Social Media OSINT and the Line We Do Not Cross

This page exists to say plainly what we refuse to do, because the refusal is a feature. Social media collection is where open source intelligence turns into surveillance of a private person, and the tool almost never asks which one is happening.

The boundary below is published so a buyer can hold us to it and an employee can point at it.

See pricing

Scope recorded before collection.
Passive collection only.
Evidence a reviewer can re-run.
Built to clear procurement.

Two activities that look identical in a tool.

Reading a company's public posts to understand what it sells, who it partners with and which office it opened is corporate research. It is about an organization, it uses information published for an audience, and nobody is harmed by it.

Assembling a picture of a named private individual from their public posts, their photographs, their check-ins and their connections is something else. It is about a person, it is capable of causing real harm, and in most jurisdictions it is processing personal data that requires a lawful basis before you begin.

The technical act is the same and the tools do not distinguish. Which is precisely why the distinction has to be enforced by policy, in public, with named refusals, rather than left to the intent of whoever is sitting at the keyboard.

The boundary, stated as specific cases.

Not principles, because principles are easy to agree with and hard to apply. These are the actual cases.

The activity	Our position	Why
Researching a company's public presence and announcements	In scope	Information about an organization, published for an audience, no individual is the subject.
Mapping a competitor's public infrastructure and hiring signals	In scope	Corporate research. See competitive intelligence.
Monitoring a named individual's accounts without a lawful basis	Refused	This is surveillance. It causes real harm and no business purpose makes it lawful on its own.
Locating a private person, or building a profile of their movements	Refused	Stalking is stalking regardless of the vocabulary used to commission it.
Consumer background checks under FCRA-regulated conditions	Refused	We are not a consumer reporting agency and our output is not a consumer report.
Circumventing a platform's terms, rate limits or authentication	Refused	Information behind an authentication boundary is not public, and accepting terms then breaching them is a contractual act.
Collection intended to harass, intimidate or retaliate	Refused	Purpose is part of legality. A lawful method with an unlawful purpose is not saved by the method.
Authorized, consent-backed screening of a business counterparty	In scope, with the basis recorded	Legitimate diligence with a documented basis, and the scope is stamped on the report.

Researching a company's public presence and announcements

Our position: In scope
Why: Information about an organization, published for an audience, no individual is the subject.

Mapping a competitor's public infrastructure and hiring signals

Our position: In scope
Why: Corporate research. See competitive intelligence.

Monitoring a named individual's accounts without a lawful basis

Our position: Refused
Why: This is surveillance. It causes real harm and no business purpose makes it lawful on its own.

Locating a private person, or building a profile of their movements

Our position: Refused
Why: Stalking is stalking regardless of the vocabulary used to commission it.

Consumer background checks under FCRA-regulated conditions

Our position: Refused
Why: We are not a consumer reporting agency and our output is not a consumer report.

Circumventing a platform's terms, rate limits or authentication

Our position: Refused
Why: Information behind an authentication boundary is not public, and accepting terms then breaching them is a contractual act.

Collection intended to harass, intimidate or retaliate

Our position: Refused
Why: Purpose is part of legality. A lawful method with an unlawful purpose is not saved by the method.

Authorized, consent-backed screening of a business counterparty

Our position: In scope, with the basis recorded
Why: Legitimate diligence with a documented basis, and the scope is stamped on the report.

The limit is structural rather than promised.

A policy that only exists in a document is a policy the product can ignore. Ours is built into the shape of the tool.

The Domain Footprint demo on this site accepts a domain and nothing else. There is no field for a name, an email address, a phone number or a username, and entering something that looks like a person is rejected with a message explaining why. You cannot misuse it, because there is no input through which to misuse it.

The platform follows the same rule. The unit of work is a scoped case, the scope is declared before collection, and the declaration is stamped on the report. When the subject is an organization and the collection is passive, the boundary is visible in the artifact itself rather than in a promise made in a sales call.

This costs us traffic deliberately. Queries like reverse email lookup and username search have very large search volume, and we do not build pages for them because doing so would fill the funnel with exactly the visitor we refuse to serve.

Four questions before any collection involving a person.

General information about how this category works rather than legal advice. Take your own advice for your jurisdiction and your matter.

Is the source genuinely public?

Public means published without an authentication boundary and without a term of service you accepted that prohibits the collection. A logged-in view is not public merely because anyone could make an account.

What is the purpose, written down before you start?

A purpose recorded first constrains the work. A purpose reconstructed afterwards is a justification, and it reads as one to anybody reviewing the file.

Whose law applies?

To the subject, to you, and to the data. Cross-border matters are where good intentions most often produce unlawful processing.

What is the lawful basis for personal data?

Under GDPR and similar regimes, legitimate interest requires an assessment you can produce, and consent requires it to have been freely given. "It was public" is not a basis.

Why a refusal list is a commercial asset.

Regulated buyers do not block OSINT tooling because it is technically weak. They block it because nobody can tell them what it will not do.

A general counsel evaluating an investigation platform is asking one question: what happens when somebody on my staff uses this badly, and what will it look like in a deposition. A vendor with no published boundary cannot answer, and the tool does not get bought.

Publishing named refusals answers it. So does a demo with no input that accepts a person, and a scope declaration stamped on every report. The FAQ covers whether OSINT is legal in more depth, and the security page sets out data handling, retention and the passive-collection guarantee.

More for security and risk teams

New to the category? Start with open source intelligence, then see how a scoped case runs or read the analyst notes on the blog.

Run one scoped sweep and see what a sourced finding looks like.

The demo is free, it takes a domain and never a person, and it produces the same evidence chain the paid report does.

See how a case runs

Passive collection only, from public sources.
A domain, never a person. There is no input for one.
Your case data stays yours. No card required.