Trust & Evidence
Trust should rest on things you can check. Here is what we can evidence — and, just as importantly, what we do not claim.
Industry Standards & Compliance
SOC 2-Aligned Controls
Our systems and processes are built around the SOC 2 trust criteria for security, availability and confidentiality. Enterprise buyers can request our current control documentation under NDA during procurement.
GDPR & Data Protection
Client and investigation data is handled under GDPR principles — lawful basis, data minimisation and defined retention. A data processing agreement is available on request.
ISO 27001 Aligned
Information security management practices aligned with international standards.
What You Can Hold Us To
Evidence should be checkable. These are commitments you can verify against our reporting rather than figures you have to take on faith.
Evidence with every case
Each detection and takedown we report comes with the underlying evidence — URLs, screenshots, registrar and host, and the timestamps of what we sent and when. You can audit any case we bill you for.
Response targets in writing
Acknowledgement and escalation times are agreed in your engagement terms rather than advertised as an average. If we miss a target, it is visible in the same reporting.
Honest about what we cannot do
Takedown depends on registrars, hosts and registries we do not control. We tell you when a case is likely to stall, and what the realistic alternatives are, instead of promising a success rate no provider can guarantee.
Your data stays yours
Investigation data is handled under the terms in our privacy policy, with a data processing agreement available on request and defined retention periods.
How Takedowns Actually Reach the Right Desk
Removing a malicious site means getting evidence to whoever controls the domain, the hosting, or the payment path. These are the channels we work through.
Registrar abuse channels
Every gTLD registrar is required by its ICANN accreditation to publish and act on an abuse contact. We file evidence-backed reports through those channels and escalate to the registry when a registrar does not act.
Hosting & CDN abuse desks
Where the content sits with a hosting provider or CDN, the fastest route is usually their abuse desk. We know what each one needs to see in a report to act on it quickly.
Industry reporting bodies
Phishing URLs are submitted to the anti-phishing clearinghouses and browser blocklists that feed Safe Browsing and similar protections, so victims are warned even before a site comes down.
When it becomes a police matter
Some cases — organised fraud, extortion, large-scale counterfeiting — need law enforcement. We prepare the evidence package your legal team or counsel needs to make a referral in your jurisdiction.
See Our Work in Action
Explore real-world examples of how we've protected organizations from digital threats.
View Case Studies