Responsible Monitoring Policy

Hunting fraud means looking at things other people publish and asking third parties to take them down. We hold ourselves to these rules, and so must our customers.

What we monitor

• Public sources only: certificate transparency logs, domain registration feeds, public threat feeds, search engines, public social media profiles, app stores, public code repositories, and public paste sites, accessed within their terms.
• The customer's own login pages, through the snippet the customer installs.
• Executives only with their written authorization, collected by the customer.

What we do not do

• We do not break into systems, bypass logins, or use stolen credentials.
• We do not buy or use breached databases that contain passwords in clear text.
• We do not store passwords, secrets, or personal data we come across in clear form: they are masked at ingestion.
• We do not monitor people in general; we monitor impersonation of the brands and authorized executives we protect.
• We do not file takedowns against legitimate competitors, criticism, commentary, news, or parody.

How a takedown is decided

1. Automated analysis flags a candidate and records evidence with a cryptographic hash.
2. A human analyst reviews the evidence and confirms, or dismisses, the fraud.
3. Only confirmed fraud is reported to blocklists and to the registrar, hosting provider, or platform, with the evidence attached.
4. We follow the case and stop as soon as the resource is offline.

Dismissed candidates stay under watch for 60 days in case they turn malicious later, without any report being filed.

If we reported your site or profile

If you believe we reported a resource you operate in error, write to [email protected] with the address and the reason. We review disputes within two business days. When we made a mistake, we withdraw our reports from the blocklists and parties we contacted, and tell you what we did.

Security of our own service

To report a vulnerability in Brandefend, write to [email protected]. Please give us reasonable time to fix it before disclosing it, and do not access data that is not yours. We will not pursue good-faith research that follows these rules.