- 1Nothing tells mail servers to refuse email forged in your name
- 21 domain made from your firm's name was registered on 5 September 2026, is set up to send and receive email and has no website. We cannot tell from outside who owns it. Is it yours?
- 33 addresses on your domain are present in monitored breach databases
Seen 7 Oct 2026: Arizona court system, reached through email made to look like it came from a trusted sender. The same way in is open on your domain: nothing tells mail servers to refuse email forged in your name (opening 1).
A gap like this is usually a default nobody was asked to change.
External Cybersecurity Assessment of harbourview-law.example
It reads your firm's own domain and the addresses at it from outside, the way an attacker's tools would. It does not read inside your network or your staff's personal email accounts.
Each fix comes as exact steps, in order, with the check that proves it is done. We re-check it from outside when you mark it done, every day through your first month of monitoring, and every week after that until our re-check confirms it closed. Where a finding cannot be confirmed from outside, your assessment says so on that finding and records your confirmation.
Three documents and a dated record.
- 1Owner Summary and Action BriefFor the owners
- 2Technical Evidence and FindingsThe evidence and the exact fix
- 3Rules and Insurance BriefingPrivacy rules and insurer questionsSets your findings beside the privacy and breach-notice rules for Canada or the United States, and beside the sector rule where one is named: law, health, accounting, and financial and wealth firms. Most technical findings fall under one safeguards rule. Then the questions insurers ask at renewal that an outside read can answer. It is not legal advice.
- 4Assessment RecordDated record, issued by LeakTrace Inc.A dated record of what was read from outside your firm, verified by a person at LeakTrace before release. LeakTrace Inc. issues it as a company, with a reference and a fingerprint anyone can check at getleaktrace.com/verify/. No individual signs it. It is not a certification, not a penetration test, not legal or compliance advice, and not a statement about your internal systems.
Human-verified: every finding is verified by a person at LeakTrace before release. After delivery you get a recorded walkthrough of your own dashboard: a short video of your page that shows where each fix, document and setting is.
Your clients ask an AI assistant how to pay you. It answers in your name. We check what it says against your own website as part of the paid assessment.
The inside checklist: a few things for your own people to check in their own email accounts, on your schedule, each answer recorded with its date. We never access your mailboxes or systems.
The first month of monitoring: your domain and staff addresses watched continuously for 30 days (email settings, look-alikes and new host names hourly, the rest daily), with a same-day alert if anything new appears.
Supplier watch: name up to five suppliers or clients, and we look for new look-alikes of their domains and email you the day one worth a look appears.
A call-back sheet: the main or accounts number each of them publishes on its own website, read again every week, so a change of bank details is confirmed by calling a number you already hold.
The insurer pack. One download for your broker or insurer: your Assessment Record, the Rules and Insurance Briefing, and every fix confirmed closed from outside, each with its date.
A takedown request, drafted. Your reading lists a domain made from your firm's name. If you tell us it is not yours, your assessment includes a takedown request to its registrar: the registrar's abuse contact where the public record gives one, the evidence, and a letter in your firm's name, drafted for you or your lawyer to send. We do not send it, and the registrar decides what to do.
From the moment you pay: your assessment is built from our outside read of your firm, then held until a person has read it.
It is released to you human-verified, inside 72 hours of confirmation. On release your dashboard opens with your AI security agent on it, and your first month of monitoring starts.
Once you have paid, AI also chooses follow-up checks, picks when to re-check from outside, and sorts new changes by which needs you first.
If the AI fails or reaches its limit, the fixed path runs as it did before.
Your assessment comes with your AI security agent, on your dashboard. Ask it a question in plain English and it answers from your own firm's findings, and names the finding it used.
It drafts a note about any finding, for you to send. It proposes a re-check and runs it only when you approve.
Your dashboard shows what our AI agents checked without being asked, and tells you when a re-check finds an opening closed. When it cannot answer, a person replies.
Our AI agents work from outside only. They never log in, never install anything, and never touch your internal systems.
The one change they can make, to your email records, happens only when you approve it.
Delivery. Inside 72 hours of payment confirmation, verified by a person at LeakTrace before release. If it is not released inside those 72 hours, we tell you the new expected time, and from then until it is released you can reply and we refund it in full; once it is released, the ordinary refund rule applies.
When we refund. Your assessment will show more than your outside reading. If it does not, we refund it in full. Ask within 14 days of delivery: write to [email protected] with your reference. Once it has shown you more than the reading did, the work is done and it is not refundable. All sales are final except as the refund policy states. Refund policy