How we handle your data
We only collect what we need to catch what’s hurting you.
LeakSource is built around data minimization. We don’t want your entire business in our hands — only the logs, exports, and evidence required to prove or disprove leaks, fraud, or compromise.
Data minimization
Scoped access
Defined retention
Secure deletion
High-level data categories
Depending on your case, we may work with:
- Revenue & transaction data — orders, refunds, redemptions, payouts.
- Account & session data — IDs, device fingerprints, IPs, login history.
- Program & loyalty data — points, coupons, discounts, redemptions.
- Operational logs — staff actions, admin changes, backend events.
We typically do not need full card numbers, full SSNs, or entire customer profiles. When possible, we ask you to send redacted or tokenized data.
Want to know if a dataset is safe to share? Email it in abstract (no real examples) to
inquiries@leaksource.us and we’ll tell you exactly what we do or don’t need.
Retention & deletion
Our default posture is: keep data just long enough to be useful, then kill it.
- Active engagement: data is stored for the life of the investigation.
- Stabilization window: limited retention to support follow-up questions.
- Destruction: your data is scheduled for secure deletion once the window closes.
If your legal, compliance, or HR team needs a different retention schedule, we’ll capture that in writing before work begins.