LeakNix
LeakNixfor Business
Sign inStart free

See who in your company is exposed, and what was taken

Add your domain and the addresses you want watched. LeakNix shows who appears in known breaches and infostealer logs, what was taken and what to do, and emails you once when a new breach names one of them.

Start freeTry the demo

Free for 10 addresses, no card. One DNS record proves the domain; paid plans add volume, not features.

The dashboard, shown with sample data for a fictional company.
Trusted by 100,000+ usersFeatured inSaaSHubTrustpilotawesome-security

Who is exposed, in what, and what to do

Every exposure names the person, the breach it was found in and the data that breach held. A leaked password is shown masked: enough to know it must change, never enough to use.

Each one carries a status and an owner, so the list of exposures is also the list of work.

The exposures list, shown with sample data for a fictional company.

One email when a new breach names your people

LeakNix reads the public breach records every day and checks your addresses against each new breach. When one of them is in it, the people you choose get one email: who, what was taken and the next step.

Nothing is sent for breaches you already knew about, and nothing is sent twice.

Sample data
FromLeakNix for Business <alerts@leaknix.com>
Toit-security@northwind-labs.example
Subject3 Northwind Labs addresses are in the Under Armour breach

Under Armour was breached in November 2025, and the breach was added to the public breach records on 21 January 2026. It includes priya.nair@northwind-labs.example, hannah.weiss@northwind-labs.example and diego.ferreira@northwind-labs.example.

What was taken: email addresses, names, dates of birth, genders, geographic locations and purchases. No passwords.

What this means: nothing needs a reset. Names and dates of birth make a phishing email more convincing.

What to do: tell the three people to expect messages that use these details, and to check the sender before they click.

Open this alert in LeakNix

You receive this email because you are an alert recipient for Northwind Labs. Stop alerts for this address.

An alert email, shown with sample data for a fictional company.

How it works

Three steps. The third one runs on its own.

  1. Prove the domain

    Add one TXT record at your DNS host. Nothing is fetched for an address until the record is there, and LeakNix keeps checking for it on its own.
    The DNS record, shown with sample data for a fictional company.

  2. Add the addresses

    Type them, paste them or upload a CSV. Each one is checked once against breach data and infostealer logs, so you see what is already out there.
    Adding addresses, shown with sample data for a fictional company.

  3. Hear about new breaches

    Every day LeakNix reads the public breach records. When a new breach names one of your addresses, the people you chose get one email, and the alert shows who handled it.
    The alerts, shown with sample data for a fictional company.

What the public breach records held in the last twelve months

A breach exposure is an address found in the records of a breach: the company whose data was taken is the victim, and the row says what it held. An infostealer login is different: it was copied from a malware-infected device, so the device, not a website, is compromised.

A work address in either is a ticket for IT. The counts below are read live from the public breach records.

132
breaches added to the public breach records in the last twelve months
Source: the public breach records index, as read on 3 November 2026
28
of those breaches included passwords
Source: the public breach records index, as read on 3 November 2026
6
infostealer log collections in the public breach records
Source: the public breach records index, as read on 3 November 2026

Whether your domain can be spoofed

Ten checks a day on each verified domain: SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI, MX, DNSSEC, CAA and dangling CNAMEs. Each one says what it found and what to change.

When a check changes state, you get an alert with the old and the new value.

Email security, shown with sample data for a fictional company.

Who is imitating your domain

LeakNix generates up to 300 look-alike names for each domain and resolves them weekly: unregistered, registered, resolving, or receiving mail. A look-alike that gains a mail server is the phishing signal, and it raises an alert.

Your suppliers' domains are watched the same way, from public records only.

Lookalikes, shown with sample data for a fictional company.

What of yours is on the internet

Certificates, protocols and security headers on your own hosts, read the way a browser would. Every hostname your certificates have ever named, with the ones that point at unclaimed services flagged.

Registration and nameserver changes come from registry data, with reminders before the domain expires.

Web security, shown with sample data for a fictional company.

