LeakTrace
Sign in Check my firm
The external layer, then the fix
External Exposure CheckThe ways in an attacker sees on your firm today, with the proof for the lead finding External Cybersecurity AssessmentEvery way in we find, the proof for each and the fix, human-verified inside 72 hours MonitoringEvery hour for email settings, look-alikes and new host names, every day for the rest, told the same day Dated assessment recordThe page your insurer and clients can check See it firstWhat you get, before you commit How we use AIAI-driven. Human-verified.
Start from what worries you
Forged invoicesProtect against fake payment requests sent in your name Firm addresses in breach recordsWhich addresses, which breach, what to change Email anyone can fakeThe settings that refuse forged mail Look-alike domainsDomains made from your firm’s name Insurance renewalAnswer the questions insurers now ask Confidentiality rulesWhat your regulator expects you to show
By sector
Law firmsClient confidentiality, trust accounts and closing funds Accounting practicesTax data, portals and forged invoices at filing time Dental and health clinicsPatient records and booking systems Financial advisersClient money, identity and account changes Insurance and mortgage brokersClient files and payment instructions Real estate brokeragesClosing-day wire changes and deposit fraud Trades and contractorsQuotes, invoices and deposits by email Studios and wellnessBooking accounts and card details Restaurants and hospitalityOrdering, payroll and supplier email All sectorsEvery sector page and what it covers
Zero access. Every assessment human-verified.Check my firm
Offer the assessment to your own clients
IT providersFindings with evidence and fix steps your team can act on Accountants and bookkeepersA reason to talk to clients about invoice fraud Insurance brokersEvidence for renewal, in the insurer’s terms AssociationsA reading for every member at once InsurersA portfolio view across the firms you cover Referral partnersIntroduce a firm and we handle the rest
How the programme works
How it worksYour brand on the covers, our reading inside Become a partnerApply in five minutes Partner portalSign in to your clients and their findings
Zero access. Every assessment human-verified.Become a partner
Learn
Articles Weekly briefing Glossary Threat patterns
Research
Research studies Disclosure tracker Rules and frameworks
Tools
Request your external reading Verify a record
Help
Help centre Questions and answers Contact
Zero access. Every assessment human-verified.Read this week’s briefing
About
About us Careers Contact
How we work
Methodology What we never do Trust centre How we use AI
Legal
Privacy Terms Refund policy
Zero access. Every assessment human-verified.Read the methodology
For firms
External Exposure CheckThe ways in an attacker sees on your firm today, with the proof for the lead findingExternal Cybersecurity AssessmentEvery way in we find, the proof for each and the fix, human-verified inside 72 hoursMonitoringEvery hour for email settings, look-alikes and new host names, every day for the rest, told the same dayDated assessment recordThe page your insurer and clients can checkSee it firstWhat you get, before you commitHow we use AIAI-driven. Human-verified.
By problem
Forged invoicesProtect against fake payment requests sent in your nameFirm addresses in breach recordsWhich addresses, which breach, what to changeEmail anyone can fakeThe settings that refuse forged mailLook-alike domainsDomains made from your firm’s nameInsurance renewalAnswer the questions insurers now askConfidentiality rulesWhat your regulator expects you to show
By sector
Law firmsClient confidentiality, trust accounts and closing fundsAccounting practicesTax data, portals and forged invoices at filing timeDental and health clinicsPatient records and booking systemsFinancial advisersClient money, identity and account changesInsurance and mortgage brokersClient files and payment instructionsReal estate brokeragesClosing-day wire changes and deposit fraudTrades and contractorsQuotes, invoices and deposits by emailStudios and wellnessBooking accounts and card detailsRestaurants and hospitalityOrdering, payroll and supplier emailAll sectorsEvery sector page and what it covers
Check my firm →
Partner types
IT providersFindings with evidence and fix steps your team can act onAccountants and bookkeepersA reason to talk to clients about invoice fraudInsurance brokersEvidence for renewal, in the insurer’s termsAssociationsA reading for every member at onceInsurersA portfolio view across the firms you coverReferral partnersIntroduce a firm and we handle the rest
Programme
How it worksYour brand on the covers, our reading insideBecome a partnerApply in five minutesPartner portalSign in to your clients and their findings
Become a partner →
Learn
ArticlesWeekly briefingGlossaryThreat patterns
Research
Research studiesDisclosure trackerRules and frameworks
Tools
Request your external readingVerify a record
Help
Help centreQuestions and answersContact
Read this week’s briefing →
About
About usCareersContact
How we work
MethodologyWhat we never doTrust centreHow we use AI
Legal
PrivacyTermsRefund policy
Read the methodology →
Sign in Check my firm 3 in 4of the professional firms we read have no published rule telling mail servers to refuse mail forged in their name.LeakTrace index, readings to 8 October 2026Read the index →
Zero accessNot a pen testHuman-verified

Version 2026-11-04.1

LeakTrace Core Partner Agreement

Release OS-1, Partner Readings. Between LeakTrace Inc., a corporation of Ontario, Canada ("LeakTrace") and the organisation that accepts it ("the Partner").

