Question 1

Where does the data actually come from?

Accepted Answer

Collectors we run: stealer-log devices, underground forums, XMPP/Jabber networks, Discord servers, Telegram channels, criminal marketplaces, paste-site drops and ransomware leak sites. Vulnerability data is the one exception and does not pretend otherwise, since it comes off the public registries, read at source rather than resold to us. That list is where we are rather than where the design stops.

Question 2

How fresh is it?

Accepted Answer

Log batches are indexed continuously; the typical run from capture to a searchable record is minutes, and the decay curve behind why that matters is on the data page. What the status page publishes is availability, measured rather than asserted: every service probed on a fixed schedule, ninety days of results including the days nobody measured, and an incident log opened and closed by observation instead of by someone remembering to write one. A leaked-credential record decays by the hour, and a vendor unwilling to publish anything you can check is asking you to skip the only benchmark that matters.

Question 3

What makes this different from a breach-notification service?

Accepted Answer

A breach service tells you a third party lost your data, usually months later, usually as a recycled list. We index the primary output of infostealer infections in the channels that distribute it. Different source, different clock, different decision on the other end.

Question 4

Which regions do you cover?

Accepted Answer

We collect globally. Coverage is not tied to a region. It follows the underground venues where credentials, access and chatter actually move, and it is deliberately weighted toward the communities that rebadged feeds underindex. If an incumbent already serves your threat model well, we will say so.

Question 5

Is any of this AI-generated?

Accepted Answer

The collection and the enrichment are engineered pipelines, not a language model summarizing other people's reports. Where models are used, they do narrow jobs such as translation, classification and deduplication, and they never invent a source or a date.

Question 6

Is the API a paid add-on?

Accepted Answer

No. The REST API is on every tier, because everything the console shows the API serves: same data, same permissions, same audit log. Keys are named, revocable, and can carry an expiry date, so an integration you are still building gets a key you can throw away. Feed delivery (STIX, TAXII, Sigma, EDL) is the Enterprise-tier layer on top.

Question 7

Who can see the credentials we pull?

Accepted Answer

Your organization, and only through the modules your organization holds. Access is granted at the organization level rather than per record, so the boundary is the account you contracted under: there is no anonymous read path to credential material and nothing lateral into another customer's data. In the console, secret values stay masked until an analyst deliberately reveals them, so they are never simply sitting on screen. The control we would actually point at is the log. Searches against the credential corpus are recorded with the caller, the query, the filters and the result count, and your organization can read its own history without asking us for it. Our own staff access is recorded under the same regime and reviewed internally; the retention rules and the full access model are on the legal basis page.

Question 8

What are the quotas, and what happens when I hit them?

Accepted Answer

Console use is not metered at all: the quotas apply to the API alone, per organization per day. Every ceiling is published, not negotiated, and the pricing page is the one place they are written down, so there is a single number to check rather than four pages to reconcile. Past the limit further calls are declined and the counter resets at 00:00 UTC. There is no overage billing and no surprise invoice, and your consumption is a live bar in the console alongside an endpoint your automation can read before it starts a long job.

Question 9

Do you do takedowns?

Accepted Answer

Not today, and we would rather say that before you ask us to. There is no takedown service in the product and none behind it: we do not file with registrars, hosts or platforms on your behalf. What we produce is the evidence chain that a takedown actually runs on: the post, the screenshot, the archived copy, the timestamps. That is what registrars, platforms and law enforcement require, and what most requests get refused for lacking. If you need the filing done as well, we will point you at the partner route rather than pretend it is ours.

Question 10

Does it integrate with my SIEM?

Accepted Answer

Most likely, and without a connector to install. We publish standards rather than shipping software into your estate, so anything that speaks STIX 2.1, TAXII 2.1, Sigma or a plain EDL consumes us as-is, and everything the console holds is also on a REST API you can pull on your own schedule. Detections ship as Sigma; conversion to a few of the query languages teams actually run is available today, and the list of targets is something we extend on request rather than a fixed menu. If your platform is not one we have already been asked for, tell us what it speaks; that is usually a mapping rather than a project. The integrations page has the current wire formats and the setup steps.

Question 11

Is it lawful to process leaked personal data?

Accepted Answer

It requires a documented lawful basis, defined retention limits and a route for data-subject rights. Ours is published on the legal basis page rather than described in a sales call, and it is written to be handed straight to a DPO.

Question 12

Do you buy data from criminals?

Accepted Answer

No. We observe what criminal marketplaces expose to their own audiences. We do not trade, solicit, or commission the theft of data, and we do not pay actors. Our collection posture is documented for customers under NDA.

Question 13

Who watches you?

Accepted Answer

Searches against the credential corpus are written to the Activity log with the caller, the query and the filters behind it, and your organization can read its own history without going through us. Our own staff access is recorded under the same regime and reviewed internally. "Even we watch ourselves" is meant as a control you can audit in an evaluation, not a slogan.

Question 14

Could this be used to attack someone?

Accepted Answer

The platform is built for defenders and sold to organizations monitoring their own exposure. Access is scoped to the modules you hold, every query is logged where your own admins can read it, and the lexicon deliberately explains how the criminal economy works without explaining how to join it. We turn down business that fails that test.

Question 15

What does it cost?

Accepted Answer

It is published, which is the part worth saying here. Four tiers, list prices in USD, the daily API ceiling behind each one and what sits outside list price are all on the pricing page, and that page is the only place any of those figures is written down: a number repeated in a FAQ is a number that goes stale in a FAQ. A vendor who will not tell you what a product costs until you take the call is telling you something.

Question 16

Is there a free trial?

Accepted Answer

Not a self-serve one, and we would rather say that plainly. Access to this data requires verifying who you are and what you are entitled to monitor, and no signup form can do that. What we do offer free and without an account: the public CVE library at cvekit.com, and the Underground Lexicon here.

Question 17

Can I try it against my own domain first?

Accepted Answer

Yes, and that is what a demo is for. We run your domain family through the platform live, on an NDA, and show you what is actually there. If the answer is "not much", we will tell you that too.

Question 18

Do you sell to individuals?

Accepted Answer

No. We sell to organizations monitoring their own exposure, and we verify that entitlement before granting access. This is a data-protection constraint as much as a commercial one.

The questions, including the ones we'd rather you didn't ask.

The data

The platform

Legal & ethics

Commercial

Data & Ethics

Legal basis

Collection numbers

Pricing

Still holding a question we didn't answer?