What you see first

See it first.

The outside record of trust at work before you commit: what is open, and the record behind it. For a business, the External Exposure Check and the External Cybersecurity Assessment it leads to. For a person, the free address check and the Personal Exposure Briefing after it.

Start here · 48 seconds

Every finding, proven.

A forged invoice, the attacker’s AI behind it, six ways in, and each one found, with its fix, and checked again from outside. Words on screen, no voice. Illustrative firm.

Read the transcript
  1. Invoice 2217: new bank details. From [email protected]. Paid · $48,200. Your firm never sent it.
  2. How did they get in? Attacker’s AI agent: Attackers now send AI agents. Find firms to impersonate. 4,000 firms read. Copy of your address: set up. (harbourview-llp-pay.example) Invoice written in the partner’s style. Sent. (Illustration.)
  3. Copy of your address: set up. (harbourview-llp-pay.example) Mail from it looks like yours.
  4. Staff emails in leaked lists from hacks.
  5. A remote-access door, open to the internet.
  6. A private file, readable online.
  7. Software with a public weakness.
  8. Email anyone can fake.
  9. Six ways in.
  10. Their AI agents check every door.
  11. At every firm.
  12. LeakTrace checks from outside.
  13. Never your email or files.
  14. LeakTrace finds each one.
  15. Hands you the exact fix. Step by step.
  16. Checks again from outside: closed.
  17. A copy isn’t yours to switch off.
  18. LeakTrace watches it, and every new one.
  19. LeakTrace checks for new copies every hour.
  20. The AI defense layer. See what’s open at your firm. Enter your website. Results by email. Free. Check my firm · getleaktrace.com
What you get

What arrives, and what we never need.

72 hFrom confirmation to the delivered assessment, human-verified
HourlyEmail settings, look-alikes and new host names re-read every hour after delivery, with an alert within the hour; the rest every day. First to know.
0Log-ins, installs or access to your systems

Read-only, from public sources only. Not a pen test: nothing attacked, nothing installed, no access given.

For businesses

What a stranger sees of your domain.

The External Exposure CheckYour outside reading: the openings a stranger can see today, with the proof for the lead finding. Free.
The External Cybersecurity Assessment addsThe full watch, the proof for every finding, and the fix.Human-verified, inside 72 hours of confirmation.It doubles as your insurance renewal evidence pack:
  • the outside questions insurers commonly ask at renewal, each shown with its evidence
  • forged-email protection where we reach your DNS host, one click per step
The assessment comes with an AI security agent on your dashboard: ask it about any finding in plain English and it answers from your own firm's findings.Our AI agents work from outside only. They never log in, never install anything, and never touch your internal systems.The one change they can make, to your email records, happens only when you approve it.
Check my firm
For individuals

Is your address in a public breach?

The free address checkBreach records for one email address, and an optional phone number.
The Personal Exposure Briefing addsThe full picture, and the order to fix it.
Check my address
Request your reading

See what anyone can already see about your firm.

Attackers now use AI to read a firm from outside the way a search engine does: the website, directories, search results and what AI assistants say. We read it first, and every finding is human-verified before your assessment is released.

We send one confirmation link to that address. A person prepares your outside reading after you confirm, and it goes only to that address.

The rules that apply to you

We map what we find to the rules that apply where you operate.

United States

FTC Safeguards Rule: tell the FTC within 30 days.

Tax preparers, mortgage brokers and other financial institutions notify the FTC no later than 30 days after discovering a breach of 500 or more people.

Source: FTC, Safeguards Rule guidance.

Law
GLBA Safeguards Rule, 16 CFR 314
Regulator
Federal Trade Commission, and your state attorney general
Checkout currency
US dollars (USD)

Canada

PIPEDA: report a breach as soon as feasible.

Report to the Privacy Commissioner when a breach creates a real risk of significant harm, and keep a record of every breach for 24 months.

Source: Justice Laws Website, PIPEDA.

Law
PIPEDA s. 10.1
Regulator
Office of the Privacy Commissioner of Canada
Checkout currency
Canadian dollars (CAD)
A short video, and the 72 hours

See how we explain what we find, and how the 72 hours run.

What a finding looks like

Words on screen, no sound. Illustrative; no firm is shown.

Read the transcript
  1. Anyone can send email in your name.
  2. The firm’s public email record tells other mail servers to take no action on forged mail. Read 19 Sep 2026. Human-verified.
  3. Every finding, proven. Dated and checkable by anyone.
  4. One setting changes. Forged mail in the firm’s name is then refused. Forged email: one click per step, where we reach your DNS host and you approve it.
  5. The AI defense layer for businesses. Every finding at your firm, in one assessment. getleaktrace.com

How the 72 hours run

From confirmation to delivery, nothing installed and nothing logged into. Words on screen, no sound.

Read the transcript
  1. 72 hours. One domain. Nothing to install.
  2. Discover. Every way in, found from outside.
  3. Validate. Every finding, proven. Dated and checkable by anyone.
  4. Close. Forged email: one click per step, where we reach your DNS host and you approve it.
  5. You get the fix for the rest, step by step, and we re-check until it is closed.
  6. Monitor. On monitoring: email settings, look-alikes and new host names re-checked every hour. Alerts within the hour.
  7. Every paid assessment is human-verified before release.
  8. The AI defense layer for businesses. getleaktrace.com/see-it-first/

Link to these videos: getleaktrace.com/see-it-first/

How it works

Check us first

Our own email record, looked up live when the video was made. Words on screen, no sound. Run the same command and you get the same answer:

dig TXT _dmarc.getleaktrace.com +short
Read the transcript
  1. Check us.
  2. Our own email record, looked up live: p=reject. Mail forged in our name is refused.
  3. Every finding we send you holds up the same way.
  4. Every finding, proven.
  5. The AI defense layer for businesses. getleaktrace.com
What this page will never show
  • A real client's documents, dashboards or names
  • Testimonials or logos
  • Prices