Questions and answers.
Zero-access security intelligence, answered. What we check, the evidence behind each finding and how it gets fixed: 27 short answers about LeakTrace and the External Cybersecurity Assessment, each true as written.
What does LeakTrace do?#
LeakTrace provides independent external cybersecurity assessments for firms of any size. It reads a firm externally the way an attacker’s AI tools do and shows what a stranger would find first:
- whether email can be sent in the firm’s name and delivered
- whether the firm’s addresses appear in monitored breach databases
- whether documents or admin pages answer a stranger
- whether lookalike domains have been registered
Each finding carries the change that closes it. It is read-only and every paid assessment is human-verified before release. You get the exact fix for each finding, step by step. We re-check until each one is closed.
LeakTrace Inc. (getleaktrace.com) is not affiliated with the water leak detection companies that share the name.
When was LeakTrace founded and how does it publish?#
LeakTrace Inc. was incorporated in Ontario on 21 October 2024 and launched in 2025. Its founder is Matt Sherzay of Toronto. Findings are published under the LeakTrace name and name no client. The company facts are on the company page.
Who does LeakTrace serve?#
Firms of any size, such as law, accounting and wealth firms, with the people who run them and their households. It suits any firm that wants an independent external reading before an insurance renewal, a client questionnaire or a regulator asks.
Is LeakTrace a Canadian or American company?#
LeakTrace Inc. is an independent firm with its mailing address in Toronto. Its application and database are hosted in the United States. The Rules and Insurance Briefing maps findings to the rules that apply where the firm operates.
How does the External Cybersecurity Assessment work?#
You ask and we show you first what attackers can see about your firm, with a check you can run: your external reading. If it is worth going further, you order the assessment: the full external watch on your firm, the proof for every finding and the fix.
It reads the public exposure surface (breach records, email authentication records, registration data and certificate logs, your website's own code and public search results).
Every assessment is human-verified before it is released, inside 72 hours of confirmation, with a private dashboard, a recorded walkthrough of that dashboard and the first month of monitoring.
After that the watch continues: email settings, look-alikes and new host names hourly, the rest daily and you hear from us first, the same day, when something new appears.
What sources does LeakTrace read?#
Public and observable signals only:
- monitored breach databases
- mail records, domain registration data and certificate-transparency logs
- publicly reachable services
- your website's own code and public search results
- published business and registry records
Does LeakTrace hack into anything?#
No. LeakTrace is not a pen test: nothing attacked, nothing installed, no access given. It reads only public and observable signals.
There is no unauthorised access, no exploitation of private systems and no interception of communications. Where there is no observable signal, LeakTrace says so plainly rather than trying to get past it.
Does LeakTrace access private accounts, email or devices?#
No. LeakTrace never accesses private email, personal social accounts, messaging systems or personal devices. We read everything a firm shows the public internet and say plainly what cannot be seen externally.
For a household, each adult gives written consent on their own consent page before any of their details are watched.
What is the AI security agent?#
It comes with the assessment, on your dashboard. Ask it a question in plain English and it answers from your own firm's findings and names the finding it used.
It drafts a note about any finding, for you to send and proposes a re-check that runs only when you approve.
It keeps a log of everything it did and when it cannot answer, a person replies. Every paid assessment is still human-verified before release. Our AI agents operate externally.
They never log in, never install anything and never touch your internal systems. They change nothing by themselves: you approve each change to your email records.
What do the AI agents do on a paid assessment?#
On a paid assessment, our AI agents work your firm externally, stage by stage. Every paid assessment is human-verified before release.
- On a paid assessment, the Discover AI agent reads what your firm shows the public internet with fixed checks, records each finding with its evidence and chooses follow-up checks.
- Every finding is kept with the record that proves it. A person reads the assessment before release.
On a paid assessment, the Close AI agent gives you the fix for each finding and, for an email record, sets the steps out with your DNS host's own screens where we hold its guide.
When you mark a fix done, AI chooses when to re-check and only a fresh external read closes it.
On monitoring, fixed checks re-check your email settings, look-alike domains and new host names every hour and everything else every day.
The Monitor AI agent puts first the change that needs you, with a plain reason when it has one.
If the AI fails or reaches its limit, the fixed path runs as it did before.
What can the AI agents never do?#
They never log in to anything of yours, never install anything and never touch your internal systems.
They send nothing in your name: a note about a finding and the request about a look-alike domain are drafted for you to send and a takedown request goes only on your written permission, sent by a person at LeakTrace.
