What Compromised does, and what it does not claim.

Frequently asked questions

What does Compromised search?

Email addresses, usernames, full names, phone numbers, IPv4 or IPv6 addresses, government ID, driver's licence, vehicle identification numbers and licence plates. Passwords are checked separately and never leave your browser. Social security numbers are not searchable. Coverage varies by identifier type: the provider holds far more data about some than others, so a zero result on a less common type says less than a zero on an email address.

Does a zero result mean I am safe?

No. A zero means the configured provider reported no match at that moment. Provider coverage changes, some responses are partial and labelled as such, and no breach service can prove an identifier has never been exposed.

How are searches counted?

One search is reserved before the provider is called, so two simultaneous requests can never spend the same slot. If the provider fails, the reserved search is returned to the pool it came from — you are not charged for a search that produced no answer.

What happens when my monthly searches run out?

Your recurring allowance is always spent first. Once it is exhausted, purchased credits are used. If you have neither, the search is refused before the provider is called rather than being run and billed afterwards.

How do Search Credits work?

A credit pack adds a fixed number of searches to a separate balance. That balance is only drawn on after a subscription allowance for the current period has run out, so an allowance that resets is never wasted. Credits work without a subscription too.

Do credits expire?

No. Purchased credits have no expiry date in the system — there is no scheduled job, no timestamp and no rule that removes them. They remain on the balance until they are spent or refunded.

What is included in Pro?

A recurring monthly search allowance, normalized breach detail rather than counts alone, and an explicit, audited reveal of your own stored query value. The exact allowance and capabilities of each plan are shown on the pricing page, which reads them from the live plan catalog rather than from fixed copy.

How does annual billing work?

You are charged once a year, and the search allowance still resets every month. Billing frequency and allowance period are deliberately separate concepts in the system: an annual plan is not a year's worth of searches to spend at once.

Can I cancel?

Yes, from the customer portal reached through your billing page. Cancellation is handled by the payment provider, which hosts checkout and subscription management.

What happens after I cancel?

Access continues until the end of the period you have already paid for, then stops. Purchased credits are unaffected: they belong to a separate balance and are not removed when a subscription ends. Your search history remains readable while your account exists.

How do refunds affect credits?

A refunded credit purchase reclaims those credits from your balance. If some were already spent, only what remains is reclaimed and the shortfall is flagged for manual reconciliation rather than pushing the balance negative.

How is my data protected?

Search values and resolved client IP addresses are encrypted with AES-256-GCM before any history record exists. Exact-match lookup runs over keyed hashes, so the searchable index never contains the identifier itself. Response fields are filtered by entitlement on the server — the browser is never trusted to hide anything.

Do you store the values I search for?

Yes, encrypted, so that your own history is readable by you. The stored value is masked in listings and decrypting it requires an explicit, audited action. It is never written to application logs, analytics or webhooks in plain form.

Do you show leaked passwords?

No. Revealing raw credentials is outside the product scope. Results are normalized into breach names, dates, severity and the categories of data involved. The separate password exposure check never receives your password at all — it is hashed in your browser and only a five-character fragment of that hash is sent.

Do I need an account?

For a breach search, yes, and an active plan or credits. Authentication alone does not grant searches — there is no free tier. The password exposure check is free and needs no account.

Is this continuous monitoring?

No. Every search is a point-in-time check. There are no alerts, saved searches or background scanning.