Every month, we tell you whether you are safe.Avoid surprises. Protect your savings, security and privacy.
Try it now: a free self-assessment of your own email address against infostealer logs and known data breaches. We tell you how many issues we found; the monthly check takes it from there.
Every breach leaves a trace. Passwords, phone numbers, home addresses, the name of the laptop that got infected. VINDICIS finds them in under a second and tells you what to fix. You mark problems as resolved; every month we check again and warn you only if something new shows up.
How it works: three steps, then we re-check every month
- 1
First scan
Enter an email you own. Four public sources are queried in parallel and merged into one verdict in under a second: how many issues, how severe, what kind of data. Verify the inbox with a one-time code to unlock the details.
- 2
Fix it and mark it resolved
Change the exposed passwords, clean an infected device and mark each problem as resolved. The score counts only what is still open, not the past.
- 3
We re-check every month
We tell you whether you are safe and warn you only if something new shows up. If a scan finds a serious problem, we email you right away instead of waiting for the monthly report.
What the assessment looks at
Public, lawful sources only. Nothing is bought, scraped or guessed.
Infostealer infections
Records of malware families such as RedLine, Vidar and Lumma that harvested saved logins from a device.
Known data breaches
Which leaked databases include your address, when, and through which sources they are reported.
Exposed data classes
Whether passwords, phone numbers, addresses or other personal fields travelled with the address.
Password exposure
Check a password against known leaks without sending it anywhere. Only a 5-character hash prefix leaves your device.
Choose how to stay on top of it
The monthly check is the simplest way to know, every month, whether you are safe. The one-off audit is a single snapshot. Prices include VAT; Lemon Squeezy is the merchant of record.
Personal Cyber Tech Expert
Every month we tell you whether you are safe. A fresh scan, alerts on what is new and, on your approval, GDPR requests sent for you.
€14.99per month
VAT included. Secure checkout by Lemon Squeezy.
- Every month we tell you whether you are safe: automatic rescan and a PDF audit by email
- Immediate email if a scan finds a new, serious problem
- Mark problems as resolved: we warn you only about what is new
- Everything in the one-off audit
- Semi-automatic GDPR kit: approve once and we send access, erasure and objection requests to 60+ data brokers, telecom, energy and finance companies, with you in copy
- Tracker with deadlines, delivery status and one-click follow-ups
- Domain email security check and public-profile (Gravatar) check
- Up to 10 verified emails
- Cancel any time from the billing portal
We send and track each request on your documented instruction. Every company decides for itself, so removal is not guaranteed.
Details unlock only after you confirm a code sent to the address you own.
Running a business or a practice?
Small businesses, freelancers and professional practices get a monthly check of business email and domain, with alerts on serious findings.
Notable data breaches, explained
What leaked, how many accounts were affected and what to do about it. Facts come from the public Have I Been Pwned catalogue.
Under Armour
2025 · underarmour.com
72,742,892 accounts
- Dates of birth, medium risk
- Purchase history, medium risk
- Email addresses, lower risk
Free
2024 · free.fr
13,926,173 accounts
- Bank account numbers, high risk
- Dates of birth, medium risk
- Phone numbers, medium risk
Odido
2026 · odido.nl
6,077,025 accounts
- Bank account numbers, high risk
- Driving licences, high risk
- Government-issued IDs, high risk
Deezer
2019 · deezer.com
229,037,936 accounts
- Dates of birth, medium risk
- Email addresses, lower risk
- Genders, lower risk
LinkedIn
2012 · linkedin.com
164,611,595 accounts
- Passwords, high risk
- Email addresses, lower risk
Canva
2019 · canva.com
137,272,116 accounts
- Passwords, high risk
- Email addresses, lower risk
- Geographic locations, lower risk
Your personal privacy expert: we send the GDPR requests for you
Finding out you are exposed is half the job. Approve once and VINDICIS writes formal access, erasure and objection requests (Art. 15, 17 and 21) and sends them to the privacy contact of 60+ data brokers, telecom operators, energy suppliers and other companies. Every email carries your name, you in copy and your address for replies; the kit tracks the one-month deadline and sends follow-ups in one click. We act on your documented instruction, and each company decides for itself: we cannot guarantee that your data will be erased.
