How LeakNix for Business handles your data

What we store

About a customer: the company name, the users' emails and roles, sessions (hashed), the audit log (actions, hashed IP addresses), domains and their verification state, the addresses on verified domains, which breaches each address appears in, the data classes of those breaches, masked passwords, infostealer collection dates, alerts, tasks and notes, the posture and certificate readings of verified domains, the software list, the supplier domains, integration destinations (webhook URLs encrypted at rest) and the billing customer and subscription ids.

Not stored: plaintext passwords, names, dates of birth, phone numbers or postal addresses from a breach row (only the data class labels), response bodies from your servers, card numbers.

Where it lives

The database is a managed Postgres in Ireland (eu-west-1). Payments are handled by the payment processor; LeakNix never sees a card number. Emails are sent through a transactional email provider. The website runs on a hosting platform in front of it. The subprocessor table at the end names each one and what it receives.

How long

Backups are the database provider's own and follow the same windows.

Secrets

• Leaked passwords are masked before they are stored: up to two leading characters, bullets, the last character, with the length clamped so the mask does not reveal it. The plaintext arrives from the source, is masked in memory, and is never written to a log, a response or the database.
• Session tokens, invitation links and verification tokens are stored hashed.
• Sign-in codes are stored as a salted HMAC and expire in 10 minutes; five wrong attempts void the code.
• Webhook URLs and API keys are encrypted at rest; an API key is shown once, at creation.

Access

Three roles. The owner alone touches billing and can delete the company; admins change everything else; viewers see everything and change nothing. Every change in the app is written to an append-only audit log that the company's users can read.

LeakNix staff can reach the database for support with a service key. In this version the audit log does not record operator reads; it will say so until it does.

How monitoring works

Each watched address is checked once when it is added: against the public breach records, and once against breach data and infostealer logs for leaked passwords. After that, LeakNix reads the public breach records once a day and checks every watched address against each new breach, paced so that no customer waits on another. A new breach that names a watched address becomes an exposure and one email.

Each verified domain is read once a day from public DNS for its email posture and from certificate transparency logs for its hostnames, and once a week from registry data.

The boundary. The only servers LeakNix connects to are your own verified domains, the way a browser would. For each host: one connection to read the certificate, one page request (two if the page redirects on the same host) and one plain HTTP request to see the redirect to HTTPS, never more than four connections a host a day. Response bodies are discarded. Look-alike domains, suppliers and everything else are read from public records only; LeakNix never connects to them.

What we do not claim

• No certification or formal audit of LeakNix itself. This page is the description; ask us anything it leaves out.
• No uptime figure. The app has a status line on its own page and a support address.
• No source covers everything that has ever leaked. LeakNix names the kind of source on every row so you know what you are looking at.
• Alerts are sent when a new exposure is recorded, after the daily read, not the moment a breach happens.

Reporting a security issue

Write to support@leaknix.com with what you found, where, and how to reproduce it. You get an acknowledgement by email and a reply when the issue is understood. Please do not test against other customers' data; the demo company is there for that.

Subprocessors

The providers are named in the data processing agreement, available from support@leaknix.com.