Business
For firms
External Exposure Check External Cybersecurity Assessment Monitoring Signed assessment record See it first How we use AI
By problem
Forged invoices Staff in breach records Email anyone can fake Look-alike domains Insurance renewal Confidentiality rules
By sector
Law firms Accounting practices Dental and health clinics Financial advisers Insurance and mortgage brokers Real estate brokerages Trades and contractors Studios and wellness Restaurants and hospitality All sectors
Individual
Free address check Personal Exposure Briefing First three steps Check my address
Partners
Partner types
IT providers Accountants and bookkeepers Insurance brokers Associations Insurers Referral partners
Programme
How it works Become a partner Partner portal
Intelligence
Learn
Articles Weekly briefing Glossary Threat patterns
Research
Research reports Disclosure tracker Rules and frameworks
Tools
Free address check Email spoofing check Verify a record
Help
Help centre Questions and answers Contact
How we work
About
About us Careers Contact
How we work
Methodology What we never do Trust centre How we use AI
Legal
Privacy Terms Refund policy
Sign in Check my firm
See it first

What you get, before you commit.

For a firm, the External Exposure Check and the External Cybersecurity Assessment it leads to. For a person, the free address check and the Personal Exposure Briefing after it.

What you get

What arrives, and what we never need.

72 hFrom confirmation to the delivered assessment, reviewed by a person
DailyThe watch re-checks after delivery, and you hear it from us first
0Log-ins, installs or access to your systems

Read-only, from outside, from public sources only.

For firms

An outside view of your domain.

The External Exposure CheckYour outside reading: four openings anyone can see, and a check you can run yourself. Free.
The External Cybersecurity Assessment addsThe full outside watch on your firm, the proof for every finding, and the fix. Approved by a person, inside 72 hours of confirmation.
Check my firm
For individuals

Is your address in a public breach?

The free address checkBreach records for one email address, and an optional phone number.
The Personal Exposure Briefing addsThe full picture, and the order to fix it.
Check my address
Instant preview

Here’s what anyone can already see about your firm.

Attackers use AI to find openings. We use it to find yours first, and a person checks every finding before you see it.

The rules that apply to you · Canada and the United States

One site for both countries. Each finding is mapped to the rule where your firm is.

United States

FTC Safeguards Rule: tell the FTC within 30 days.

Tax preparers, mortgage brokers and other financial institutions notify the FTC no later than 30 days after discovering a breach of 500 or more people.

Source: FTC, Safeguards Rule guidance.

Law
GLBA Safeguards Rule, 16 CFR 314
Regulator
Federal Trade Commission, and your state attorney general
Checkout currency
US dollars (USD)

Canada

PIPEDA: report a breach as soon as feasible.

Report to the Privacy Commissioner when a breach creates a real risk of significant harm, and keep a record of every breach for 24 months.

Source: Justice Laws Website, PIPEDA.

Law
PIPEDA s. 10.1
Regulator
Office of the Privacy Commissioner of Canada
Checkout currency
Canadian dollars (CAD)
A short video, and the 72 hours

See how a finding is explained, and how the 72 hours run.

What a finding looks like

Captions on, no sound. Illustrative finding; no firm is shown.

Read the transcript
  1. p=none. Anyone can send email in your name.
  2. A public DNS record for a firm: its email authentication setting.
  3. The setting that fails: p=none. Email in the firm's name can be forged.
  4. p=none is monitor mode. Mail servers are told to report a forgery, not to stop it.
  5. Delivered in your firm's name: a forged invoice, a fake payment instruction, a request for client records.
  6. The fix in three steps: read the reports, move to quarantine, then reject.
  7. Forged mail refused. Your own email still delivered. One public record changed.
  8. 8 in 10 professional firms cannot stop an email sent in their name.
  9. One finding, read from outside. Every finding at your firm, in one assessment.

How the 72 hours run

From confirmation to delivery, nothing installed and nothing logged into. Captions on, no sound.

Read the transcript
  1. 72 hours. One domain. Nothing to install.
  2. What happens in the 72 hours of an External Cybersecurity Assessment.
  3. You confirm the scope: one domain, your firm's. Nothing to install, no access to give.
  4. We read what anyone can see from outside: mail records, look-alike domains, staff addresses in monitored breach databases, website software, sign-in pages. We log into nothing.
  5. A person checks every finding and approves the release. Each one comes with a check anyone can run.
  6. Three documents and a signed summary: the Owner Summary, the Technical Evidence for your IT provider, the Rules and Insurance Briefing, and the Signed Assessment Record.
  7. Your IT provider gets the exact fix for each finding; we re-check until it is closed. A 10-minute walkthrough, and the first month of monitoring, are included.
  8. Inside 72 hours of confirmation.

Link to these videos: getleaktrace.com/see-it-first/

How it works

What this page will never show
  • A real client's documents, dashboards or names
  • Testimonials or logos
  • Prices