Contents · 17 sections
- 01Description of Services
- 02Scope of Services
- 03Account Registration
- 04Fees, Subscription & Billing
- 05Data Use, Privacy Compliance & Retention
- 06User Responsibilities & Acceptable Use
- 06BBusiness Services Terms
- 07Service Modifications & Termination
- 08Third-Party Services & Integrations
- 09No Guarantee of Complete Security
- 10Limitation of Liability & Indemnification
- 11Refund Policy & Charge Disputes
- 12Prohibited Uses & Security Violations
- 13Government Requests & Compliance
- 14Dispute Resolution & Arbitration
- 15Governing Law
- 16General Provisions
01 Description of Services#
LeakTrace Inc provides independent external cybersecurity assessments for owner-run firms, and breach checks for individuals, read from outside. For a business, the External Cybersecurity Assessment (the "assessment": three documents and a dated record: the Owner Summary and Action Brief, the Technical Evidence and Findings, the Rules and Insurance Briefing, and the Assessment Record) and monitoring (email settings, look-alike domains and new host names checked hourly, everything else daily). For an individual, the Personal Exposure Briefing and optional monitoring. Automated checks assess what is found and assign a severity; a person reviews every assessment before it is released.
When users sign up and agree to these Terms, they consent to what is found being displayed in their dashboard for verification and reporting purposes.
02 Scope of Services#
LeakTrace reads monitored breach databases and public sources and reports what it finds. Automated checks assess what is found and assign a severity to prioritise risks. We do not guarantee the completeness, timeliness, or absolute accuracy of all breach data. Some exposures may go undetected, and new breaches may occur after your briefing or assessment. Users are responsible for staying vigilant about their security beyond our Services.
Every finding carries the evidence it rests on and a check you can run yourself. We withhold the names of specific sources where a source's terms require it.
LeakTrace handles three kinds of data:
- Breach records tied to an email address or, where you give one, a phone number: which monitored breach database the record appears in, when, and what kind of data the breach exposed.
- Public DNS and website data for a business domain: email-authentication records, certificates, open services, subdomains, lookalike domains and keys left in the business's own website code.
- Business contact details as published by the business or a public registry.
We do not monitor Social Insurance Numbers, Social Security Numbers, passport or driver's licence numbers, card or bank account numbers, PINs, credit scores or medical records. What we find depends on what the monitored sources hold and is not guaranteed. The products and what each includes are described at /business/ and /individual/.
03 Account Registration#
- Users must be 18 years or older to register.
- You agree to provide accurate and current information during sign-up, including your full name and email, so that the briefing is tied to the right address.
- You are responsible for maintaining the confidentiality of your login credentials.
- We reserve the right to suspend or terminate accounts for fraudulent activity or violations of these Terms.
- By registering, you acknowledge that LeakTrace performs automated checks. A person reviews a business assessment before it is released; the Personal Exposure Briefing and monitoring alerts are produced by automated checks, without a person reviewing each one. You grant us a limited licence to use your email address, name and, where given, phone number solely for the purpose of identifying and reporting exposure found in monitored breach databases and public sources.
04 Fees, Subscription & Billing#
LeakTrace offers two service segments: Individual and Business. Prices are charged in CAD or USD according to the card issued, at the same figure, plus applicable taxes.
Individual
Business
Business fees are set by the size band chosen at checkout: up to 50 people and one domain (the first figure); 51 to 200 people, or up to 3 domains (the second); 201 to 500 people, or 4 or more domains (the third). The fee charged is the one shown at checkout for the band chosen. Monitoring that continues an assessment is charged at that assessment’s band.
Refunds are governed by the LeakTrace Refund Policy, which forms part of these Terms. Where that policy and this section differ, the Refund Policy governs. Billing errors and duplicate charges are corrected on review regardless. Nothing here limits any right you have under applicable consumer protection law. Payments are processed securely through Stripe.
- Subscriptions are billed on a monthly or annual basis and renew automatically unless cancelled.
- For an annual plan, we email you at least 7 days before it renews, with the renewal date and the amount. Monthly plans renew each month without a separate notice.
- Users can cancel at any time. Cancellations apply to future billing cycles only.
- Individual customers manage their subscription at getleaktrace.com/dashboard/. Business customers use the billing portal at getleaktrace.com/account/.
