Questions and answers.
The outside record of trust between businesses, answered. What we check, the evidence behind each finding, and how it gets fixed: 27 short answers about LeakTrace and the External Cybersecurity Assessment, each true as written.
What does LeakTrace do?#
LeakTrace provides independent external cybersecurity assessments for owner-run firms. It reads a firm from outside the way an attacker’s AI tools do, and shows what a stranger would find first:
- whether email can be sent in the firm’s name and delivered
- whether the firm’s addresses appear in monitored breach databases
- whether documents or admin pages answer a stranger
- whether lookalike domains have been registered
Each finding carries the change that closes it. It is read-only, and every paid assessment is human-verified before release. You get the exact fix for each finding, step by step, and we re-check until each one is closed.
LeakTrace Inc. (getleaktrace.com) is not affiliated with the water leak detection companies that share the name.
When was LeakTrace founded, and how does it publish?#
LeakTrace was founded in 2025. The firm publishes institutionally under the LeakTrace name rather than an individual byline, which suits clients who value discretion, such as law, accounting and wealth firms.
Who does LeakTrace serve?#
Owner-run professional firms, such as law, accounting and wealth firms, and the people who run them, including their households. It suits any firm that wants an independent outside reading before an insurance renewal, a client questionnaire or a regulator asks.
Is LeakTrace a Canadian or American company?#
LeakTrace Inc. is an independent firm with its mailing address in Toronto. Its application and database are hosted in the United States. The Rules and Insurance Briefing maps findings to the rules that apply where the firm operates.
How does the External Cybersecurity Assessment work?#
You ask, and we show you first what attackers can see about your firm, with a check you can run: your outside reading. If it is worth going further, you order the assessment: the full outside watch on your firm, the proof for every finding, and the fix.
It reads the public exposure surface (breach records, email authentication records, registration data and certificate logs, your website's own code and public search results).
Every assessment is human-verified before it is released, inside 72 hours of confirmation, with a private dashboard, a recorded walkthrough of that dashboard and the first month of monitoring.
After that the watch continues: email settings, look-alikes and new host names hourly, the rest daily, and you hear from us first, the same day, when something new appears.
What sources does LeakTrace read?#
Public and observable signals only:
- monitored breach databases
- mail records, domain registration data and certificate-transparency logs
- historical DNS and publicly reachable services
- your website's own code and public search results
- published business and registry records
Does LeakTrace hack into anything?#
No. LeakTrace is not a pen test: nothing attacked, nothing installed, no access given. It reads only public and observable signals.
There is no unauthorised access, no exploitation of private systems and no interception of communications. Where there is no observable signal, LeakTrace says so plainly rather than trying to get past it.
Does LeakTrace access private accounts, email or devices?#
No. LeakTrace never accesses private email, personal social accounts, messaging systems or personal devices. We read everything a firm shows the public internet, and say plainly what cannot be seen from outside.
For a household, each adult gives written consent on their own consent page before any of their details are watched.
What is the AI security agent?#
It comes with the assessment, on your dashboard. Ask it a question in plain English and it answers from your own firm's findings, and names the finding it used.
It drafts a note about any finding, for you to send, and proposes a re-check that runs only when you approve.
It keeps a log of everything it did, and when it cannot answer, a person replies. Every paid assessment is still human-verified before release. Our AI agents work from outside only.
They never log in, never install anything, and never touch your internal systems. The one change they can make, to your email records, happens only when you approve it.
What do the AI agents do on a paid assessment?#
On a paid assessment, our AI agents work your firm from outside, stage by stage, and it is human-verified before release.
- On a paid assessment, the Discover AI agent reads what your firm shows the public internet with fixed checks, records each finding with its evidence and chooses follow-up checks.
- Every finding is kept with the record that proves it. A person reads the assessment before release.
On a paid assessment, the Close AI agent gives you the fix for each finding and, for an email record, sets the steps out with your DNS host's own screens where we hold its guide.
When you mark a fix done, AI chooses when to re-check, and only a fresh outside read closes it.
On monitoring, fixed checks re-check your email settings, look-alike domains and new host names every hour, and everything else every day.
The Monitor AI agent puts first the change that needs you, with a plain reason when it has one.
If the AI fails or reaches its limit, the fixed path runs as it did before.
What can the AI agents never do?#
They never log in to anything of yours, never install anything, and never touch your internal systems.
They send nothing in your name: a note about a finding and the request about a look-alike domain are drafted for you to send. They change nothing on their own.
No AI agent can state a finding without a fixed outside check behind it, and AI cannot change a severity or edit evidence.