- To
- dpo@broker.example
- Subject
- Request for erasure of personal data pursuant to Art. 17 GDPR
I am the data subject identified by this email address. I request the erasure of all personal data you hold about me without undue delay, and I object to any further processing for marketing or profiling under Art. 21 GDPR. Please confirm completion within one month.
Built so we hold as little about you as possible
AES-256-GCM at rest
Emails and scan results are encrypted field by field before they touch the database.
Blind index lookups
Accounts are found through a keyed HMAC, so addresses never sit in plaintext to be searched.
Free scan is not stored
The address you test on the home page is not saved or logged. Results live in memory for four hours at most.
Self-hosted, no trackers
No analytics, no ad pixels, no third-party scripts or fonts. Your browser only talks to this site.
Passwords never leave the device
The password checker hashes locally and sends five characters. Account passwords are stored as Argon2id hashes.
Short-lived, scoped sessions
HttpOnly, Secure, SameSite=Strict cookie. No token is ever stored in the page.
Password and device checks, inside your dashboard
Check a password against known leaks without sending it, and see what your browser reveals. Both come with every paid plan.
Straight answers
What does “every month we tell you whether you are safe” mean?
With the monthly plan we rescan your addresses every month and send a report with a verdict: safe, attention or at risk. You fix the problems and mark them as resolved; we warn you only about what is new, and immediately if a scan finds something serious. We cannot guarantee you will never be attacked: we show what public sources know.
What happens after I change my passwords?
You mark the problem as resolved, or give the date on which you changed all of them: earlier breaches stop counting towards your score. If a new breach or a new infection appears, it comes back as an open problem and we tell you.
Can I check someone else’s email address?
No. VINDICIS is self-assessment software: it is meant for addresses you own or are authorised to check. The free verdict shows only counts and the kinds of data exposed, and the details are unlocked only for inboxes whose owner confirms a one-time code.
What do I see before I pay?
How many issues we found, how severe the worst one is, how many breaches and infostealer infections, and which kinds of data were exposed (for example passwords or phone numbers). Names, dates, devices and the action plan stay locked until you buy and verify the inbox.
Why do you ask me to verify my inbox?
Detailed breach and infection data could hurt the person it describes if it reached the wrong hands. Verification proves you can read the inbox, so the full audit only ever goes to its owner.
Where does the data come from?
From public sources: Hudson Rock (infostealer records), LeakCheck and XposedOrNot (breach databases) and Have I Been Pwned (password hash ranges). We do not buy data or run our own crawlers.
Do you store the address I scan on the home page?
No. It is processed to run the query, the result is cached in memory for up to four hours under a keyed hash, and nothing is written to the database or the logs.
What does a clean result mean?
That none of the sources that answered knows about your address. It is not a guarantee: breaches are discovered late and some sources can be unavailable. We tell you when a scan is partial and never show a failed source as clean.
What exactly does VINDICIS send for me?
With the monthly plan you fill in a requester profile and accept a written mandate. You then choose the type of request (erasure, stop marketing, access, withdraw consent) and the recipients, and review a sample letter. We send each email to the company’s published privacy contact, in your name, with you in copy and replies going to your address. Companies that only accept a web form are handled as guided manual steps.
Will my data really be deleted?
We cannot promise that. Each company decides on your request and may keep some data where the law requires it, for example for contracts or credit reporting. VINDICIS makes the request, tracks the one-month deadline, lets you send follow-ups and helps you complain to your authority if they stay silent.
Can I cancel the monthly plan?
Yes, at any time from the billing portal. You keep access until the period you paid for ends. You can also revoke the sending mandate whenever you like.
Can VINDICIS look people up for me?
No. It is software you run on your own data. The requests it sends are yours, about your own data. We never look other people up on your behalf.
Every month, you know whether you are safe.
Start with a free check: it takes less time than resetting a password.