Where we look

All public-source reconnaissance collapses into four quadrants. Each quadrant maps to a distinct class of source, with its own access pattern, verification cost, and decay rate.

Source map · 4 quadrants · evaluated each engagement

We do not purchase data. We do not access accounts without authorisation. Breach corpora are queried on a first-party consent basis — you authorise us to search records associated with your own identifiers, and the raw data is never transferred to you.

How a finding becomes a report

Every entry that appears in a report passes through four sequential gates. Each gate has a published time budget so the schedule is honest before it starts.

Pipeline · 48-hr Snapshot Scan SLA · longer engagements scale per stage

A finding cannot move forward until it clears the gate before it. Discovery is breadth: collect candidate hits across the four quadrants. Cross-reference compares each candidate against at least one independent source. Verification applies confidence scoring; uncertain entries are flagged, not dropped. Report structures findings by category and risk priority, then ships via encrypted channel.

From enquiry to delivery

An engagement is a sequence of four moments. Most enquiries begin at stage one and never need stages three or four — that is a feature, not a defect.

1. Snapshot Scan

   The starting point. A 1-page exposure summary delivered within 48 hours, free of charge. We check public sources, breach databases, people-search platforms, and the data broker surface. If there is nothing significant to report, we say so. If there is, the summary names the categories of exposure and which service, if any, addresses them.

2. Qualification

   After reviewing the Snapshot Scan, you may enquire about a specific service. We respond within 24 hours by email. For straightforward cases we confirm scope and provide payment instructions directly. For larger engagements (Shield, Eraser, Corporate Audit) we move to a written proposal.

3. Proposal

   A written proposal sets fixed scope, fixed price, and fixed delivery timeline. There are no hourly rates and no scope creep. If the engagement requires more than the proposal anticipated, we say so before the work expands; you decide whether to extend.

4. Delivery

   Findings are delivered via encrypted channel on the agreed date. Reports are structured, source-attributed, and ranked by risk priority. Case data is cryptographically deleted within 48 hours of acceptance. There is no automatic upsell at the end of an engagement.

Sample report

A redacted Mirror report illustrates the format. Categories, risk classifications, and source attributions are visible; client identifiers are removed. The asset is in preparation and will replace the placeholder below in a follow-up release.

Verification standard

A finding is included in a report only when it can be attributed to a verifiable source. We do not speculate or infer. If a data point is uncertain, it is marked unverified and flagged for follow-up. Confidence levels are noted for each finding category.

Report structure

Reports are organised by source category (brokers, breaches, social, forums, search-engine, corporate records) and by risk priority (high, medium, low, informational). Each section includes:

• What was found
• Where it was found (source category, not necessarily URL)
• Risk classification
• Recommended action

We do not include raw screenshots of sensitive data unless explicitly requested. Report format is structured text delivered via encrypted channel.

Scope and limitations

An investigation covers what is findable at the time of search. Dark web data in particular is volatile — findings may change between search and report delivery. We document what is present, not what may have existed previously.

We do not:

• Conduct penetration testing or active technical scanning
• Access accounts without authorisation
• Purchase data from brokers or forums
• Retain findings beyond 48 hours of delivery acceptance

Further reading