Your privacy matters.
Here is how we protect it.
This page explains what our encryption actually protects, who can read what, and what stays visible. It is a summary, not a contract. The legal detail lives in our Privacy Policy.
Request handling
Authorised staff decrypt your submitted details to fulfil your request.
Report access
Your recovery file unlocks the delivered report. Staff know the findings they prepare.
Encryption has limits
Technical metadata and payment records remain visible.
01 · Protections
Five layers, in the order they happen.
Your keys are made in your browser
A 3072-bit RSA keypair and a random access token are generated with your browser’s WebCrypto API. You download them as a recovery file before the request is sent. The application does not upload your private key.
Request details are sealed before upload
Search fields are encrypted with AES-256-GCM, and that key is wrapped to the staff public key with RSA-OAEP. The server stores ciphertext, your public key and a hash of your access token.
Staff decrypt to do the work
Authorised staff decrypt your request on their own device so they can research it. This is deliberate: someone has to read a request to fulfil it.
Reports and files return encrypted to you
Reports, quotes and attachment files (up to 10 MB each, filenames included) are encrypted to your public key in the staff browser before upload. Your browser decrypts them locally.
Messages are encrypted twice
Each message in a request conversation is encrypted once for you and once for staff, so both sides can read it. Sender role and timestamp are stored alongside in the clear.
02 · Limits
What encryption does not hide.
Encryption protects the content of a request. It does not make you anonymous, and this is not a zero-knowledge service. These things are visible to us, our providers, or the public:
- Your IP address, browser details and request timing, as seen by our hosting and security services.
- Which module you chose, its price, request status and delivery dates.
- Payment amounts, networks, addresses, transaction references and any refund address you supply.
- Public blockchain records, which anyone can inspect independently of us.
- Anything you send by email.
The payment provider receives price, currency, an order identifier and a general service description, not your decrypted request. No system is absolutely secure; a compromised device or a shared recovery file undermines all of the above.
03 · Surveillance
Surveillance enquiries involve an outside firm.
We do not carry out surveillance ourselves. When you agree to it in the enquiry form, authorised staff manually share the information reasonably needed to assess, quote and perform the work with an external private-investigation firm. Sharing is recorded and limited to that purpose.
Providers do not get automatic access to your request. Their identities are not routinely disclosed, except where the law requires it.
04 · Your part
The recovery file is the key to everything.
Keep it
Your recovery file holds your private key and access token. You need these credentials to access your tracking page and decrypt your delivered report, and we cannot recreate the private key. Keep an independent, secure copy; the browser only holds a session copy until the tab closes.Never send it
Do not email it, paste it into a payment memo, or share it. Anyone holding it may read your tracking page and decrypt your report.05 · Retention
We keep records while they are needed.
There is currently no fixed automatic deletion interval. Records are kept for research, report access, payments, refunds, disputes and legal obligations, and reviewed when those purposes end or you ask for deletion. Backups and independent providers may hold copies for a time, and blockchain records cannot be erased. You can request access or correction under the Privacy Act 2020 by emailing us with "Privacy request" in the subject.
Questions before you send anything
Email us. Never include your recovery file, private key or voucher PIN in an email — email sits outside the encrypted request workflow.