The email record, one click per step, works where your domain's DNS is at Cloudflare and you supply a token for that one use. Anywhere else you get the exact record to paste.
Who checks the AI agents?#
A person. Every paid assessment is held until a person has read it, and nothing is released on its own: it is human-verified before release.
Your dashboard lists what each AI agent did for your firm, newest first. Every line carries its date and the stage that did it, and a closed finding carries the evidence of the re-check.
How much does LeakTrace charge?#
The price of the External Cybersecurity Assessment is stated on your firm's outside reading, and it is shown again before you pay. The Personal Exposure Briefing’s price is shown before you pay. Household coverage is scoped per household on a short call.
Does LeakTrace publish household pricing?#
No. Household coverage is Perimeter, and each Perimeter engagement is scoped per household on a short call. No fee is published.
Is monitoring a subscription?#
Yes. Monitoring is available monthly or annually, with a discount on the annual term. Terms are shown before you pay, and you can cancel at any time for future billing periods.
Is LeakTrace SOC 2 certified?#
No. We hold no third-party security certification. SOC 2 is planned; no audit is underway, and we would rather say that than imply otherwise.
What is in place today:
- HTTPS with HSTS
- encrypted database backups
- role-based access
- human verification of every paid assessment before release
The security page sets out the rest.
Which rules does the assessment map to?#
The Rules and Insurance Briefing maps each finding to the rules that apply to the firm’s sector and jurisdiction.
Depending on the business, these include:
- In Canada: PIPEDA, Alberta and BC PIPA, and PHIPA for Ontario health custodians
- In the United States: the FTC Act Section 5, SEC Regulation S-P for SEC-registered advisers and broker-dealers, the FTC Safeguards Rule, HIPAA, state breach notification laws and Massachusetts 201 CMR 17.03
- For law firms: the law society rules or ABA Model Rule 1.6
It names no rule it does not map. It is informational and is not legal advice.
How does LeakTrace handle client confidentiality?#
A mutual NDA is available before any concrete discussion. Access to client data is limited to the staff roles that need it, and findings are disclosed only to the client who ordered them. Client identities are not disclosed in any public document.
How long does LeakTrace keep what it holds?#
We keep what we hold until you ask us to delete it. Email [email protected] and we delete it and confirm in writing, except where the law requires us to keep something.
Our payment processor keeps payment records under its own terms. The privacy policy has the detail.
Does LeakTrace replace cyber insurance?#
No. Insurance pays claims after an incident; LeakTrace shows you the outside view first so you can close what is open.
The assessment doubles as your insurance renewal evidence pack:
- the outside questions insurers commonly ask at renewal, each shown with its evidence
- forged-email protection where we reach your DNS host, one click per step
Its evidence is something an insurer can check.
Does LeakTrace replace a lawyer?#
No. LeakTrace provides source-traced evidence a lawyer can use. Legal advice, letters and filings are for counsel. If you have no lawyer, LeakTrace can introduce one; it does not resell legal services.
Does LeakTrace replace an IT provider?#
No. Your IT provider keeps your systems running. LeakTrace reads your firm from outside, gives you the exact fix for each finding and the check that proves it, and re-checks until it is closed. It is paid by no one who sells the fixes, so every finding is independent.
How do I start?#
For a firm, choose Check my firm at /business/ and we tell you what your domain shows from outside, with a check you can run.
For yourself, run the free check at /individual/. For a household or anything else, email [email protected]; a person replies within 4 business hours from a LeakTrace address.
What happens on a scoping call?#
Scoping calls are for household and network programmes. Fifteen to thirty minutes covering scope, the consent each adult or member gives, and how often we re-check. There is no pitch deck. If it is not a fit we say so plainly and there is no follow-up.
What is the fastest way to get an assessment?#
Check your firm at /business/. Once you order and confirm, the External Cybersecurity Assessment is delivered inside 72 hours of confirmation: the full outside watch on your firm, the proof for every finding, and the fix.
Does LeakTrace work with firms in other countries?#
The Rules and Insurance Briefing maps findings to Canadian and US rules. Anywhere else, ask at [email protected] and we will say plainly whether the public signals and the applicable privacy law let us do the work.
Does LeakTrace do incident response?#
No. LeakTrace finds the ways an attacker could get in, closes them and keeps watching; it does not respond to incidents.
When an incident is confirmed, it provides its findings and evidence to your lawyer, insurer or response firm. If you have no response firm, LeakTrace can introduce one; it does not resell the service.
To see what your firm shows from outside: Check my firm.