Open-source checks are a normal part of antifraud, KYC, hiring and counterparty due diligence. The same tool in the wrong hands becomes a surveillance tool. The difference is not the technology but the purpose, the legal basis and what happens to the data afterwards. Below is a practical set of rules we follow and expect from our clients.
1. Purpose first, scan second
Before you start, answer: why do you need this data and what decision will you make with it? "Check an applicant for a synthetic identity before issuing a card" is a purpose. "Find out everything about a person" is not. In Oracul the purpose is set when the scan starts, together with the seeds, and every request goes to the audit log.
2. The legal basis is yours
Oracul processes open data only, but the basis for checking a specific person is yours alone: a contract, a regulatory duty, consent, a legitimate interest. Without one, do not run the scan. What GDPR and similar laws require depends on your role and scenario, so check with your counsel. We sign a DPA on the Business and Enterprise plans.
3. Open sources only
- Public profile pages, open APIs, public commit metadata, public breach databases.
- No logging into other people's accounts and no collection behind a login: closed networks are marked "closed" and not touched.
- Telegram subscriptions are private and not collected; only public channels and mentions are visible.
4. Quiet: the person should not learn about the check from an email
Many services can be asked "does this email exist" by starting a password reset. The person gets an email, and a quiet check becomes an intrusion. In Oracul such modules are switched off and not available via the API: no password resets, no sign-up attempts, no notifications to the subject.
5. Minimum data leaves the server
Faces on avatars are compared with local models on the server; photos go nowhere. A prose summary is written by an external model, which receives only public names, city, bio, links and dates. Never emails, phones or breaches.
6. A namesake is not your customer
The most common OSINT mistake is attributing someone else's accounts to a person. It is not only inaccurate but unfair: a decision about one person is made on another's data. So every account has a confidence level and a reason, and rejected ones (namesake, someone else's name, another face, shared username) are shown separately. The analyst can mark "not them", and the whole branch found through that account leaves the profile.
7. Retention
Check data is needed for a decision, not forever. Scan results are kept for 30 days and deleted together with their files. If the decision is made sooner, erase the scan right away with DELETE /v1/scans/{id}.
Prohibited
- Surveillance, stalking, deanonymisation.
- Profiling private individuals without a legal basis.
- Discrimination in hiring, lending or housing.
- Reselling raw results.