What you get · The External Cybersecurity Assessment

Every way in we find, with its evidence, the exact fix and a record of when it closed.

Each way in is re-checked until it is closed. A dated record says when it closed. In writing, that is the evidence and the exact fix for every finding, three documents and a dated record. A first month of the watch comes with it. Each item below, with its limits.

Check my firm How it works

No loginNo installNo mailbox accessOne dated record

At a glance

Delivered: Inside 72 hours
Before release: Read by a person
Re-checked: Until closed
Replies: 4 business hours

01 · The documents

Three documents and a dated record.

It is not a certification, not a penetration test, not legal or compliance advice and not a statement about your internal systems.

Owner Summary and Action BriefThe verdict, the fixes in order and what each one closes.

Technical Evidence and FindingsEvery finding with its evidence and the check that proves the fix.

Rules and Insurance BriefingFor counsel and your insurer: your findings beside the privacy and sector rules that apply and the insurer questions an outside read can answer.

Assessment RecordA dated record of what was read from outside and found, verified by a person at LeakTrace before release. Not a certification.

02 · Every finding

The evidence, the exact fix and the check that proves it.

EvidenceEvery finding comes with its evidence, its date and a check anyone can run again, your insurer included.

A deeper read of your websiteUp to 30 of your site's most telling pages, read the way an attacker's tools read them: your sign-in pages, forms that send what visitors type in the clear, keys printed in the site's own code, the addresses where private files are sometimes left and every plugin and script that reports its version, matched to public records of known flaws. A visit only: nothing is typed and no password is tried. On monitoring, read again every night. We read your own website for hidden instructions planted for AI assistants: text your visitors cannot see, written to make AI tools repeat a fake payment change or vouch for a fake sender. We read your site the way an attacker's AI does, before it does.

Domains in your people's namesFrom the people your own website names, we look for domains registered in their names, such as a partner's name with your line of work. We tell you which ones are live or set up for email, with the steps to warn your clients and have it taken down.

The exact fixEach fix comes as exact steps, in order, with the check that proves it is done. Each one says where the change is made: your DNS settings, your web host, your registrar account.

Forged emailOne click per step. No code, no password shared. You approve each step with one click: reporting first, then refusing forged email, about four weeks in all, re-checked from outside at every step. Where we cannot reach your DNS host, you get the exact record to paste.

Re-checked until closedWe re-check it from outside when you mark it done, every day through your first month of monitoring and every night after that until our re-check confirms it closed. Where a finding cannot be confirmed from outside, your assessment says so on that finding and records your confirmation.

Takedown requests, sent in your nameWhere your assessment lists a live look-alike of your firm's name and you tell us it is not yours: the registrar's abuse contact where the public record gives one, the evidence and a letter in your firm's name. With your permission we can send the requests to the registrar and the host in your firm's name and follow them up for 90 days: that is the look-alike response. It covers every live look-alike set up for email or copying your site in your reading and you can add it to the assessment; monitoring includes up to 6 a year. The registrar decides what happens; a domain set up only for email may fall outside its abuse rules.

Read by a personYour assessment arrives inside 72 hours of payment confirmation. A person checks it before it is released and we email you the moment it is ready.

03 · After delivery

The watch, from the day it is released.

Your first monthThe assessment includes your first month of monitoring: the watch starts the day the assessment is released and nothing renews on its own.

The watchThe watch re-reads your email settings every 5 minutes and sees new certificates for your domain and for look-alikes of your name within minutes of being logged and alerts you within minutes when one changes. New look-alike registrations are looked for every hour. Everything else is re-checked every day, with the fix for anything new.

Each change, datedOn monitoring the same checks run again after that date. Each change found is recorded with its date.

Takedown requestsTakedown requests sent to the registrar and the host in your firm's name on your permission, followed up until they answer and re-checked from outside.

Suppliers we watchName up to ten suppliers or clients and we look for new look-alikes of their domains and email you the day one worth a look appears.

The call-back sheetThe main or accounts number each of them publishes on its own website, read again every night, so a change of bank details is confirmed by calling a number you already hold.

Fake apps and job adsWe look in the app stores and on the job sites for an app or an ad that uses your firm's name but is not yours. A person at LeakTrace checks each one before you see it. We give you the steps to have it removed.

The inside checklistA few things for your own people to check in their own email accounts, on your schedule, each answer recorded with its date. We never access your mailboxes or systems.

The insurer packOne download for your broker or insurer: your Assessment Record, the Rules and Insurance Briefing and every fix confirmed closed from outside, each with its date.

A recorded walkthroughA short video of your page, made when your assessment is released, that shows where each fix, document and setting is.

04 · When you write to us

We reply within 4 business hours.

Write to [email protected] about anything in your assessment or your reading. Business hours are 9 to 5 Eastern, weekdays.

When we refundYour assessment will show more than your outside reading. If it does not, we refund it in full. Ask within 14 days of delivery: write to [email protected] with your reference.

If it is lateIf it is not released inside 72 hours, you are told the new time and can have a full refund on request until it is released.

05 · What we do not do

Who LeakTrace is not for.

LeakTrace is for a firm that wants to know what it shows the internet, with the proof for each finding and to see each way in closed. It is not the right choice for these.

Read the outside reading policy.

Someone working inside your systemsWe hold no keys to your firm. No login, no install, no mailbox access. LeakTrace stands where the attack begins. It reads what your firm shows the internet the way an attacker reads it, never what is behind it.

A penetration testWe test nothing, exploit nothing and try to get past nothing. An assessment is a dated reading of your firm, with the evidence for every finding.

Every change made for youWe give you the fix for each finding and re-check from outside until it is closed. The one change we can make ourselves is to your email records and only when you approve each step, where your DNS host allows it.

An IT providerIt does not replace an IT provider. It is an independent reading of your firm, paid for by no one who sells the fixes.

Personal accountsIt reads your firm's own domain and the addresses at it from outside, the way an attacker's tools would. It does not read inside your network or your staff's personal email accounts.

Check my firm

See what your firm shows the internet, without handing over a key.

Your domain and a work email at it. No password, no login and no software. Read-only and sent only to your work email.

Check my firm