Privacy

The email or identifier you search is never stored in plain text. Before it touches our database, it's run through HMAC-SHA256 with a server-side key, and only that hash is compared against hashes already on file. We don't have a reversible copy of what you searched, only whether the hash matched.

If you're signed in, we log one row per search: a timestamp and whether it matched — never the identifier itself, hashed or otherwise.

If your identifier is found, the report shows masked values (e.g. j***@example.com, P********!), aggregate counts (how many machines, how many services), and metadata about the infection (approximate date, OS, antivirus). Full plaintext passwords or emails are never displayed, exported, or stored anywhere you or we can read them back.

Your IP is used for one minute at a time to enforce rate limits (so the lookup endpoint can't be scraped or brute-forced), then it expires automatically. It's never written to our database or kept in logs beyond that window.

If you create an account, we store your name, email address, and a salted password hash to authenticate you — standard practice for any sign-in system. Email verification is required before you can sign in. You can update or permanently delete this data at any time from your Profile settings.

We don't run third-party analytics or ad trackers on this site. The only cookie we set is your session cookie.

API keys are stored as a one-way hash, the same way passwords are. The raw key is shown to you exactly once, at creation — we can't retrieve it afterward, and neither can anyone else.

The exposure data IDSentinel searches against comes from info-stealer malware logs that are already circulating outside our platform — we don't create or distribute them, we index them so you can check whether your own information appears. If you'd like data associated with your identifier removed from our index, email [email protected] and we'll act on it.