- Unauthorized chargebacks may result in account suspension or permanent banning.
- If you experience a billing issue, contact [email protected] before disputing charges.
05 Data Use, Privacy Compliance & Retention#
- By using LeakTrace, you acknowledge that we collect, store, and analyse data tied to your email address, name and, where given, phone number, found in monitored breach databases and public sources, to provide your briefing and alerts.
- We handle personal information under the Canadian and US privacy laws that apply to us, including PIPEDA. Users can exercise their rights by contacting [email protected].
- We do not sell or share your data with third parties for marketing purposes.
- LeakTrace is not responsible for removing leaked data from third-party websites or breach databases. Our Services focus on alerting you to act. Users seeking data removal should contact the relevant entities directly.
- Data is displayed in your dashboard only after you have explicitly opted in during signup, authorising us to check your email address across monitored breach databases and public sources.
- Data Retention: LeakTrace keeps what it holds for the periods set out in the retention schedule in the Privacy Policy, and deletes it sooner when you ask, as that policy states. You may request account and data deletion at any time by contacting [email protected]. We will permanently remove your data at your request, except where legally required to retain it (for example, financial records).
06 User Responsibilities & Acceptable Use#
By using LeakTrace, you agree not to:
- Engage in fraudulent activities or use LeakTrace to access unauthorized data.
- Attempt to hack, reverse-engineer, or disrupt our systems.
- Share confidential breach reports with third parties, except as section 6C allows.
- Use a briefing, assessment or alert to make a decision about a person’s eligibility for credit, insurance, employment or housing.
- Use our Services for malicious purposes, including identity theft.
- Order an assessment or monitoring of a domain you do not own or are not authorised to have assessed.
- Describe a briefing, an assessment or the Assessment Record as an audit, a certification, a penetration test or a compliance attestation.
You are responsible for maintaining the security of your own accounts and passwords. You acknowledge that failure to act upon breach notifications (for example, freezing accounts or changing passwords after detection) may result in further exposure, and LeakTrace is not liable for damages due to user inaction.
06B Business Services Terms#
- Access credentials are confidential and must not be shared, published, or embedded in client-side code.
- Usage is subject to the limits associated with your service tier. Exceeding limits may result in temporary suspension.
- You may not use the service to: assess domains you do not own or have authorisation to assess; resell access without written agreement; attempt to reverse-engineer proprietary methods; or perform attacks against our infrastructure.
- LeakTrace reserves the right to revoke access at any time for violation of these terms or non-payment.
- All outputs are provided for informational purposes only and do not constitute security certification, compliance attestation, or legal advice.
- Partners refer clients to LeakTrace. The assessment is delivered under the LeakTrace name; there is no white-label licence.
- Partners are responsible for their relationship with their end clients, including obtaining any necessary consent.
- LeakTrace retains ownership of all assessment data, proprietary methods, and underlying technology. Partners may not claim ownership of these assets.
- Commission structures are agreed upon during onboarding. LeakTrace reserves the right to adjust terms with 30 days' written notice.
- Partners must not misrepresent what the service does, guarantee specific outcomes, or use outputs for legal, insurance, or compliance determinations without appropriate professional advice.
- Accounts may be suspended or terminated for non-payment, misuse, or violation of these terms.
- Each assessment includes the exact fix for each finding it reports, step by step, and says where each change is made (for example, the client’s DNS settings or web host). LeakTrace re-checks a finding from outside until it is closed, where an outside re-check can settle that finding.
- LeakTrace does not implement changes on client systems, with one exception. Where the client’s DNS host allows it and LeakTrace supports that host, LeakTrace can publish or update the client’s email authentication records (DMARC and SPF), one step at a time, and each step only when the client approves it. Where the client supplies an access token for that change, it is used for that one step and is not kept. The value a record held before each change is kept, so that the change can be put back. The client approves each step and is responsible for confirming, before approving it, that every service that sends mail for the client is covered. Loss from mail that is delayed, filtered or refused after a change the client approved falls within the limits in section 10. The client retains full administrative control of their systems throughout. LeakTrace does not otherwise request administrative credentials, and it retains none.
- Guidance addresses findings identified in the client’s assessment. LeakTrace does not guarantee complete elimination of all security risks.
