Footprint mapping
We assemble the profile an adversary would assemble — same sources, same tools — and show it to you in full. It is a confronting document by design.
Practice area 04
Digital privacy protection
Home addresses, family names, school runs, flight patterns, corporate filings and the data-broker profiles that assemble them into a target package. This is security work that happens to look like reputation work.
The exposure
Your address is probably for sale for less than a coffee.
People-search sites and data brokers assemble property records, corporate filings, voter and registry data, breach dumps and social activity into a single profile. For a principal with visible wealth, that profile is the first thing an extortionist, a process server or an aggrieved counterparty buys.
Most clients have never looked. The ones who do look are rarely relaxed about what they find.
What we remove or reduce
- Residential addresses and property ownership records
- Personal mobile numbers and private email addresses
- Spouse, children and household members named alongside you
- School, club and gym affiliations that reveal routine
- Aircraft, yacht and vehicle registrations linked to your name
- Historic addresses and relationship history on people-search sites
- Breach-exposed credentials circulating on paste sites and forums
- Geotagged photographs published by you or by others
Method
How the work runs
Broker removal
Opt-out and erasure requests across the major aggregators and the long tail of smaller sites that copy them. Under the PDPA and GDPR where it applies, many of these are obligations rather than requests.
Source hardening
Fixing what re-publishes the data: filings, registrations, DNS and WHOIS records, vendor accounts and social settings. Removal without hardening means it returns in ninety days.
Household extension
Family members are usually the weakest link. With consent, we run the same process for spouse, adult children and household staff.
Re-listing sweeps
Brokers repopulate. Quarterly sweeps catch re-listings before they age into search results and get copied onward.
Incident support
Where exposure has already been used — doxxing, extortion, stalking, impersonation — we work with your security counsel and, where appropriate, law enforcement.
Common questions
Straight answers
Is this legal, and does it actually work?
Entirely legal — most of it is exercising rights you already hold under data protection law. It works unevenly: major brokers comply, smaller ones stall, and some jurisdictions publish records that cannot be withdrawn at all. Realistically, this is about reducing exposure substantially, not achieving invisibility.
How long does it take?
The first sweep takes six to ten weeks, because brokers use statutory response windows in full. Meaningful reduction is visible after the first cycle. Because listings repopulate, most clients keep it running on a quarterly basis.
Can you remove company filings and registry data?
Rarely at source — corporate transparency regimes exist for good reason and directors' details are meant to be findable. What we can do is remove the scraped copies that aggregators build on top of the filing, which is what actually ranks and what actually gets bought.
Do you handle physical security too?
No, and we would be suspicious of a firm that claimed both. We work alongside your existing security advisers and hand over the digital footprint picture they need.
Private enquiry
See what an adversary would see.
The footprint map is the starting point. Most principals ask for it after somebody else's incident, not their own.