Digital risk protection · Onboarding
A questionnaire, a few documents, and one decision about takedowns
The service can only protect what it knows is yours. Onboarding is where your digital footprint is written down, so that a lookalike of your domain is recognised as a lookalike and your own new microsite is not reported as one. It asks for the brands and assets to watch and who should use the portal, plus a little more depending on the package, and it takes your team less time than the kick-off meeting.
What we ask for
The questionnaire arrives within two business days of the order and takes about 10 to 15 minutes. What it asks depends on the modules you take.
| Module | What we need |
|---|---|
| Brand impersonation (web, social media, apps) | Brand and company names, logos, trademarks and service marks · the domains and subdomains to monitor, and the ones to allow-list · your genuine mobile apps · your official social media accounts and the key people whose profiles we should protect |
| Dark Web Watcher | Your corporate email domains · private email addresses of key people, where you want them monitored · payment card BIN ranges, if you issue cards |
| Executive Cyber Guard | For each executive: full name, title, corporate and personal email addresses, social media profiles, · optionally a clear photograph for facial recognition, phone numbers, ID or passport numbers, and home and work addresses |
| All modules | The people at your end who should have portal access, with their contact details and role |
None of it requires access to your systems. Everything on the list is information you already publish, or information about your own people that you choose to give us.
The documents that let us act in your name
A phishing site can usually be reported to its registrar and host on the strength of the evidence alone. Social media platforms are stricter: they want to see that whoever reports an impersonation is entitled to complain about it. And when a phishing site stays up, the next step is a trademark complaint, which needs the trademark. So we ask for two things once, at the start.
- Trademark documents for the brands in scope, and the logos we should recognise.
- A certificate of authority, a short signed letter that authorises the analysts to file takedown requests on your behalf. We send you the template with the questionnaire.
With these on file, a fake profile is reported through the platform’s own impersonation process with your documents attached. Without them, the analysts can still report it, but only through the ordinary “report this account” menu from their own designated accounts, which is the weaker route.
Your takedown policy
Before the service goes live you choose how takedowns are approved.
Standing takedown order
You authorise the analysts in advance to act on any finding that falls within agreed limits, for example confirmed phishing sites using your brand. They typically act within hours, during analyst working hours, without waiting for a ticket or a purchase order on your side, and you see each case in the portal afterwards.
Case by case
Where a finding can be taken down, you request the takedown in the portal, and nothing happens until someone on your side does.
A sensible way to start is a standing order for confirmed phishing sites and case-by-case approval for everything else, widening the standing order once you have seen what the findings look like. You can change the policy at any time.
From kick-off to a quiet alert feed
- Onboarding (one to two weeks). The profile is built from your questionnaire and the searches are configured.
- Kick-off. A meeting with the customer success manager, a walkthrough of the portal, and an introduction to the service. Spirity joins it and stays your contact afterwards.
- Portal access. Your named users get credentials with multi-factor authentication, each with a role: admin, editor or viewer.
- Tuning (14 days). Collection runs from day one. The first fortnight is spent adjusting the searches with your feedback, adding allow-listed domains, and removing patterns that are yours, until the output is accurate rather than noisy.
From order to live service, the average is two to three weeks; the 14-day tuning period follows.
Optional integrations
Onboarding is also the moment to switch on any of three optional integrations. Each reuses something you already run: a script on your login page, your abuse mailbox, or your web logs. They are described on the detection page.
Keeping the footprint current
The profile is only as good as the list behind it. When you register a new domain, launch an app, open a new social account or appoint a new executive, tell us, and it goes into scope. When you stop using a domain, tell us too: an abandoned domain that lapses and gets re-registered by somebody else is one of the most convincing lookalikes there is.
Where this stops
An incomplete list means incomplete coverage. If a brand name or an app is missing from the questionnaire, nothing impersonating it will be recognised as an impersonation. The tuning fortnight catches some gaps, but it cannot catch a brand nobody mentioned.
The portal is in English. So is everything the analysts write. Your Spirity contact works in Hungarian or German, and so do the walkthroughs, but the people who use the portal daily need to be comfortable reading English.
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
No. The questionnaire asks for the brands and assets to watch and for the names and contact details of the people who should use the portal; depending on the package, it asks for a little more, such as private email addresses you want monitored. The optional integrations are a script on your login page, forwarding your abuse mailbox, and sharing referral logs, and you decide whether to use them.
Collection starts as soon as the questionnaire is back, so alerts can arrive in the first days. Expect them to be noisier during the 14-day tuning period than afterwards; that is what the period is for.
Yes. Changes to the footprint are made through a service request in the portal or by telling your Spirity contact. Whether an addition fits within your package depends on what it is; brands and executives are counted, domains are not.
The rest of the service
How it works
Five stages, who does what, how long it takes to start, and where the limits are.
Detection
Passive DNS, criminal chat groups, the dark web, app stores and breach data, ranked before an analyst looks.
Validation
Every finding is reviewed by an analyst: false positives removed, evidence attached, an action recommended.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.