No black box. Here's the path — discover, enrich, identify — and the principle that keeps the result honest: corroboration is confidence, volume is not.
179 sources, in parallel — not a checklist, a widening surface.
A single email seed fans out across social platforms, developer and gaming sites, breach databases, archives, people-search engines and DNS/email metadata — all at once. Each pass widens the surface the next pass searches: usernames found in the first wave are themselves re-scanned in the second.
Once a name resolves with high confidence, go deeper — on five independent layers.
Only after a name is established do the name-based sources run: global news and media, sanctions and PEP watchlists, corporate registries and officer records, and court records across the US, France and the UK. The layers are independent by design, so an error in one never cascades into the others.
From findings to a person — an 11-axis behavioral signature, not a list of indicators.
The graph links accounts, breaches, domains and locations into personas. An 11-axis behavioral fingerprint captures what persists when infrastructure rotates. Exposure and threat are scored separately. Every finding carries its provenance — where it came from, how confident we are, when we first and last saw it.
Findings don't become an identity by piling up. A result is only as strong as the independent evidence behind it — so the scoring weights every source by reliability, rewards independent sources that agree, and refuses to let a crowded but shallow match outrank a sparse but corroborated one. An inferred signal never outweighs an observed one.
Source, confidence tier, cross-verification, first seen, last seen — attached to every result. You see exactly what we see, and exactly why a score is what it is. No "trust us."
179 sources, graph algorithms and a rules engine — running on a 7-year-old laptop at roughly 50 watts, about 90 seconds per scan. Constraints breed creativity; we show our math instead of claiming 100×.