Browser
Holds what you type and receives only the server-authorized DTO. No global analytics provider receives the search value through the event contract.
Request to result
One search. Six observable boundaries.
The browser collects the request. The server owns authorization, normalization, persistence, and visibility. The provider supplies a signal, not a guarantee.
Current scope
Nine identifier types: email, phone, username, full name, IP, government ID, driver's licence, VIN and licence plate. Passwords are checked separately, without ever being transmitted. No social security numbers, no credential reveal, no continuous monitoring, no saved alerts and no domain scanning.
Search request flow
- 01
Submit a supported identifier
The public form accepts an email address, username, full name, or IPv4/IPv6 address. It posts the selected type, the exact value, and—when required—a Turnstile token as JSON to the search API. The value is not placed in a route or query string in the browser.
Input is bounded to 256 characters. Normalization validates the value and builds a stable blind index later; it does not replace the exact value sent to the provider.
- 02
Authorize and reserve usage
A signed-in request resolves the Auth.js session subject against MongoDB and atomically reserves usage under the current entitlement. An anonymous request must pass the breach-search Turnstile action and have a network scope the server can meter.
Free, active-access, and anonymous allowances are server policy. The client cannot grant detail visibility or increase a counter by changing UI state.
- 03
Call the configured provider
The server sends the type and exact value over HTTPS to the configured breach intelligence source. The adapter declines redirects, applies a timeout, bounds the response body, and maps upstream failures to a generic unavailable response.
This is a third-party, point-in-time lookup. Compromised does not operate an independent comprehensive breach corpus and cannot establish the provider’s total coverage.
- 04
Normalize the upstream response
Only allowlisted fields survive: bounded breach names, valid calendar dates, non-negative affected-record counts, derived severity, and known data-class categories. Unknown keys, arbitrary prose, query echoes, unsafe names, and excess rows or fields are discarded or reduced.
A reduced or oversized response is marked partial and truncated. The reported count can therefore be larger than the list of normalized breach summaries.
- 05
Persist before returning data
The exact query and any resolved IP are encrypted with authenticated encryption, and purpose-separated HMAC blind indexes are stored with key and normalization versions. If persistence fails, provider findings are not returned to the browser.
Every search stores its encrypted search record. A normalized result snapshot is also stored only when MongoDB transaction support has been explicitly enabled, so the two writes remain atomic.
- 06
Filter the result for this account
The server builds a DTO from current capabilities. Summary visibility, detailed fields, explicit saved-query reveal, billing management, and owner history are independent decisions. Hidden fields are omitted on the server rather than sent and covered with CSS.
History reads require the record owner. A reveal additionally requires an explicit action and records the actor, record, field, and reason without logging the plaintext.
Who sees what
The raw query crosses two server-side boundaries.
Compromised server
Sees plaintext to validate and call the provider, then encrypts persistence fields and applies account, usage, ownership, and response policy.
Breach provider
Receives the supported type and exact value for the requested lookup. Its raw response stays server-side and is reduced to the normalized contract.
Read the state before the count.
- Complete zero
- The provider returned no entries and normalization did not detect a reduced response. This is still not proof that the identifier was never exposed.
- Complete result
- All provider entries fit the accepted bounded schema for this request. Accuracy and provider coverage remain external limits.
- Partial result
- Some provider material was dropped, reduced, or exceeded a bound. Treat the visible list as incomplete.
- Snapshot unavailable
- The search record exists, but normalized provider-time details were not persisted. The application does not reconstruct or invent them later.
Use the result as a prompt for safer action.
Change reused passwords at the affected service, enable multi-factor authentication where available, and review account activity. Never submit the password itself to Compromised.