Overview
Before Verusight reveals any credential exposure data for a domain, we require you to prove you own or control that domain. This is a deliberate security decision — not a limitation.
Why Verification Is Required
Credential exposure data contains sensitive information: email addresses, passwords, and the services where those credentials were used. If this data were accessible without verification, it could be misused to:
- Harvest employees' passwords from a competitor's domain
- Target individuals with credential stuffing attacks using their exposed passwords
- Conduct social engineering using knowledge of which services employees use
Domain verification ensures that only authorized personnel can access this data.
How Verification Protects You
When you verify a domain, you're proving one of the following:
- You control an email account at the domain (smart verification or email code)
- You have DNS management access (DNS TXT record)
- You have web server access (file upload)
Each method proves a different level of administrative access to the domain — all sufficient to establish ownership.
Who Can See My Domain's Data?
Only the Verusight account that has successfully verified a specific domain can view exposure data for that domain. This means:
- Your data is not visible to other Verusight users, even if they also verified the same domain on a different account
- Each account's verification is independent
- There are no shared views or cross-account data access
Restricted Domain Types
Some domain types have additional restrictions to prevent misuse:
.edu,.gov,.mil,.acdomains cannot use Smart or Email verification — they require DNS or file verification, which proves a higher level of administrative access- This prevents a student or low-level employee from accessing breach data for an entire institution