Known-exploited vulnerabilities in your software

List the software you run, or take what LeakNix saw in your own servers' headers. Every entry in the government catalog of known exploited vulnerabilities that matches gets a row with its due date; new CVEs above your threshold do too.

Each row can become a task with an owner.

Software and vulnerabilities, shown with sample data for a fictional company.

This week, as it concerns you

New breaches in the public records, additions to the known-exploited catalog and government advisories, in one dated feed. Items that touch your addresses, your software or your suppliers are marked.

Any breach in the public records can be searched, with what to do for each kind of data it held.

News, shown with sample data for a fictional company.

Assign, fix and prove it

Any finding becomes a task with an owner, a due date and steps. A board by status, a table by person, a reminder before a due date and another when it passes.

Findings also go to Slack, Teams, Discord or a signed webhook, and everything in the app is in the API.

Remediation, shown with sample data for a fictional company.
LeakNixAPP27 Jan, 08:11 UTC

New breach, low. 2 Northwind Labs addresses are in the SoundCloud breach, added to the public breach records on 27 January 2026: jonas.lindqvist@northwind-labs.example, kenji.watanabe@northwind-labs.example. Taken: avatars, email addresses, geographic locations, names, profile statistics, usernames. No passwords. Open in LeakNix

Where the data comes from

Seven kinds of public source and one private one, your own servers. No source covers everything that has ever leaked, and LeakNix names the kind of source on every row.

Public breach records
Which breaches an address appears in and what data each breach held. The company whose data was taken is the victim of the breach; the records say so.
Infostealer logs
Logins copied from malware-infected devices. A work address in one of these means a device, not a website, was compromised. Passwords are masked before they are stored.
Public DNS
SPF, DKIM, DMARC, MX and the other records that decide whether your domain can be spoofed. Read from public resolvers, never from your servers.
Certificate transparency logs
Every certificate issued for your domain, which is how LeakNix learns your hostnames and spots a new issuer.
Registry data
Registrar, expiry, status codes and nameservers for your domain, and the registrar's abuse contact for reporting a look-alike.
Government vulnerability catalogs
The catalog of known exploited vulnerabilities with its due dates, new CVEs, and advisories.
Your own servers
Only after you prove the domain is yours, and only the way a browser would: one connection to read the certificate, one page request (two if the page redirects on the same host) and one plain HTTP request to see the redirect to HTTPS, never more than four a host a day. Response bodies are discarded.

What happens to the data

The practices, in plain words. The security page has the retention table, the subprocessors and how to report an issue.

Masked passwords
A leaked password is masked before it is stored. The plaintext never reaches the database, an email or a log.
DNS proof first
A domain must be proven with a DNS TXT record before anything about its addresses is fetched.
Only your own hosts
The only servers LeakNix connects to are your own verified domains, the way a browser would. Everything else is public records.
Hashed tokens
Session tokens, invite links and verification tokens are stored hashed; sign-in codes as a salted HMAC.
Append-only audit log
Every change is in an append-only audit log for one year.
Three roles
Owner, admin and viewer. The owner alone touches billing; viewers see everything and change nothing.
2 Nov 2026, 08:20 UTC
Dana Popescu
Signed in
Email code
15 Oct 2026, 09:10 UTC
Andrei Marin
Exported a CSV
exposures, 39 rows
14 Oct 2026, 07:55 UTC
Dana Popescu
Added 5 addresses
21 Jan 2026, 09:02 UTC
Andrei Marin
Acknowledged an alert
Under Armour breach, 3 addresses
12 Jan 2026, 08:05 UTC
Dana Popescu
Invited a member
as admin
12 Jan 2026, 07:58 UTC
Dana Popescu
Added 35 addresses
The audit log, shown with sample data for a fictional company.

Who it is for

An IT lead

You run IT for a company of 10 to 100 people. One domain, the addresses on it, and an email when a new breach names one of them.

northwind-labs.example
40 of 100 addresses

An MSP

You look after several clients. Each domain is verified on its own, with its own addresses, its own alert recipients and its own posture page.

northwind-labs.example
Verified
northwind.example
Pending

A security team

You want the list in your own tools. CSV from every table, a signed webhook or Slack for every finding, and an API that reads what the app shows.

