The Graph

United States · thegraph.com · 4 vendors

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 4 sub-vendors.

Insights

Last updated 2026-07-07 · revision 1

4 direct vendors, 124 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 8/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

The Graph exhibits high migration readiness, largely attributable to its modern and cloud-native oriented internal tech stack. The extensive use of Docker, Kubernetes (K8s), Terraform, and Google Cloud Platform (GCP)/Google Kubernetes Engine (GKE) indicates a highly containerized and infrastructure-as-code approach, which are foundational for flexible and efficient migrations to various cloud or hybrid environments. The data also states 'Total Vendors: 0' for services, implying a significant absence of external vendor lock-in, which is a major advantage for reducing complexity and cost during a migration. Additionally, the 'Amp' product's offering of 'cloud, on-prem, and hybrid deployment' options suggests an architectural design that inherently supports diverse deployment targets. Challenges for migration could arise from the unique nature of its 'Decentralized Protocol' and 'blockchain-native database' (Amp), which might require specialized expertise or considerations not typical for traditional enterprise migrations. The lack of specified 'Data Residency Requirements' and information on the 'Regulatory Environment' introduces potential unknowns that could impact migration planning and execution. Similarly, the absence of 'Financial Stability' data means the ability to fund a significant migration effort cannot be assessed.

Compliance

8 in-scope frameworks identified; showing 3.

CCPA — Partially Compliant

The Graph explicitly includes a CCPA supplemental notice in its Privacy Policy, demonstrating awareness of and partial compliance with CCPA obligations. The policy discloses categories of personal information collected, third-party disclosures, and California residents' rights (access, deletion, non-discrimination). However, the policy was last updated November 2023 and may not fully reflect CPRA (California Privacy Rights Act) amendments effective January 2023, including requirements for sensitive personal information handling, data minimization, and purpose limitation. The risk is Medium because The Graph has made good-faith CCPA disclosures but the policy may require updates for full CPRA compliance.

Evidence: https://thegraph.com/privacy/

MiCA — Assessment Required

MiCA (Regulation EU 2023/1114) came into full effect on December 30, 2024, establishing a comprehensive EU regulatory framework for crypto-assets. The Graph's GRT token and associated services may fall within MiCA's scope. Risk is High because: (1) MiCA imposes authorization, disclosure, and operational requirements on crypto-asset service providers (CASPs) and issuers of crypto-assets other than asset-referenced tokens and e-money tokens; (2) The GRT token is a utility token used for network payments — potentially classified as a 'utility token' or 'other crypto-asset' under MiCA; (3) The Graph Foundation is registered in the Cayman Islands but serves EU users, and MiCA has extraterritorial reach for services offered to EU residents; (4) Non-compliance with MiCA can result in significant fines and prohibition of services in the EU.

Evidence: https://thegraph.com/terms-of-service/, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32023R1114

Cayman Islands Data Protection Act — Assessment Required

The Graph Foundation is legally registered in the Cayman Islands (c/o Zedra Cayman Management Services Limited, Grand Cayman). The Cayman Islands Data Protection Act (2017 Revision) applies to data controllers established in the Cayman Islands. As the legal entity is registered there, the DPA 2017 is directly applicable. Risk is Medium because: (1) The Cayman Islands DPA imposes obligations on data controllers including fair processing, data subject rights, and security requirements; (2) No evidence of DPA 2017 compliance measures (e.g., registration with the Ombudsman, privacy notices meeting DPA standards) was found; (3) The Privacy Policy does not reference the Cayman Islands DPA.

Evidence: https://thegraph.com/privacy/, https://ombudsman.ky/data-protection

Financials

Three-year financials

Financial Resilience Score: 5/10

The Graph is not a traditional company but a decentralized blockchain protocol governed by The Graph Foundation (non-profit) and built by a federation of independent core developer teams. There are no audited financial statements, no SEC filings, and no disclosed revenue, EBIT, or equity figures. Financial resilience must therefore be assessed via proxies such as GRT token market capitalization, treasury reserves, and protocol usage metrics. The Foundation holds a treasury seeded by the December 2020 token sale (~US$12M) and prior venture rounds (~US$7.5M), partly in GRT and reportedly in stablecoin/fiat reserves. Strong protocol adoption (75,000+ projects, 60+ chains, ~1.27 trillion cumulative queries served) provides a genuine network-effect moat and reduces single-point-of-failure risk via the federated builder model. However, resilience is materially exposed to GRT token price volatility: the token traded around $0.30 at end-2024 (~$3.0B market cap) but fell sharply to $0.07–$0.10 in late 2025, compressing treasury value and funding runway. Protocol economics also face a demand/supply imbalance (many Indexers, still-nascent query fee demand), token inflation from indexing rewards (~3% annual issuance), competitive pressure from centralized alternatives (Alchemy, QuickNode, Covalent, Dune, Goldsky) and decentralized rivals (SubQuery, Chainbase), and regulatory uncertainty around GRT's securities classification. Overall a mid-range score reflects a real, adopted protocol with diversified builders but with meaningful token-price and transparency risks.

Key strengths: Diversified treasury seeded by ~US$12M token sale (Dec 2020) plus ~US$7.5M prior venture rounds, Federated core-developer model spread across Edge & Node, StreamingFast, Semiotic Labs, The Guild, GraphOps, Messari, Pinax and Geo reduces single-entity risk, Strong network effects: 75,000+ projects, 60+ chains, ~1.27 trillion cumulative queries, Successful Sunrise (2024) full decentralization milestone and Horizon (Dec 2025) upgrade, Enterprise/institutional traction (e.g., DTCC 'Great Collateral Experiment' pilot)

Risk factors: Heavy GRT token-price exposure; GRT fell from ~$0.30 (end-2024) to ~$0.07–$0.10 in late 2025, Token inflation (~3% annual issuance) dilutes GRT if query-fee burns don't keep pace, Acknowledged supply/demand imbalance: many Indexers but query demand still small, Competition from centralized providers (Alchemy, QuickNode, Covalent, Dune, Goldsky) and decentralized rivals (SubQuery, Chainbase), Regulatory risk: potential US securities-law scrutiny of GRT, No audited financial statements or public accounts limits transparency

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report