Exposure intelligence, delivered as an API.
Query breach records, infostealer logs, and drop-site dumps by any identifier and get every matching record, with its dataset and source, inside your own product — account takeover and fraud, workforce exposure, threat intelligence, executive protection.
Invite-only. Team-scoped access, API keys per user, usage billed per search.
Three source classes, one index.
Breach data, infostealer logs, and drop-site dumps are normalized to the same record shape, so one query reaches every layer.
Breach data
Records from company breaches, searchable across every breach in the index at once instead of one file at a time. Email, name, postal address, SSN, password hashes; plaintext when the breach was that bad.
What gets exposed
Infostealer logs
Credentials harvested by infostealer malware: the saved logins an infected device gave up, indexed by email, username and password, with the site URL kept on the original row.
What gets exposed
Drop sites
Combolists and exfiltrated dumps from paste sites, exposed buckets, and adversary forums — normalized into the same index instead of a thousand loose files.
What gets exposed
Built for the teams that need exposure signals inside their own product.
Platform and security teams call the API from their own workflows — the login flow, the SOC runbook, the analyst's console — not from a separate tool with a separate login.
Account takeover and fraud
Check the email, username, or phone behind a sign-up or a login against breach and stealer data. A password that appears in three stealer logs is an account-takeover risk: step up the login or force a reset.
Workforce exposure
Query your company domain for employee credentials in breach and stealer data, and reset the accounts that appear before an attacker uses them.
Incident response
When a new dump surfaces, scope which of your users' credentials it holds: query by domain or email and read each hit's dataset and original row.
Threat intelligence
Query your own domains and executives' identifiers on a schedule, and pivot from a leaked identifier to every dataset and source file it appears in.
Executive protection
Map what an adversary can find about a principal — leaked home addresses, personal credentials, and accounts — before it is used to target them.
Something else?
Tell us the workflow and the volume, and we'll say whether the API fits.
Request access →Query, inspect, integrate.
The same engine behind the search workspace, as a REST API: boolean queries, cursor pagination, sparse fieldsets, and links on every record.
- 01
Query
Send one identifier or a boolean expression — email, phone, name, username, domain, address — to /search. GET with a query string or POST with a body; one handler either way.
- 02
Inspect
Every hit comes back with its dataset, the exposed fields, a raw-or-hashed password classification, and links to the record, its original row, and its dataset.
- 03
Integrate
Page with the cursor, follow the links, and act in your own workflow: step up the login, force a password reset, brief the analyst.
Access and controls.
Built to be run by a security team: who can query, what they can see, and how much they can spend are all team-level settings.
Team-scoped access
Searching, record access, and API keys require team membership, and every search bills to the team.
Invite-only membership
Teams are created by Shadow Identity. Admins invite members by email, or verify a company domain so colleagues join on login.
Credit limits and usage reporting
Usage is metered per search against a credit limit set with your team. Admins see daily volume, monthly totals, and invoices.
SSN masking policy
Social Security numbers are masked for every team by default. Revealing them is a team-level policy set by Shadow Identity, never a per-user grant.
API keys per user
Each member issues and revokes their own keys, and can read each key's daily search count through the API. A key stops working when its owner leaves the team.
Linked results
Every search result links to its record, its original row, and its dataset; GET pages carry next_url, so integrations follow links instead of building URLs.
Bring exposure intelligence into your product.
Tell us about your use case and expected volume. Teams are created by invitation; API access follows.