GET /api/business/v1/exposures?status=open
Authorization: Bearer <your key>

Compared with doing it yourself

Every cell is what the named kind of tool does today. Suite prices are the lowest published starting points.

Compared: Spreadsheets and manual checks, LeakNix for Business, Enterprise threat intelligence suites
What is comparedSpreadsheets and manual checksLeakNix for BusinessEnterprise threat intelligence suites
Proof of domain ownershipNot needed, so nothing stops a mistakeA DNS TXT record before any checkVaries, often by contract
Leaked passwordsIn clear, wherever you looked them upMasked, never stored in clearUsually in clear, for security teams
Infostealer logsManual lookups, one address at a timeChecked once per address, shown with the collection dateYes
New-breach alertsWhen someone remembers to lookOne email per new breach: who, what, the next stepYes, often into a SIEM
Email posture and certificatesdig and a calendarTen checks a day per domain, change alertsSometimes, as separate products
Who fixed whatA column in the sheetStatus, owner, steps and an audit logThrough a ticketing integration
Export and APIIt is the sheetCSV from every table and a documented APIYes
PriceYour time$0 to $399 a monthFrom $3,600 a year, most quote only

Compared on 2 November 2026, from the vendors' public pages.

Pricing

One price per company, billed in USD, excluding tax. Cancel from Billing at any time. Everything is included from day one; plans add volume, not features.

Free
Everything, for one domain and ten addresses.
$0per month
No card
  • 1 domain
  • 10 watched addresses
  • 2 seats
  • 3 password checks in total
  • 90 days of history
  • 3 CSV exports a month
  • 2 alert recipients
Start free
Starter
One company domain, the people in it.
$49per month
$490 a year on the yearly plan
  • Everything in Free, plus
  • 25 watched addresses
  • 5 seats
  • 25 password checks a month
  • 1 year of history
  • 25 CSV exports a day
  • 5 alert recipients
Start with Starter
Team
A few domains or brands, the IT team on it.
$149per month
$1,490 a year on the yearly plan
  • Everything in Free, plus
  • 3 domains
  • 100 watched addresses
  • 15 seats
  • 100 password checks a month
  • 2 years of history
  • 100 CSV exports a day
  • 10 alert recipients
Start with Team
Business
An IT department or an MSP with up to ten domains.
$399per month
$3,990 a year on the yearly plan
  • Everything in Free, plus
  • 10 domains
  • 300 watched addresses
  • 50 seats
  • 300 password checks a month
  • 3 years of history
  • 500 CSV exports a day
  • 25 alert recipients
Start with Business
Domain
A domain you have proven with one DNS TXT record. Only addresses on a verified domain can be watched.
Watched address
An email address on a verified domain that LeakNix checks. Paused and removed addresses do not count.
Seat
A person who can sign in, plus pending invitations. Three roles: owner, admin, viewer.
Password check
The one-time lookup of a watched address in breach data and infostealer logs, run once when the address is added. It is what finds leaked passwords, shown masked, and infostealer entries.

Prices exclude tax. Billed in USD.

