What you can expect from this site,
and what it does not do for you.

01Who these terms are between

They are between you, as someone using this website, and Avantis Data Solutions LLC, a Pennsylvania limited liability company doing business as ObscureIQ.

They cover this website: the pages, the free instruments, the research library and the forms. They do not cover an engagement. If you become a client, the agreement you sign governs the work, and where that agreement and this page differ, the agreement controls.

Using the site means these terms apply to you. If you do not accept them, the remedy is the ordinary one: close the tab. Nothing here asks you to create an account or to agree to anything in order to read.

02What this site is, and is not

It is a description of what the firm does and a library of what it has published. It is not advice, and reading it does not make anyone safer by itself.

Nothing on this site is legal advice, security advice, investment advice or a professional recommendation for your situation. The field guides and research are written for a general reader facing a general version of a problem. Your version has particulars, and the particulars are usually what matters.

We also do not promise erasure, here or anywhere. The firm's published standard is the operative statement:

03The free instruments

A score is a reading, not a verdict.

The Hostility Index, the Threat Surface Index and the Breach Risk Index are published as instruments anyone can use. They are calculated from what you tell us and from what is publicly observable, and they can be wrong in both directions. A low reading is not a statement that you are safe, and a high one is not a prediction that something will happen to you.

They are estimates offered in good faith and without warranty. Decisions with consequences deserve more than a number from a web form, which is the same thing the Limits section of each instrument says in its own words.

A reading is yours. We do not publish it, sell it, or attach your name to it.

04The research library and the breach corpus

A corpus entry records what has been observed in circulation at a point in time. It is not a finding of fact about any company.

The Circulating Data Breaches corpus, the Command Briefs, CODEX (our index of the companies that collect, trade and monetize personal information) and the research hubs describe incidents, entities and infrastructure as we have observed and assessed them at a point in time. Every brief states its confidence, and an entry marked provisional is exactly that.

Where an entry names an organization, it describes a breach or a practice attributed to it on the evidence available. It is not an allegation of wrongdoing beyond what the entry says, and it is not a legal conclusion. If you are named and believe an entry is wrong, write to us and we will look at it. We would rather correct a record than defend one.

Scores and classifications change as evidence changes. A figure published today may be revised, and a record under re-audit carries no published figure at all.

05Contacting us does not make you a client

Sending a message through this site creates no engagement, no retainer, no duty of care and no privilege.

We may decline a matter, and we would rather say so on a short call than after taking a retainer. Nothing on this site is an offer to act for anyone.

06Acceptable use

Two prohibitions are specific to what this site publishes. The rest is the ordinary list.

• Do not use the instruments to assess somebody else. A hostility reading is a measure of the attention a person attracts, which read in the other direction is a targeting aid. The instruments are for assessing your own exposure, or that of someone you are responsible for protecting. Using one to profile a person you are pursuing, investigating without authority, or intending to harm is a misuse of it, and we will not help you do it.
• Do not bulk-extract the research or the corpus. Read it, cite it, quote it, link to it. Do not scrape it, mirror it, or repackage it as a dataset or a product. The corpus exists so that people can check a claim, not so that it can become somebody else's feed.
• Do not attack the site or attempt to reach systems or data you are not authorized to reach. Testing in good faith and telling us what you found is a different thing, and is welcome: write to security@obscureiq.com, and the Data Security Statement says what happens next.
• Do not impersonate the firm, its people, or anyone else, and do not use the site to harass, defraud or threaten.

07What belongs to whom

The published research is ours. What we produce for a client is the client's, on the terms of their agreement.

The text, design, instruments, indexes, briefs and research on this site belong to ObscureIQ or to the people we licensed them from. The marks, including ObscureIQ, Obscurity and ThreatWatch, are ours.

You may read, quote and cite this material with attribution, and you may link to any page. You may not republish it wholesale, present it as your own, or build a competing product out of it. If you want to use something more substantially than that, ask; the answer is often yes.

If you send us a suggestion or a correction, we may act on it without owing you anything for it. That is not a claim over anything else you send us, which section 05 and the Privacy Notice cover.

08Links and material from elsewhere

We link out to sources rather than embedding them, and we do not control what is on the other end.

Where we cite a court filing, a vendor's own documentation or a news report, the link is there so you can check us. It is not an endorsement, and the content, the accuracy and the privacy practices on the other side are not ours. A page we linked to last year may say something different today.

09Disclaimers, and the limits of what we owe

This site is provided as it is. We maintain it carefully and we do not warrant it.

We do not warrant that the site will be available without interruption, that it is free of errors, or that anything on it is current, complete or fit for a particular purpose. Research is published at a point in time and the ground moves.

To the extent the law allows, ObscureIQ is not liable for indirect, incidental, special, consequential or punitive damages arising from your use of this site, and our total liability arising from the site is limited to the amount you have paid us for the use of this site, which for a reader is nothing. That limit applies to the website. It does not limit what we owe a client under a signed engagement, and it does not exclude anything the law does not permit us to exclude, including liability for fraud or for death or personal injury caused by negligence.

Some jurisdictions do not allow certain exclusions, in which case the exclusions that are not allowed do not apply to you and the rest stand.

10If something goes wrong between us

Pennsylvania law, Erie County courts, and no arbitration clause.

These terms are governed by the laws of the Commonwealth of Pennsylvania, without regard to its conflict of laws rules. Any dispute arising from this website will be brought in the state or federal courts sitting in Erie County, Pennsylvania, and we both consent to those courts.

Those three clauses are close to universal in terms of service, and they are deliberately absent here. Our clients include survivors, whistleblowers and people who are being pursued. Opening a relationship with them by removing their access to a judge is not a position this firm is willing to take for the sake of boilerplate.

Before filing anything, tell us. Most disagreements are a misunderstanding and a phone call, and section 12 is how to reach a person.

11Changes, and the rest of the housekeeping

We may change these terms. The date at the top says when the current version took effect.

Material changes will be posted here before they take effect. Continuing to use the site after that is acceptance of the revised terms, and the previous version stays available for comparison.

If any part of these terms is held unenforceable, the rest stands. If we do not enforce something immediately, that is not a waiver of it. These terms, together with the Privacy Notice and the Data Security Statement, are the whole of what governs your use of this site. You may not assign them; we may, to a successor to the business, and the Privacy Notice says what happens to personal data if that ever occurs.

12Reaching a person

Three addresses, each answered by someone who can do something about what you sent.

If you are named in the research and believe an entry is wrong, write to info@obscureiq.com with "Correction" in the subject line. Corrections are handled by the people who wrote the entry.