What The Open Internet Already Knows About You

An exposure check answers one question. If a stranger decided to look you up today, what would they find, and what could they do with it?

Most people assume the answer is "not much". It usually is not.

Where it comes from

Almost none of this comes from anywhere dramatic. It accumulates quietly, from six ordinary places:

Data brokers. Companies whose entire product is a profile of you, assembled from public records, loyalty schemes, app permissions, and each other. Most operate legally, and most offer an opt-out if you know they exist.
Old breaches. Credentials from a service you forgot you signed up for, still circulating years later in combined lists.
Public records. Property, company filings, court records, registries. What is public varies enormously by country, and in Switzerland it varies by canton.
Accounts you abandoned. A forum profile from 2013 still carrying your username, your city, and a photo you have reused ever since.
Metadata. Photos with location coordinates attached. Documents with your full name and employer sitting in the file properties.
The people around you. A relative's public friends list. A colleague posting a team photo and tagging you in it.

The risk is the join, not the pieces

Individually, none of it looks like anything. A username here, a city there, a photo of a street.

Then it joins up. A username reused across three sites links an anonymous account to a real name. A photo taken in your garden gives a neighborhood. A work history gives an employer and a routine. Together, someone can work out roughly where you live, who you live with, where you will be on Tuesday morning, and the answer to at least one of your security questions.

That is the same method we use in Digital Investigations to identify people who harass others. It works in both directions, which is exactly the point.

What can actually be removed

Be skeptical of anyone who promises to erase you from the internet. Honestly, here is what tends to be possible:

Broker records: usually yes. It is slow and repetitive, and they refill over time, but opt-outs do work.
Old accounts: usually yes, if you can still recover access to the email behind them.
Search results: sometimes. Delisting is possible in some jurisdictions and for some categories of information.
Public records: rarely. If the law says it is public, it stays public.
Anything already copied: no. Once something has been scraped and mirrored, removal at the source does not reach the copies.

A good exposure review tells you which bucket each finding falls into, so you spend effort where it changes something.

Five things worth doing this week

Search your own name in quotes, then again with your city, then again with your employer.
Check your main email address against a breach index, and change any password you reused after a hit.
Reverse image search your profile photo. If it appears somewhere you did not put it, that is worth knowing.
Log out, or open a private window, and look at what your own accounts show a stranger.
Turn off location data on your camera, and strip it from photos before posting.

When it is worth getting help

Do it yourself when you are curious and nothing has happened yet. Get help when something has: an account you do not recognize using your name, a person who seems to know where you are, a job or a deal that fell apart for reasons nobody will explain.

Our Personal Exposure work maps what is findable about you, ranks it by what it actually enables, and gives you a removal plan in order of impact. Nothing is accessed that is not already open.

Write to us. It stays confidential, and we will tell you honestly whether it is worth doing before anything starts.