- LeakTrace keeps the rights in its methods, software and report formats. When you have paid for a briefing, an assessment or monitoring, you have a licence to use what we deliver to you for your own purposes, for as long as you need it.
- You may share it, in confidence, with your IT or web provider, your insurer or insurance broker, your auditors and accountants, your lawyers and other professional advisers, your lenders, and the people you answer to, such as your board or owners. Anyone you share it with may use it only to advise or serve you.
- You may not publish it or sell it. Where a document names other people or other organisations, for example staff addresses found in breach records or a third party’s exposure, you may not pass on those details beyond the people listed above.
- What we deliver is prepared for you alone. Anyone you share it with, such as an insurer, an auditor or a lender, may rely on it only with our written consent, and without that consent we owe them no duty.
- If an order is refunded, the licence for what was delivered under it ends: stop using and sharing those documents. Its pages close when the refund is made, and we do not reopen them. A partial refund changes nothing. A card dispute does not close them while it is open; a dispute that is lost is treated as a refund.
07 Service Modifications & Termination#
LeakTrace may change, suspend or discontinue features of the Service. If we discontinue a paid service you have paid for in advance, we refund the unused part. We may suspend or terminate accounts that violate these Terms or engage in misuse.
- When we change these Terms, we publish the new version on this page with a new version number, a new effective date and an entry in the change log.
- If you have an active subscription, we email you at least 30 days before a change that reduces your rights or increases what you pay takes effect. For you, that change applies from your first renewal after the notice period ends. You can cancel before then and the change will not apply to you.
- A change needed to comply with the law, or one that only adds a new service or improves your rights, may take effect when it is published.
- A one-time purchase, such as an assessment or a briefing, stays governed by the version in force when you bought it.
08 Third-Party Services & Integrations#
LeakTrace uses third-party services including payment processing, hosting and email delivery, listed in the Privacy Policy. This includes the monitored breach databases we read to deliver your briefing. We are not responsible for the privacy practices or policies of third-party providers.
09 No Guarantee of Complete Security#
LeakTrace provides exposure detection and monitoring tied to your email address or domain but does not guarantee the prevention of future security breaches or the removal of leaked data from monitored breach databases. We are not liable for damages resulting from the misuse of your personal data by others.
Point in time. Every briefing, assessment and alert describes what was publicly visible from outside on the date it was checked. It is not a test of internal systems and it is not a guarantee of security. If you think a finding is wrong, tell us at [email protected] and we will check it and correct or delete it.
Not legal or insurance advice. Nothing LeakTrace delivers is legal, insurance or compliance advice, including the Rules and Insurance Briefing, which describes rules and policy terms in general and cannot tell you how they apply to you. Ask your lawyer or insurance broker before relying on it for a legal or insurance decision. Nothing we deliver is a security certification. The Assessment Record is a dated record of what was read from outside your firm: it is not a certification, an audit opinion or a statement about your internal systems.
10 Limitation of Liability & Indemnification#
- 10.1 Cap. To the extent the law allows, the total liability of LeakTrace, its affiliates and its people for all claims arising from the Services is limited to the fees you paid LeakTrace for the Services in the 12 months before the event that gave rise to the claim.
- 10.2 Excluded losses. To the extent the law allows, LeakTrace is not liable for indirect, incidental, special or consequential losses, or for loss of profit, revenue, business, data or goodwill, even if they were foreseeable.
- 10.3 What these limits do not cover. Nothing in these Terms limits liability for fraud, wilful misconduct or gross negligence, for death or personal injury caused by negligence, or any other liability that the law does not allow to be limited. If you are a consumer, your consumer protection law, including the Ontario Consumer Protection Act, 2002 and the Quebec Consumer Protection Act, may give you rights these limits cannot reduce. Where it does, those rights apply in full (section 19).
- 10.4 Indemnity by business users. If you use the Services for a business, you will indemnify LeakTrace against third-party claims, and the reasonable legal costs of defending them, arising from your breach of these Terms, your misuse of the Services, or your asking us to assess a domain or system you were not authorised to have assessed. This section does not apply to consumers.
LeakTrace assesses the public-facing systems of businesses from outside, without credentials or access, and writes to published business addresses about what it finds. The Outside Reading Policy sets out what we check and how to opt out; the Privacy Policy sets out the basis on which we write. By using the Service, you agree that LeakTrace is not liable for distress caused by the receipt of an accurate finding.
