Third Party Due Diligence
Analyze any company across compliance and cybersecurity dimensions
Loading your workspace
Analyze any company across compliance and cybersecurity dimensions
Run an analysis from the Search page to see results here.
Select an investigation to view its graph
Choose an investigation below, or create a new one to get started.
AI-powered executive reports with hash-based provenance tracing
Create an investigation on the Graph page, then return here to generate an AI-powered executive report.
All previous analyses and generated reports
| Company | Domain | Country | Score | Date | |
|---|---|---|---|---|---|
| No searches yet | |||||
| Version | Searches | Status | Files | Date | Actions |
|---|---|---|---|---|---|
| No reports generated yet | |||||
Third Party Due Diligence Platform
ClearTrace automates compliance screening and cybersecurity risk assessment across 200+ registries and data sources spanning 140+ jurisdictions. It enables analysts to quickly identify sanctions exposure, adverse media, cybersecurity weaknesses, and corporate structure risks for any counterparty — and to group related searches into investigations for collaborative deep research and executive-grade reporting.
When a company operates multiple domains or when the primary domain cannot be automatically resolved, ClearTrace lets you select all relevant domains before running the analysis. Cybersecurity checks are executed against every selected domain in parallel; the worst-case score across all domains is applied to ensure no exposure is missed. A real-time activity feed shows per-domain progress as each check completes.
Group searches into named Investigations and explore connections visually in the interactive D3.js graph. The graph surfaces entity relationships across all searches in an investigation simultaneously.
Select an investigation and trigger Deep Research: ClearTrace runs an AI-powered cross-entity correlation analysis, surfacing discrepancies, shared infrastructure, and red flags across all searches. Once complete, generate a professional executive report in PDF, HTML, or both.
| Source | Type | What it checks |
|---|---|---|
| OpenSanctions | Sanctions | OFAC SDN, EU FSF, UN SC, FATF & 70+ lists including PEP |
| World Bank Debarment | Watchlist | Debarment & cross-debarment enforcement actions |
| ICIJ Offshore Leaks | Watchlist | Panama Papers, Pandora Papers, FinCEN Files |
| GDELT | Compliance | Adverse media — fraud, corruption, bribery articles |
| Country Risk (FATF / CPI) | Compliance | Grey/black-list jurisdictions and corruption index |
| Companies House / OpenCorporates | Registry | Company registration, filings & director records |
| GLEIF / LEI | Registry | Global legal entity identifier & ownership chain |
| Wayback Machine | Compliance | Domain web-archive presence & first-seen date |
| SSL Labs | Cybersecurity | TLS certificate grade (A+ to F) |
| Mozilla Observatory | Cybersecurity | HTTP security headers & web hardening score |
| DNS Security | Cybersecurity | SPF, DMARC, DKIM email authentication posture |
| Have I Been Pwned | Cybersecurity | Known data breach exposure for the domain |
| VirusTotal / URLhaus / PhishTank | Cybersecurity | Malware, phishing, and malicious URL reputation |
| Shodan / AbuseIPDB / DNSBL | Cybersecurity | Open ports, IP reputation & blocklist exposure |
Scores run from 0 (no risk) to 100 (maximum risk). ClearTrace computes two independent scores — Compliance and Cybersecurity — and combines them into an overall rating.
Combined score = the worst (highest) of Compliance and Cybersecurity. If a check is skipped because no API key is configured, its points are excluded and the remaining checks are scaled proportionally so the total always stays 0–100.
| Check | Max pts | How it's calculated |
|---|---|---|
| Sanctions (OpenSanctions) | 35 | Match >85% confidence = 35 pts · Match 50–85% = 15 pts · No match = 0 |
| PEPs (OpenSanctions) | 15 | PEP match >80% = 15 pts · PEP 60–80% = 10 pts · No PEP = 0 |
| Country Risk (FATF + TI) | 15 | FATF blacklist = 15 · FATF grey list = 10 · TI CPI <30 = 11 · CPI >60 = 0 |
| Adverse Media (GDELT) | 15 | 0 articles = 0 · 1–3 = 5 · 4–10 = 10 · >10 = 15. Adjusted by negative tone. |
| Enforcement (World Bank + ICIJ + Companies House) | 20 | Active debarment = 20 · Historical = 10 · ICIJ hit = 10 · None = 0 |
| Bonus: Administrator sanctioned | +25 | If the company is clean but a director matches a sanctions list, +25 pts added to compliance score |
| Check | Max pts | How it's calculated |
|---|---|---|
| SSL/TLS (SSL Labs) | 20 | A/A+ = 0 · B = 5 · C = 10 · D/E = 15 · F/expired = 20 |
| Security Headers (Mozilla Observatory) | 15 | A = 0 · B = 3 · C = 6 · D = 10 · F = 15 |
| Email Security (DMARC + SPF) | 20 | No DMARC = 15 · DMARC p=none = 8 · p=reject = 0 · No SPF = +5 |
| Data Breaches (HIBP) | 15 | 0 breaches = 0 · 1–3 = 5 · 4–10 = 10 · >10 = 15 |
| Domain Reputation (VirusTotal + URLhaus + PhishTank + Safe Browsing) | 15 | Any malicious flag = 15 · Suspicious = 8 · Clean = 0 |
| Open Ports / Blacklists (Shodan + DNSBL + AbuseIPDB) | 15 | Critical ports (RDP, SMB, Telnet) = 15 · Blacklisted = 10 · Clean = 0 |
Not all nodes in the investigation graph carry the same risk weight. ClearTrace distinguishes three categories of datasets:
When ClearTrace queries OpenSanctions and similar screening databases, each match is assigned a confidence score (0–100%) reflecting how closely the returned record matches the searched entity name, alias, or identifier.
| Confidence | Risk weight | Interpretation |
|---|---|---|
| > 85% | Full (35 pts) | High-confidence hit — strong name or ID match; manual review required |
| 50–85% | Partial (15 pts) | Possible match — fuzzy name or alias overlap; further investigation advised |
| < 50% | None (0 pts) | Unlikely match — name similarity below threshold; treated as no hit |
Note: Matches found only in corporate registries (e.g. OpenCorporates, GLEIF, Companies House) are treated as registry-only and receive half the normal sanctions weight, as registry presence alone does not indicate sanctions exposure.
All API keys are encrypted at rest using AES-256-GCM before storage. Analysis results are cached locally and tied to your authenticated session. No search data or results are transmitted to third parties beyond the individual data source APIs you have configured.
ClearTrace is a decision-support tool, not a substitute for qualified legal, compliance, or financial advice. Scores and flags are computed from automated API queries and may be incomplete, delayed, or inaccurate. Match confidence values reflect algorithmic similarity — a high-confidence hit does not confirm identity, and a low score does not confirm the absence of risk. All results must be independently verified by a qualified compliance professional before any business or legal decision is taken. ClearTrace accepts no liability for decisions made on the basis of its outputs.
Configure AI provider and API keys for premium data sources
All keys are encrypted at rest. Optional — sources without keys will be skipped or use free tiers.
Route AI requests through Cloudflare AI Gateway for observability, caching, and rate-limit protection.
Change your ClearTrace login password.
You are about to delete:
this analysis version
This will permanently delete the Deep Research run and all associated report files. This cannot be undone.