What you get · The External Cybersecurity Assessment

Exactly what you receive, in writing.

Three documents and a dated record, the evidence and the exact fix for every finding, a re-check until each one is closed, and a first month of the watch. Each item below, with its limits.

Check my firm How it works

No loginNo installNo mailbox accessOne dated record

At a glance

Delivered: Inside 72 hours
Before release: Read by a person
Re-checked: Until closed
Replies: 4 business hours

01 · The documents

Three documents and a dated record.

It is not a certification, not a penetration test, not legal or compliance advice, and not a statement about your internal systems.

Owner Summary and Action BriefThe verdict, the fixes in order and what each one closes.

Technical Evidence and FindingsEvery finding with its evidence and the check that proves the fix.

Rules and Insurance BriefingFor counsel and your insurer: your findings beside the privacy and sector rules that apply, and the insurer questions an outside read can answer.

Assessment RecordA dated record of what was read from outside and found, verified by a person at LeakTrace before release. Not a certification.

02 · Every finding

The evidence, the exact fix, and the check that proves it.

EvidenceEvery finding comes with its evidence and its date, and a check anyone can run again, your insurer included.

The exact fixEach fix comes as exact steps, in order, with the check that proves it is done. Each one says where the change is made: your DNS settings, your web host, your registrar account.

Forged emailOne click per step. No code, no password shared. You approve each step with one click: reporting first, then refusing forged email, about four weeks in all, re-checked from outside at every step. Where we cannot reach your DNS host, you get the exact record to paste.

Re-checked until closedWe re-check it from outside when you mark it done, every day through your first month of monitoring, and every week after that until our re-check confirms it closed. Where a finding cannot be confirmed from outside, your assessment says so on that finding and records your confirmation.

A takedown request, draftedWhere your assessment lists a look-alike of your firm's name and you tell us it is not yours: the registrar's abuse contact where the public record gives one, the evidence, and a letter in your firm's name, drafted for you or your lawyer to send. We do not send it, and the registrar decides what to do.

Read by a personYour assessment arrives inside 72 hours of payment confirmation. A person checks it before it is released, and we email you the moment it is ready.

03 · After delivery

The watch, from the day it is released.

Your first monthThe assessment includes your first month of monitoring: the watch starts the day the assessment is released, and nothing renews on its own.

The watchThe watch re-reads your email settings, look-alike domains and new host names every hour, and alerts you within the hour when one changes. Everything else is re-checked every day, with the fix for anything new.

Each change, datedOn monitoring the same checks run again after that date, and each change found is recorded with its date.

Suppliers we watchName up to five suppliers or clients, and we look for new look-alikes of their domains and email you the day one worth a look appears.

The call-back sheetThe main or accounts number each of them publishes on its own website, read again every week, so a change of bank details is confirmed by calling a number you already hold.

The inside checklistA few things for your own people to check in their own email accounts, on your schedule, each answer recorded with its date. We never access your mailboxes or systems.

The insurer packOne download for your broker or insurer: your Assessment Record, the Rules and Insurance Briefing, and every fix confirmed closed from outside, each with its date.

A recorded walkthroughA short video of your page, made when your assessment is released, that shows where each fix, document and setting is.

04 · When you write to us

We reply within 4 business hours.

Write to [email protected] about anything in your assessment or your reading. Business hours are 9 to 5 Eastern, weekdays.

When we refundYour assessment will show more than your outside reading. If it does not, we refund it in full. Ask within 14 days of delivery: write to [email protected] with your reference.

If it is lateIf it is not released inside 72 hours, you are told the new time and can have a full refund on request until it is released.

05 · What we do not do

Who LeakTrace is not for.

LeakTrace is for a firm that wants to know what it shows the internet, with the proof for each finding, and to see each way in closed. It is not the right choice for these.

Read the outside reading policy.

Someone working inside your systemsWe hold no keys to your firm. No login, no install, no mailbox access. We read what your firm shows the internet, the way an attacker reads it, and nothing behind it.

A penetration testWe test nothing, exploit nothing and try to get past nothing. An assessment is a dated reading of your firm, with the evidence for every finding.

Every change made for youWe give you the fix for each finding and re-check from outside until it is closed. The one change we can make ourselves is to your email records, and only when you approve each step, where your DNS host allows it.

An IT providerIt does not replace an IT provider. It is an independent reading of your firm, paid for by no one who sells the fixes.

Personal accountsIt reads your firm's own domain and the addresses at it from outside, the way an attacker's tools would. It does not read inside your network or your staff's personal email accounts.

Check my firm

See what your firm shows the internet, without handing over a key.

Your domain and a work email at it. No password, no login and no software. Read-only, and sent only to your work email.

Check my firm