11 Refund Policy & Charge Disputes#
Refunds are governed by the LeakTrace Refund Policy, which forms part of these Terms and sets out the circumstances in which each product is refundable and the window for requesting one. All sales are final except as the Refund Policy states. Duplicate charges and billing errors are corrected on review in every case. Nothing in these Terms limits any right you have under applicable consumer protection law.
12 Prohibited Uses & Security Violations#
Except as section 6C allows, users may not copy, modify, reverse-engineer, or resell LeakTrace data. Any unauthorized access to our systems or attempts to bypass security measures will result in account termination and legal action.
13 Government Requests & Compliance#
LeakTrace may disclose user information if required by law, court order, or law enforcement request. Affected users will be notified unless prohibited by law.
14 Dispute Resolution & Arbitration#
Any disputes arising under these Terms shall first be attempted to be resolved informally. If unresolved, disputes shall be settled through binding arbitration in Toronto, Ontario, Canada, conducted under the rules of the ADR Institute of Canada (ADRIC).
Business users waive the right to participate in class-action lawsuits against LeakTrace. Any arbitration or legal proceedings shall be conducted in English and held in Toronto, Ontario, Canada. If you are a consumer, this does not apply to you. Nothing in this section limits any right you have under consumer protection legislation, including the right to commence or join a class proceeding under the Ontario Consumer Protection Act, 2002 or equivalent legislation where you live. Where such legislation applies, the arbitration requirement and the class-action waiver in this section do not apply to you.
15 Governing Law#
These Terms shall be governed by and construed in accordance with the laws of the Province of Ontario, Canada, without regard to conflict of law principles. For business users in the United States, any legal actions not subject to arbitration shall be brought in the courts of Ontario, Canada. Consumers in the United States may bring an action in the courts of their own state of residence.
16 to 24 General Provisions#
16. Severability
If any provision of these Terms is found to be invalid, illegal, or unenforceable by a court of competent jurisdiction, the remaining provisions will continue in full force and effect to the maximum extent permitted by law.
17. Entire Agreement
These Terms, together with our Privacy Policy, Refund Policy, Outside Reading Policy (formerly the Scanning Policy) and Security page and, for an External Cybersecurity Assessment or business monitoring, the Authorized Scan Agreement, constitute the entire agreement between you and LeakTrace regarding the use of our Services. Where the Authorized Scan Agreement and these Terms differ on the scope or authorisation of an assessment, the Authorized Scan Agreement governs. They supersede all prior or contemporaneous agreements, representations, warranties, or understandings, whether oral or written.
18. Waiver
No failure or delay by LeakTrace in exercising any right, power, or privilege under these Terms shall operate as a waiver thereof, nor shall any single or partial exercise of any right preclude any other or further exercise thereof.
19. Consumer Protection Laws
Certain provisions of these Terms, including refund policies and limitations of liability, may be subject to mandatory consumer protection laws in Canada (e.g., Ontario's Consumer Protection Act) or the United States (e.g., California consumer protection laws). In such cases, applicable consumer protection laws will take precedence to the extent they provide greater rights or protections to you.
20. Contact Information & Support Response Times
For enquiries regarding these Terms:
- LeakTrace Inc., 1200 Bay Street, Suite 1201, Toronto, ON M5R 2A5, Canada
- General: [email protected]
- Privacy / DSAR: [email protected]
- Security disclosure: [email protected] (see Outside Reading Policy)
Response time commitments:
- General support (billing, product questions, account changes): response within one (1) business day, Monday to Friday, Eastern Time. Practical resolution typically within three (3) business days.
- Security disclosure (vulnerability report against LeakTrace property): acknowledgement within seventy-two (72) hours, status update within seven (7) days, resolution of confirmed critical issues within thirty (30) days. See the Outside Reading Policy for the full responsible-disclosure protocol.
- Privacy / data subject access requests: acknowledgement within one (1) business day, substantive response within thirty (30) days (PIPEDA s.8 maximum). See the Privacy Policy.
- Incident response: if you believe a security incident affects your LeakTrace account or data, email [email protected] with "Incident" in the subject line. LeakTrace will respond within four (4) hours during business hours, twelve (12) hours otherwise.
