How we work
Our methods are the reason our findings can be used. These rules are not adjustable for any client.
We follow money and infrastructure
We trace funds, domains, servers, payment pages and companies. We take an investigation to the point where an institution holding identity data — an exchange, bank, registrar or hosting provider — can be required by a competent authority to disclose it. That disclosure happens through lawful process.
Lawful sources only
- Public blockchains, read from our own nodes wherever possible.
- Public web content, captured as an ordinary visitor would see it.
- Public registries and official publications.
- Public criminal forums, channels and leak sites — read only.
- Commercial data under contract from providers who warrant lawful collection.
- Data our clients are entitled to give us.
What we don't do
- We don't track individuals' locations, movements, communications or devices.
- We don't hack, "hack back", take over accounts, or bypass access controls — even if a client holds a court order. Those powers belong to the state.
- We don't buy stolen data, access or information, and we don't pay criminals.
- We don't log in with, test or use leaked credentials.
- We don't use fake identities — human or AI — to interact with criminals, and we don't talk to operators to obtain payment details.
- We don't open accounts on criminal sites, make test deposits or buy anything from criminal services.
- We don't look up who holds a bank or e-money account, and we never obtain other people's bank data. We tell the institution that holds the account, which already knows its customer.
- We never collect or view child sexual abuse material, and we never contact victims or suspects of trafficking. Those findings go to the competent authorities first.
- We don't announce breaches publicly. We tell the affected organisation privately first, and authorities where required.
- We don't publish accusations. Our findings go to our client and, where appropriate, to competent authorities. Payment details we find go privately to the institution that holds the account; each institution sees only its own.
- We don't charge public authorities for the reports we send them.
- We don't promise to recover money.
Who sees what
Institutions
A bank, payment or e-money institution or exchange sees only the instruments held at its own institution, plus shared, non-personal infrastructure signals. Other institutions appear only as a count, never by name.
Authorities
Competent authorities see what falls within their jurisdiction and their recorded legal basis. Every access is logged.
Clients in a case
A law firm or company sees its own case and nothing else.
We vet every client
Before any engagement we verify who our client is, why they need the work, and whether we have a conflict. We decline requests to locate individuals, identify journalists or critics, or find out whether someone is under investigation.
Independence
Investigation reports are fixed-fee. We take no share of recovered assets. Analysts state confidence and limitations for every conclusion.
Legal basis
Every processing activity has a documented lawful basis and purpose. Data protection is designed for GDPR, UK GDPR and Türkiye's KVKK, with data minimisation and a data protection impact assessment before launch.
Edge cases
Requests that fall outside these rules are declined. Unusual cases are reviewed by an ethics review board that includes external members.
How we work
Our methods are the reason our findings can be used. These rules are not adjustable for any client.