Zero access · For professional firms

Security that never needs the keys to your firm.

We hold no keys to your firm. No login, no install, no mailbox access. We read your firm from outside, the way an attacker does, find each way in first, and check again from outside until it is closed.

Check my firm How it works

No loginNo installNo mailbox accessOne dated record

What we hold of your firm

Passwords to your systems: None
Software on your machines: None
Mailboxes we open: None
Standing access of any kind: None

01 · The proof

Access to many firms is one door to all of them.

A login that reaches many firms is worth more to an attacker than any one firm behind it. Break in once and every firm on the other side is in reach.

Government cyber agencies in Canada, the US, the UK, Australia and New Zealand warned in a joint advisory that threat actors use a provider as "an initial access vector to multiple victim networks." So we built LeakTrace to hold no access at all.

Source: joint cybersecurity advisory AA22-131A, 11 May 2022, CISA, NSA and FBI with the Canadian Centre for Cyber Security and the national cyber centres of the UK, Australia and New Zealand. Read the advisory.

02 · What we hold

Nothing of yours to steal from us.

PasswordsNone. No password, no login and no account in your systems. We keep no key of yours for anyone to steal.

SoftwareNone. No software on your machines and no agent on your network. Nothing runs inside your firm.

MailboxesNone. We read your email settings from outside, where every mail server reads them. Your messages stay yours.

What we readWhat anyone can see of your firm on the public internet: your email settings, your website, look-alike domains, your firm's addresses in monitored breach databases, and public records.

03 · The one change, on your approval

One click per step. No code, no password shared.

We give you the fix for each finding and re-check from outside until it is closed.

The one change we can make ourselves is to your email records, and only when you approve each step, where your DNS host allows it.

You approve each step with one click: reporting first, then refusing forged email, about four weeks in all, re-checked from outside at every step.

Where we cannot reach your DNS host, you get the exact record to paste.

No key is kept afterwards.

04 · What we do instead

Security you can check. Not security you take on trust.

Keys to your firmWe read what your firm shows the internet, and nothing behind it. We hold no key of yours.

A score with no proofEvery finding comes with its evidence and its date, and a check anyone can run again, your insurer included.

A one-time lookWe check again from outside when you mark a fix done, every day through your first month of monitoring, and every week after that until it is closed.

Inside your firmWhere something is not visible from outside, your own people confirm it. The inside checklist is your own team's check, on your schedule: we never access your mailboxes or systems, and a completed checklist is your team's confirmation, not something we verified.

05 · What we never touch

Read-only means read-only.

Every limit is written down in the outside reading policy.

Read the outside reading policy.

NoA login to your systems
NoSoftware on your machines
NoYour mailboxes or your messages
NoTesting, exploiting or trying to get past anything
NoContact with your staff
NoA change without your approval

Check my firm

See what your firm shows the internet, without handing over a key.

Your domain and a work email at it. No password, no login and no software. Read-only, and sent only to your work email.

Check my firm