1. What LeakTrace Core is

LeakTrace Core is the LeakTrace reading engine, offered as a metered API. Partners build their own products on it, under their own client relationship and their own compliance. A reading is made from public records and ordinary page visits on the date it states. LeakTrace never accesses a system of the firm read. A reading is evidence of what was published on that date. It is not a certification of the firm.

2. The Partner's own compliance

The Partner uses each reading under its own client relationship and its own compliance. The Partner is responsible for the laws that apply to its own messages and products, including Canada's anti-spam legislation (CASL) and the US CAN-SPAM Act. Where the Partner reads a firm with which it has no relationship, the Partner first holds that firm's consent to the reading and to the use the Partner makes of it.

3. No cold use

The Partner does not use a reading to open an unsolicited commercial message to the firm read, or to anyone at it. A reading may support a conversation the firm has asked for or already holds with the Partner.

4. No resale of raw readings

The Partner may show a reading, or what it builds from it, to its own clients inside its own product. The Partner does not sell, license or pass on raw readings, in bulk or one by one, to anyone for use beyond the Partner's own product.

5. Customer secrecy

Every firm is read fresh, the same way, with the parts only a paying firm sees left out. A reading reveals nothing about who buys from LeakTrace. The Partner does not try to learn that from LeakTrace Core. The Partner does not say or imply to anyone whether a firm buys from LeakTrace.

6. The metered price list

Each reading is charged per reading, in US dollars, from the price list below as read from LeakTrace's price table when the Partner accepts this agreement. The price list accepted is stored with the acceptance. Each reading keeps the price it was charged at. A new price list applies to the Partner only after it accepts a later version of this agreement.

DepthPrice a reading
First stage$15
Full reading$90
Dated record$450

Readings are drawn from a prepaid block of at least $2,500, invoiced in US dollars. Each price is per reading, in US dollars. A reading that is not made is not charged.

7. Blocks, invoices and refunds

LeakTrace invoices each block through its payment service. A block is available once the invoice is paid. A reading is drawn from the balance when it starts. A reading that is not made is credited back in full. When this agreement ends, LeakTrace refunds the unused balance of any paid block within 30 days, to the payment method that paid it.

8. Keys and limits

LeakTrace issues the Partner a sandbox key that reads the demonstration records only. LeakTrace also issues live keys for metered readings. The Partner keeps its keys secret and is charged for readings started with them. Each key may make 30 requests a minute. A live partner may start 250 metered readings a Toronto day. The sandbox answers 100 a day. LeakTrace's own domains are not read through LeakTrace Core. A domain on LeakTrace's do-not-assess list, or of a firm that asked not to be read, is not read and is not charged.

9. What LeakTrace does not promise

Every finding carries its evidence. The way we find it stays with us. Where a look-alike domain is taken down, the registrar decides. LeakTrace does not promise that a reading finds every weakness. LeakTrace's liability under this agreement is limited to the amounts the Partner paid in the 12 months before the claim.

10. Ending the agreement

Either party may end this agreement by written notice. LeakTrace may end it at once and switch off the Partner's keys if the Partner breaks section 2, 3, 4 or 5. Sections 4, 5 and 7 survive the end of the agreement.

11. Changes

LeakTrace publishes each new version of this agreement with a new version line. A version applies to the Partner once the Partner accepts it. Ontario law governs this agreement.

LeakTrace

Zero-access security intelligence. We find each way in, prove it with evidence anyone can re-run, give the exact fix and re-check until it is closed.

Services External Cybersecurity Assessment Partners Networks
Intelligence Research Weekly briefing Disclosure tracker Glossary The LeakTrace index
How we work See it first What you get Methodology Email security guides Our AI agents Our own reading Claims ledger Trust centre Verify a record
Company Why LeakTrace Attacks of 2026 About Reviews Contact Privacy Security Data commitment Terms Refund policy Data processing agreement Cookie policy
© 2026 LeakTrace Inc. [email protected]

LeakTrace provides independent external cybersecurity assessments for firms of any size, as informational documents only. We are not a law firm or insurance company. Our documents are based on publicly available information and monitored breach databases and do not constitute legal, financial, or security advice. No service can completely eliminate the risk of identity theft, data breaches, or cyber fraud. LeakTrace makes no guarantees of prevention, detection, or recovery of losses.