Compare plans
Compare plansFreeStarterTeamBusiness
Watching
Domains11310
Watched addresses1025100300
Check when an address is added
Check on each new breach in the public records
Checks
Password and infostealer check3 in total25 a month100 a month300 a month
Team
Seats251550
Roles: owner, admin, viewer
Alert recipients251025
Audit log1 year1 year1 year1 year
Data
History90 days1 year2 years3 years
CSV exports3 a month25 a day100 a day500 a day
Modules
Email security and web security1 domain1 domain3 domains10 domains
Lookalike names watched per domain100300300300
Vendors watched325100300
Software entries watched525100300
Open remediation tasks252501,0005,000
Integration destinations12510
API keys and calls a day1 key, 2001 key, 5003 keys, 2,00010 keys, 10,000
Subdomains listed per domain502,0002,0002,000
Certificate log refreshWeeklyWeeklyWeeklyWeekly
Reputation checksDailyDailyDailyDaily
Reputation history90 days1 year2 years3 years
Employee notices a month101005002,000
Paste monitoringWhen an address is addedAdded and after every new breachAdded and after every new breachAdded and after every new breach
Domain registration checksWeeklyWeeklyWeeklyWeekly
Registration history90 days1 year2 years3 years
Executive report by emailMonthlyWeekly or monthlyWeekly or monthlyWeekly or monthly
Risk score history12 months12 months2 years3 years
Certificate and header checksDailyDailyDailyDaily
Web security history90 days1 year2 years3 years
Support
Email support
Compare plans: Team
Compare plansTeam
Watching
Domains3
Watched addresses100
Check when an address is added
Check on each new breach in the public records
Checks
Password and infostealer check100 a month
Team
Seats15
Roles: owner, admin, viewer
Alert recipients10
Audit log1 year
Data
History2 years
CSV exports100 a day
Modules
Email security and web security3 domains
Lookalike names watched per domain300
Vendors watched100
Software entries watched100
Open remediation tasks1,000
Integration destinations5
API keys and calls a day3 keys, 2,000
Subdomains listed per domain2,000
Certificate log refreshWeekly
Reputation checksDaily
Reputation history2 years
Employee notices a month500
Paste monitoringAdded and after every new breach
Domain registration checksWeekly
Registration history2 years
Executive report by emailWeekly or monthly
Risk score history2 years
Certificate and header checksDaily
Web security history2 years
Support
Email support

Questions

Do I need to install anything?
No. LeakNix for Business runs in the browser. The only setup is one DNS TXT record on each domain you want to use.
Will I see my employees' leaked passwords?
You see that a password leaked and a masked form of it, for example sw•••••1. The plaintext is never stored or shown. That is enough to know the password must change.
Where does the data come from?
Public breach records, infostealer logs, public DNS, certificate transparency logs, registry data and government vulnerability catalogs. Every row names the kind of source it came from.
How often do you check?
Each address is checked once when you add it. After that, addresses are checked whenever the public breach records gain a new breach, which LeakNix reads once a day. Alerts go out by email as a new exposure is recorded, usually the same morning.
Why not check every address every day?
Because the data does not change between breaches. Checking when a new breach is published is what catches a new exposure; checking every day would spend the shared quota for nothing.
What is the password check and why is it limited?
A one-time lookup of each address in breach data and infostealer logs. LeakNix runs a limited number of these each day across all customers, so after you add addresses they are checked over the following nights and the app shows the queue.
Do you connect to my systems?
Only to your own verified domains, the way a browser would: one connection to read the certificate, one page request (two if the page redirects on the same host) and one plain HTTP request to see the redirect to HTTPS. Never more than four connections a host a day. Everything else is public records.
Can I monitor a domain I do not own?
No. Each domain must be verified with a DNS record that only its owner can add. That rule keeps everyone's data where it belongs, including yours.
Can I add gmail.com or outlook.com addresses?
No. Public email providers cannot be verified by a company, and LeakNix for Business watches the domains you control. For a personal address use the free check on leaknix.com.
Who can see the data?
The people you invite, with the role you give them. LeakNix staff can reach the database for support; every action in the app is in your audit log.
Where is the data stored and for how long?
In LeakNix's database, hosted in Ireland, with the payment processor holding card details. History is kept for 90 days on Free and for 1, 2 or 3 years on paid plans, and 30 days after you cancel. Details are on the security page.
Is there a trial?
There is no plan to pick at signup. Every account starts with every feature and the free limits; the app tells you exactly which limit you reached and what lifts it.
What happens if I cancel?
Your plan runs to the end of the period you paid for. After that the account returns to Free: the newest addresses beyond ten are paused and listed, and history older than 90 days is removed after a seven-day notice.
Which free sources do you use?
Public breach records and infostealer logs for people; public DNS and certificate transparency logs for domains; registry data for registrations; government catalogs for known exploited vulnerabilities and advisories. The security page lists what each kind of source receives from us.

Add your domain and the addresses you want watched

Free for 10 addresses. The demo shows the full product with sample data.

Start freeTry the demo

Questions: support@leaknix.com