differences in trace response times that an aggregate dashboard doesn’t capture.

Getting started with forensics and compliance analytics on Chainstack

Deploy a production Ethereum archive endpoint for forensics and compliance analytics in a few steps and build better with Ethereum on Chainstack:

1. Log in to the Chainstack console (or create an account).
2. Create a new project
3. Select Ethereum as your blockchain protocol
4. Choose network: Ethereum Mainnet or Sepolia / Hoodi testnet
5. Deploy the node, confirming Archive as the node type — required for all trace and historical state methods
6. Open Access and credentials and copy your HTTPS and WebSocket endpoints

For bulk historical reconstruction or automated compliance screening, evaluate Dedicated Nodes or the Unlimited Node add-on after the initial deploy — both are available inside the same project.

See the Chainstack Ethereum tooling documentation for the full integration guide, including SDK setup for compliance-focused event scanning.

Need testnet ETH? Grab some from the Chainstack Sepolia faucet.

🤖 You can also access Chainstack Ethereum RPC directly from Claude Code, Cursor, Codex, Pi, or any MCP-compatible agent using Chainstack MCP. For a fuller agent stack — MCP, the Chainstack skill, llms.txt for context ingestion, and WebMCP for agentic browsers — see the Chainstack Agents page.

Conclusion

The infrastructure decision for forensics and compliance analytics on Ethereum in 2026 comes down to archive and trace depth, predictable costs on debug-heavy workloads, and which certifications your vendor management process actually requires.

• Bulk historical trace indexing at scale: Chainstack Dedicated Nodes with the Unlimited Node add-on — flat 2 RU debug/trace pricing, no shared RPS limits
• Data sovereignty required (law enforcement, regulated custodians): Chainstack Self-Hosted — the same archive, debug, and trace stack on your own infrastructure
• Dual SOC 2 Type II + ISO 27001 with no compromise on either: Chainstack, Quicknode, or Blockdaemon — the only three providers in this comparison with both certifications published
• Institutional bundling with custody and staking already in place: Blockdaemon — archival nodes and event streaming on the same platform as existing institutional relationships
• Structured compliance datasets via managed indexing: OnFinality — SubQuery hosting turns raw archive reads into a queryable dataset without standing up your own indexer
• Automated alerting on flagged addresses: Uniblock’s Unified API webhook layer, or Chainstack Global Nodes paired with your own subscription logic
• Institutional name recognition in legal chains of evidence: Infura — decade-long track record on Ethereum with ConsenSys backing
• Balanced production forensics stack overall: Chainstack — flat debug/trace pricing, full archive coverage, dual certification, and Dedicated Nodes without an enterprise-only gate

Frequently asked questions

Q: What Ethereum RPC methods do forensics and compliance teams use most?

The core set is debug_traceTransaction (full EVM execution trace), trace_filter (trace filtering by address and block range), eth_getLogs (event scanning for token transfers), eth_getTransactionReceipt (execution result with logs), and eth_getBalance / eth_call at a historical block. All except eth_getLogs require an archive node with the debug or trace namespace enabled — confirm your provider exposes both, since not all of them do.

Q: Which Ethereum RPC provider has the best free tier for compliance and forensics prototyping?

Chainstack’s Developer plan is a permanent free tier (3M RU/month, 25 RPS, no card required) rather than a time-limited trial, which matters for a team evaluating a provider before committing budget. Alchemy and Infura also offer permanent free tiers (Infura at roughly 3M credits/day). Quicknode’s entry offering is a one-month trial, not an ongoing plan — useful for a short proof of concept, not for open-ended prototyping.

Q: How do I migrate an existing forensics pipeline from Infura or Alchemy to Chainstack?

Migration is mostly a matter of swapping the RPC endpoint URL once you’ve confirmed method and namespace parity — the debug_* and trace_* calls your pipeline already makes work unchanged against a Chainstack archive endpoint. Chainstack’s migration runbook covers scanning a codebase for existing endpoints, converting your current CU/credit usage into an equivalent Request Unit estimate, and repointing endpoints once you’re satisfied with the cost comparison.

Q: What RPC latency do I need for real-time Ethereum sanctions screening?

For mempool and block-level monitoring, a p95 WebSocket latency under 200ms from your deployment region is a reasonable target — but subscription stability matters more than the headline number. A dropped eth_subscribe connection that takes 30 seconds to reconnect misses blocks, which is a compliance gap regardless of how fast the provider’s average response is. On the current Ethereum benchmark, Alchemy and Quicknode post lower p95 numbers than Chainstack; prioritize whichever provider pairs acceptable latency with the contractual SLA and certification your monitoring program actually requires.

Q: Which Ethereum RPC providers hold SOC 2 Type II and ISO 27001 certification?

Chainstack (SOC 2 Type II since December 2025, ISO 27001 since July 2026), Quicknode, and Blockdaemon are the three providers in this comparison with both certifications published. Alchemy holds SOC 2 Type II but has not published ISO 27001. Infura and OnFinality don’t publish standalone certifications for their Ethereum offerings — confirm directly if your vendor questionnaire requires one from either.

Q: How does Ethereum archive RPC pricing compare across providers for debug-heavy workloads?

The gap is significant. Chainstack bills every call at 1 RU, with archive, debug, and trace calls at a flat 2 RU regardless of trace complexity. Quicknode and Alchemy both weight eth_getLogs at roughly 60× and debug_traceTransaction at roughly 40× the cost of a standard call under their credit and CU models, respectively. For a pipeline running thousands of trace calls a day, that multiplier — not the advertised per-request rate — determines whether archive tracing stays affordable at scale.

Additional resources

• How to get an Ethereum RPC endpoint in 2026
• Ethereum tooling documentation — Chainstack Docs
• Ethereum available methods — Chainstack Docs
• Ethereum debug and trace RPC methods — Chainstack Docs
• More Ethereum tutorials and articles on the Chainstack Blog
• Chainstack pricing