Leaked logins
Work emails paired with passwords from combo lists, database dumps and ransomware posts. We classify plaintext against hash type and spot reuse, without ever keeping the password.
EmailPlaintextHash typeReuse
Know when your credentials leak.
Continuous monitoring of the surface web and approved dark-web sources for your verified domains. Masked alerts, plain-English next steps, and never the password itself.
Book a Monitoring Briefing
Monitoring starts only after you prove you own the domain
Safeguards
Authorization
Verified assets only
Secrets
Hashed on arrival, never stored
Oversight
Analysts review what matters
Accountability
Tamper-evident audit log
01 / 08
How it works
From proving the domain is yours to a masked alert in your inbox. No agents to install and nothing to configure on your network.
1
Verify
Add your domains and prove ownership with a DNS record. We re-check daily, and monitoring stops the moment a record disappears.
2
Collect
A governed crawler reads approved surface-web and Tor sources on a schedule. It never logs in, pays, or solves a CAPTCHA.
3
Match
Leaked records are hashed in an isolated step. Only matches to your verified assets are kept. Everything else is discarded.
4
Alert
You get a masked finding with its severity, what was exposed and what to do next. An analyst reviews the serious ones first.
02 / 08
What we watch for
Deterministic software finds and matches. AI only explains what a match means. Here is what lands in your dashboard.
Infostealer logs
Session and cookie exposure means an attacker may not need a password at all. These findings score higher and jump the review queue.
SessionsCookiesPriority review
Sensitive identifiers
Only for people you have enrolled with a lawful basis and evidence. If a matched record also carries an SSN, card or passport number, you learn the category, never the value.
PhoneSSNCardPassport
Personal context
Names, addresses and work history found in leaked text. Health content is reduced to a single flag and the text itself is discarded.
NamesAddressesHealth flagOn request
Exposure geography
Where exposures were observed, plotted only when a reliable source supplies the location. We never claim to know where an attacker is.
Observed locationsReliability-rated
Noise filtered out
Look-alike domains, namesakes and unverified breach claims are labelled as such, so your team does not chase ghosts.
Look-alikesNamesakesUnverified claims
03 / 08
See it. Fix it. Prove it.
One view of your exposure: a score you can explain, the trend, the sources and every finding. Identifiers are masked by default. Select a finding below to see how it is read.
Risk score
Lower is better
30/ 100
100 × (1 − e^(−pts ÷ 300))Lower is better
Open findings
54
3 critical · 11 high · 18 medium · 22 low
New this week
7
5 fewer than last week
Resolved · 30 days
19
Median fix time 2.4 days
New findings per week12 weeks
Source categories
- Stealer logs34%
- Combo lists28%
- Database dumps21%
- Forums & pastes11%
- Ransomware posts6%
What was exposed
- Email only22
- Password hash17
- Plaintext password12
- Phone / identity3
Where exposures were observed
CriticalHighMedium
Shown only when a reliable location exists. Unlocated findings are listed, not drawn.
Recent findingsSelect one
Synthetic data · reserved .example domains
Every figure is computed from the customer's own findings only
04 / 08
Monitoring without becoming the leak
A service that handles stolen data has to be harder to abuse than the thing it watches. These rules are enforced in code and tests, not just policy.
We never
Show or store a password
Secrets become flags and a keyed hash inside an isolated step. Alerts say that a password was exposed and what type it was, never its value.
Look up anyone you have not verified
There is no "search any email" box. Every query is scoped to domains you have proven you own, or people enrolled with a lawful basis.
Test credentials on live systems
We never try, replay or validate a leaked credential against anyone's login, yours included.
Break into restricted sources
No logins, payments, CAPTCHAs or downloads. A login wall or paywall stops the crawl and suspends the source.
Let an AI act on its own
Models explain findings. Deterministic code decides matches and severity, and no model output can trigger a reset or a notice.
We always
Verify before we watch
A DNS ownership challenge comes first, and it is re-checked daily. Individuals need a lawful basis and evidence on file.
Keep only what matches
Everything that does not match your verified assets is discarded after matching and never stored.
Put people on what matters
Critical severity, regulated data and low-confidence results go to a human analyst before they reach you.
Write it down, tamper-evidently
Every access, unmasking and source decision enters a hash-chained audit log that can be written to write-once storage.
Delete on your terms
Findings have retention limits by data type. Offboarding destroys your encryption key, so whatever remains is unreadable.
