Business due diligence intelligence
What you give us, where it goes, and how long it stays — including the parts that are not finished. Written from the same record the engineering team works from, so it says what is true rather than what reads well.
You tell us which company to screen. We read public records about that company and produce a report. We do not delete that report automatically, because no automated deletion exists yet — if you want your case removed, write to us and a person does it. This page says the rest of it plainly, including the parts that are not finished.
About the company you want screened: whatever you choose to give. A legal name, trading and former names, a registration or tax number, an LEI, country, legal form, incorporation date, addresses, websites, email domains, a parent or group, your relationship to them, the value of the engagement, why you are screening, concerns you already hold, free-text notes, and reference pages about the company. All of it is optional except that a name or a registration number must be present — an order with neither is refused.
You may also name people and their roles. That is used to work out which company is which and to understand business relationships. EVULNABLE screens businesses and never individuals: no employment, tenant, consumer credit or other background screening on a person is performed, and we are not a consumer reporting agency.
About you: your email address and display name, and from the payment provider, the amount, currency, their reference for the payment, and the email address they verified. We never see or store your card details.
A screen reads public sources — company registers, the GLEIF index, SEC EDGAR, the US OFAC and EU sanctions lists, the UK Sanctions List published by the FCDO, and the Spanish official gazette. Those receive an ordinary web request that identifies EVULNABLE.
The AI stage sends your submitted details to Anthropic, our model provider, along with the evidence gathered so far. That includes any people you named and their roles, the concerns you wrote, and your free-text notes. If you would rather that did not happen, do not put it in the form: everything except a name or registration number is optional.
Payment is handled by Stripe and email by Resend. That is the whole list for this product — it is not the same list as EVULNABLE's vulnerability management product, which uses no model provider at all.
There is no automated deletion. No scheduled job removes a report, its evidence or a case. We would rather say that than print a retention period we do not enforce, and every report we deliver prints the same thing on its own cover.
What does exist: write to us and a person removes your case and its report. A report link expires, and can be revoked before it expires.
A short retention window is designed and waiting on legal confirmation of the number. When it exists this page will say so, and until then it says this.
No analyst reviews a report before it reaches you. Every report says so on its cover and calls itself a draft. Analyst review is planned and is not part of what you are buying today.
The model does not grade, rate or decide anything. It proposes research; EVULNABLE fetches every page it cites and checks the quoted text against that page before any claim is accepted. A claim whose page cannot be retrieved is rejected rather than softened.