LeakNixLeakNix for Business privacy notice
What LeakNix for Business stores about a company and the work addresses it watches, where, for how long, and who can see it. Last updated 2 November 2026.
Who this notice is for
This notice covers LeakNix for Business: the companies that use it, the people they invite, and the people whose work addresses they watch. The LeakNix Privacy Policy covers the free check on leaknix.com and the LeakNix app.
The company that adds an address decides that it is watched. LeakNix keeps and processes the address, and what is found about it, for that company.
If your employer uses LeakNix for Business
If your employer uses LeakNix for Business, it may see that your work address appeared in a breach and a masked form of a password that leaked with it. It cannot see the password.
It also sees which breaches your work address is in, the kinds of data each of those breaches held, and, when your address is in an infostealer log, the date the log was collected.
If your employer turns on employee notifications, LeakNix may email you about a new exposure of your work address, at your employer's request. The email says what kind of data leaked and what to do. It never shows a password.
Questions about why your address is watched go to your employer. Anything else: support@leaknix.com.
What we store
About a customer: the company name, the users' emails and roles, sessions (hashed), the audit log (actions, hashed IP addresses), domains and their verification state, the addresses on verified domains, which breaches each address appears in, the data classes of those breaches, masked passwords, infostealer collection dates, alerts, tasks and notes, the posture and certificate readings of verified domains, the software list, the supplier domains, integration destinations (webhook URLs encrypted at rest) and the billing customer and subscription ids.
Not stored: plaintext passwords, names, dates of birth, phone numbers or postal addresses from a breach row (only the data class labels), response bodies from your servers, card numbers.
Where the data comes from
Public breach records, infostealer logs, public DNS, certificate transparency logs, registry data, government vulnerability catalogs and, only for verified domains, the company's own servers. Every row in the app names the kind of source it came from.
To check an address, LeakNix sends that address to the breach data providers. It never sends a password or a name.
Where it is stored
The database is a managed Postgres in Ireland (eu-west-1). Payments are handled by the payment processor; LeakNix never sees a card number. Emails are sent through a transactional email provider. The website runs on a hosting platform in front of it. The subprocessor table at the end names each one and what it receives.
How long we keep it
| What | Free | Starter | Team | Business |
|---|---|---|---|---|
| Exposures, posture and certificate history | 90 days | 1 year | 2 years | 3 years |
| Audit log | 1 year | 1 year | 1 year | 1 year |
| After you cancel | 30 days, then the account returns to Free and anything over its limits is removed after a seven-day notice | |||
| After an owner deletes the company | 7 days, then purged | |||
| Free account with no verified domain | Deleted 30 days after signup, with an email at day 23 | |||
Who can see it
Three roles. The owner alone touches billing and can delete the company; admins change everything else; viewers see everything and change nothing. Every change in the app is written to an append-only audit log that the company's users can read.
LeakNix staff can reach the database for support with a service key. In this version the audit log does not record operator reads; it will say so until it does.
Subprocessors
| Who | What for | What it receives |
|---|---|---|
| Database provider | Managed Postgres and storage, Ireland | Everything in "What we store" |
| Payment processor | Subscriptions and invoices | Billing contact, company name, tax id, card details entered on its own pages |
| Email provider | Sign-in codes, invitations, alerts, notices | Recipient address, the email's text (masked passwords only) |
| Hosting platform | The website and the app | Requests to leaknix.com, with IP addresses in its logs |
| Breach data providers (two) | The breach check and the password and infostealer check | The watched address being looked up; never a password, never a name |
| Public DNS resolvers | Posture, look-alike and supplier checks | The domain names being resolved |
Your requests
You can ask what we hold about you, and ask us to correct or delete it, by writing to support@leaknix.com. When the data is a work address your employer watches, we pass the request to the company that added it, because that company decides what is watched.
Changes to this notice
The date at the top of this page says when this notice last changed.