05 / 08
Severity, explained
Scoring is rule-based, versioned and transparent. Every finding lists the factors that moved it, so you can see why and challenge it.
Plaintext password, or a stealer log with live sessions or cookies
An attacker can probably sign in now.
Do nowReset, revoke sessions, enforce MFA, review sign-ins. Always analyst-reviewed.
Reused or privileged credentials, or weak hashes
Likely to be cracked or reused on other services.
Do soonReset and enforce MFA.
Strong hashes, or an enrolled phone or personal detail
Low chance of direct access, but useful for targeting.
Do this weekTell the person and watch for phishing.
Email address only, or an unreliable source
No secret was exposed.
Keep in viewLog it and use it in awareness training.
What moves a score
↑Plaintext password
↑Stealer log with sessions
↑Privileged or service account
↑Seen in the last 30 days
↑Several sources agree
↓Low-reliability source
↓Strong hash only
We recommend. You decide.
Password resets, session revocation and customer notices are never automated.
06 / 08
Plans and pricing
Pick the plan that matches your domains and your team. Pay monthly, or annually for about two months free. All prices are in US dollars.
Monitoring plans
Monthly or annual billingPersonal
For one person
$9.99/ month
or $99 / year
- Domains
- None
- Individuals
- 1
- Users
- 1
- Support
- Standard
Business
For one verified domain
$299/ month
or $2,990 / year
- Domains
- 1
- Individuals
- 50
- Users
- 5
- Support
- Standard
Professional
Most popularFor several domains and a team
$749/ month
or $7,490 / year
- Domains
- 3
- Individuals
- 250
- Users
- 15
- Support
- Priority
Enterprise
Set by contract
Starting at$1,999/ month
or from $19,990 / year
- Domains
- 10
- Individuals
- 1,000
- Users
- Unlimited
- Support
- Priority, negotiated SLA
Personal covers one enrolled person and no domains. Business and above monitor the domains you have verified.
API plans
Monthly billing only| Plan | Monthly | Requests / month | Per minute | Domains | People | API keys | Support |
|---|---|---|---|---|---|---|---|
| Developer API | $149 | 10,000 | 60 | 1 | 25 | 2 | Basic |
| Growth API | $499 | 100,000 | 300 | 3 | 250 | 5 | Priority |
| Scale API | $1,249 | 1,000,000 | 1,200 | 10 | 1,000 | 20 | Priority, 99.9% SLA |
| Enterprise API / OEM | Starting at$2,500 | Custom | Custom | Custom | Custom | Custom | Dedicated, negotiated SLA |
Request API access
Alerts also go out through a bearer-key REST API and signed customer webhooks.
Enterprise and Enterprise API / OEM are agreed by contract. Every other plan can be billed month to month.
07 / 08
Frequently asked questions
The questions we are asked most, answered plainly.
Q.01Can I search for any email address?
No, by design. Monitoring covers domains you have proven you own and individuals who have been enrolled with a lawful basis. There is no open lookup, so the service cannot be turned into a people-search tool.
Q.02Will you show me the leaked passwords?
No. We tell you that a password was exposed, whether it was plaintext or a hash, and what to do about it. The value is never stored, displayed, logged or sent to an AI model.
Q.03Where does the data come from?
From approved surface-web and Tor sources read by a policy-controlled crawler. Two different people review and approve every source before it is switched on. We do not buy data, log in to restricted forums or follow links to unapproved sites.
Q.04How do you monitor staff lawfully?
Domain-level monitoring needs only proof that you own the domain. Personal identifiers such as phone or ID numbers need each person enrolled under consent, an employee programme or a contract, with an evidence reference. Withdraw someone and monitoring stops immediately and their data is deleted. You remain responsible for staff notice where the law requires it.
Q.05How is AI used?
To read and explain findings, never to decide them. Models run on our own infrastructure, so your data is not sent to a third-party AI service. Their input is stripped of identifiers, and anything uncertain goes to an analyst.
Q.06Is there a contract?
Not on the standard plans: pay month to month, or annually if you prefer. Enterprise and Enterprise API / OEM are agreed by contract. See plans and pricing.
08 / 08
Find leaks first.
Book a briefing. We will walk through your domains, what monitoring would cover and how alerts reach your team.
Email[email protected]
Phone0273510488
We respond within 15 minutes during business hours (9am-5pm NZST)