They change nothing on their own. No AI agent can state a finding without a fixed external check behind it and AI cannot change a severity or edit evidence.
The email record, one click per step, works where your domain's DNS is at Cloudflare and you supply a token for that one use. Anywhere else you get the exact record to paste.
Who checks the AI agents?#
A person. Every paid assessment is held until a person has read it and nothing is released on its own: it is human-verified before release.
Your dashboard lists what each AI agent did for your firm, newest first. Every line carries its date and the stage that did it and a closed finding carries the evidence of the re-check.
How much does LeakTrace charge?#
The price of the External Cybersecurity Assessment is stated on your firm's external reading and it is shown again before you pay.
Does LeakTrace publish household pricing?#
No. Household coverage is Perimeter and each Perimeter engagement is scoped per household on a short call. No fee is published.
Is monitoring a subscription?#
Yes. Monitoring is available monthly or annually, with a discount on the annual term. Terms are shown before you pay and you can cancel at any time for future billing periods.
Is LeakTrace SOC 2 certified?#
No. We hold no third-party security certification. SOC 2 is planned; no audit is underway and we would rather say that than imply otherwise.
What is in place today:
- HTTPS with HSTS
- encrypted database backups
- role-based access
- human verification of every paid assessment before release
The security page sets out the rest.
Which rules does the assessment map to?#
The Rules and Insurance Briefing maps each finding to the rules that apply to the firm’s sector and jurisdiction.
Depending on the business, these include:
- In Canada: PIPEDA, Alberta and BC PIPA, plus PHIPA for Ontario health custodians
- In the United States: the FTC Act Section 5, SEC Regulation S-P for SEC-registered advisers and broker-dealers, the FTC Safeguards Rule, HIPAA, state breach notification laws and Massachusetts 201 CMR 17.03
- For law firms: the law society rules or ABA Model Rule 1.6
It names no rule it does not map. It is informational and is not legal advice.
How does LeakTrace handle client confidentiality?#
A mutual NDA is available before any concrete discussion. Access to client data is limited to the staff roles that need it and findings are disclosed only to the client who ordered them. Client identities are not disclosed in any public document.
How long does LeakTrace keep what it holds?#
We keep what we hold until you ask us to delete it. Email [email protected] and we delete it and confirm in writing, except where the law requires us to keep something.
Our payment processor keeps payment records under its own terms. The privacy policy has the detail.
Does LeakTrace replace cyber insurance?#
No. Insurance pays claims after an incident; LeakTrace shows you the external view first so you can close what is open.
The assessment doubles as your insurance renewal evidence pack:
- the external questions insurers commonly ask at renewal, each shown with its evidence
- forged-email protection where we reach your DNS host, one click per step
Its evidence is something an insurer can check.
Does LeakTrace replace a lawyer?#
No. LeakTrace provides source-traced evidence a lawyer can use. Legal advice, letters and filings are for counsel. If you have no lawyer, LeakTrace can introduce one; it does not resell legal services.
Does LeakTrace replace an IT provider?#
No. Your IT provider keeps your systems running. LeakTrace reads your firm externally. It gives you the exact fix for each finding and the check that proves it, then re-checks until it is closed. It is paid by no one who sells the fixes, so every finding is independent.
How do I start?#
For a firm, choose Check my firm at /business/ and we tell you what your domain shows externally, with a check you can run.
For anything else, email [email protected]; a person replies within 4 business hours from a LeakTrace address.
What happens on a scoping call?#
Scoping calls are for household and network programmes. Fifteen to thirty minutes covering scope, the consent each adult or member gives and how often we re-check. There is no pitch deck. If it is not a fit we say so plainly and there is no follow-up.
What is the fastest way to get an assessment?#
Check your firm at /business/. Once you order and confirm, the External Cybersecurity Assessment is delivered inside 72 hours of confirmation: the full external watch on your firm, the proof for every finding and the fix.
Does LeakTrace work with firms in other countries?#
The Rules and Insurance Briefing maps findings to Canadian and US rules. Anywhere else, ask at [email protected] and we will say plainly whether the public signals and the applicable privacy law let us do the work.
Does LeakTrace do incident response?#
No. LeakTrace finds the ways an attacker could get in, closes them and keeps watching; it does not respond to incidents.
When an incident is confirmed, it provides its findings and evidence to your lawyer, insurer or response firm. If you have no response firm, LeakTrace can introduce one; it does not resell the service.
To see what your firm shows externally: Check my firm.