21. Force Majeure
LeakTrace is not responsible for a delay or failure caused by events beyond its reasonable control, such as an outage at a hosting, email or payment provider, the loss of a data source, an internet or power failure, a cyberattack on our own systems, a natural disaster or an act of government. We will tell you about the delay and do what we reasonably can to limit it. If an assessment you paid for cannot be delivered within 30 days of its due date for such a reason, you may cancel it for a full refund.
22. Assignment
You may not transfer your rights under these Terms without our written consent. LeakTrace may transfer these Terms to an affiliate or to a successor to its business, on notice to you; your rights under these Terms are not reduced by the transfer.
23. Survival
Sections that by their nature should continue after these Terms or a subscription end continue, including sections 6C (licence), 9, 10 (liability and indemnity), 11 (refunds owed), 14 and 15 (disputes and governing law), and 16 to 24.
24. Notices
We give notice to you by email to the address on your account or order, or for a change that affects everyone, by publishing it on this page. A notice by email is given on the day it is sent. You give notice to us by email to [email protected], or by post to the address in section 20.
| Date | What changed | Applies to |
|---|---|---|
| 15 Oct 2026 | Change note, 15 October 2026 (version 2026-10-15.1): section 6B.3 now says what the remediation guidance is: the exact fix for each finding, step by step, where each change is made, and a re-check from outside until the finding is closed where an outside re-check can settle it. Section 1 describes the assessment as three documents and a dated record. No fee, limit or other obligation changed. | From 15 Oct 2026 |
| 14 Oct 2026 | Change note, 14 October 2026 (version 2026-10-14.1): section 4 now sets business fees by firm size. The External Cybersecurity Assessment is $700, $1,500 or $3,000 and business monitoring $300, $500 or $800 a month ($2,500, $4,500 or $7,500 a year), by the size band chosen at checkout. The fee for a firm of up to 50 people and one domain is unchanged. No other obligation or limit changed. | From 14 Oct 2026; for a subscription that renews, from its next renewal |
| 9 Oct 2026 | Change note, 9 October 2026 (version 2026-10-09.1): section 6 adds two prohibited uses (ordering an assessment of a domain you are not authorised for, and describing our documents as an audit or a certification); 6B.3 says the client approves each DNS step and is responsible for confirming its own senders, and that loss from an approved change falls within the section 10 limits; 6C says no one else may rely on our documents without our written consent and that a refund ends the licence and closes the order’s pages (6C now says a refund closes the order, in place of saying we may remove access); section 9 says the Assessment Record is not a certification; section 11 says all sales are final except as the Refund Policy states. The liability cap, dispute and governing-law sections are unchanged. | From 9 Oct 2026; for a subscription that renews, from its next renewal |
| 8 Oct 2026 | Change note, 8 October 2026 (version 2026-10-08.1): section 6B.3 now states the one change LeakTrace can make itself: the client’s email authentication records, where the DNS host allows it, one step at a time and only on the client’s approval of each step, with any access token used once and not kept and the previous value kept so the change can be put back. No fee, limit or other obligation changed. | From 8 Oct 2026 |
| 3 Oct 2026 | Change note, 3 October 2026 (version 2026-10-03.1): the description of the service now says how monitoring runs (email settings, look-alike domains and new host names checked hourly, everything else daily), and the list of technical data no longer names public code repositories, which we do not search; it names keys left in the business’s own website code instead. No obligation, fee or limit changed. | From 3 Oct 2026 |
| 30 Sep 2026 | Change note, 30 September 2026 (version 2026-09-30.2): the liability section now has one clear cap with stated exclusions and carve-outs; the indemnity applies to business users only and no longer covers fraud or identity-theft losses; new sections cover how we change these Terms, your licence to share your reports, point-in-time findings, force majeure, assignment, survival and notices; the entire-agreement clause now names the Authorized Scan Agreement and the Scanning Policy; the renewal notice is stated as at least 7 days before an annual renewal. | From 30 Sep 2026; for a subscription that renews, from its next renewal |
| 30 Sep 2026 | Product renamed External Cybersecurity Assessment. Amounts, windows and conditions unchanged. | From 30 Sep 2026 |
| 29 Sep 2026 | Change note, 29 September 2026: section 2.1 now lists the data we actually handle; the price table lists the products currently sold; the outreach clause was rewritten in plain terms. No change to liability, dispute or governing-law sections. | From 29 Sep 2026 |