| Question | Answer | What the record shows |
|---|---|---|
| Does your domain enforce DMARC at quarantine or reject? | Not yet | DMARC is published at p=none: forged mail is reported, not refused. At your assessment (30 September 2026): no DMARC record is published. At the latest check: a DMARC record is published at p=none (reports only; forged mail is not refused). |
| Do you publish an SPF record listing the servers allowed to send your mail? | Partly | SPF record published. |
| Is outgoing email signed with DKIM? | Not confirmed | DKIM signing couldn't be confirmed from outside (default, selector1, selector2, google, s1, s2, k1, mxvault). A key on another name is not visible from outside. Read at your assessment on 30 September 2026; the latest re-check did not answer. |
| Do you require multi-factor sign-in for email and remote access? | Not visible from outside | Whether a second sign-in step is enforced cannot be seen from outside. We found no public sign-in page on the parts of the site we read. 14 firm addresses are present in monitored breach databases; a second step stops a leaked password being enough on its own. |
| Are staff email addresses clear of known breach data? | Not yet | 14 firm addresses at harbourview-llp.example are present in monitored breach databases. |
The outside questions cyber insurance applications commonly ask, each with its evidence. Each row is what anyone can see of your firm from outside, with the proof under it. Questions about what happens inside your firm are marked "Not visible from outside": those are answered from inside your firm. You and your broker answer the application; the insurer makes its own decision.
26e156945c2c55fcbd6fb1ab4fd324e92ab610aad5cc4e775a49eaaf39b35537. Anyone can check it at getleaktrace.com/verify/ with the reference and the file. This summary reads only what can be seen from outside your firm; it is not a certification. The insurer makes its own decision.