Data Sources

Screens vendors against OFAC SDN, consolidated sanctions lists, PEP databases, and international sanctions regimes. Entity name verification reduces false positives from similar names.

Verifies legal entity identity via the GLEIF LEI registry, confirming jurisdiction, formation date, active status, and registered address. Name matching is verified to prevent misattribution.

Screens recent news coverage for regulatory actions, lawsuits, data breaches, financial distress, and fraud allegations across multiple news sources.

Validates SSL certificates, HTTPS enforcement, domain age, registrar information, and DNS configuration.

Identifies open ports, exposed services, cloud hosting footprint, and network-level security indicators.

Multi-engine threat analysis checking for malware association, phishing indicators, abuse reports, botnet participation, and safe browsing status.

Provides firmographic data including industry classification, company size estimates, technology stack, and operational context.

Queries WHOIS records for registrant information, registration dates, and registrar details.

Reviews SSL/TLS certificate issuance history, subdomain enumeration, and certificate authority validation.

Evaluates security headers, content security policies, and browser security configurations.

Checks IP addresses against known blocklists, spam databases, and abuse registries.

Scans domains against malware databases, phishing registries, and unsafe browsing indicators.

Performs live website scanning to detect technologies in use, screenshot capture, and threat indicators at the URL level.

Analyzes historical web presence to assess operational longevity and content consistency over time.

Reviews public tech community discussions for vendor-related feedback, incident reports, and reputation signals.

Scans vendor trust, security, and compliance pages for certification claims (SOC 2, ISO 27001, HITRUST, PCI-DSS, FedRAMP, and more). Cross-references the FedRAMP public registry for independent verification. Detects aspirational language to distinguish current certifications from in-progress efforts.

Discovers vendor subprocessor pages and extracts third-party dependencies. Runs sanctions screening and safe browsing checks against each subprocessor to surface supply chain risk.

Searches the FDIC BankFind registry for failed bank records associated with the vendor. Verifies entity identity through name match confirmation.

Searches SEC EDGAR full-text search for enforcement-related filings mentioning the vendor in the last 5 years. Findings indicate the vendor is mentioned in a filing, not necessarily the subject of enforcement.