"Public" is doing a lot of work in the phrase "public data". It is worth being precise about what it covers, because the difference between lawful diligence and surveillance is not the technology. It is the source.
Public is not the same as free to use
Under the GDPR, personal data does not stop being personal data because it was published. A name in a company registry or an article is still information about a person, and searching it still needs a purpose and a legal basis. What public sources change is where the information may come from, not whether the rules apply.
What we read
Every family of sources in the pipeline is public by right: public and company registries, published press, open web data and public profiles. Nothing we crawl requires access that was not given to us.
That constraint is not a limitation we tolerate. It is what makes a finding usable as evidence rather than as a hint you cannot cite.
What we do not touch
- No content behind a login, a paywall or a privacy setting.
- No purchased breach data, whatever it is marketed as.
- No inference about health, beliefs or affiliations from what we read.
A source that has to be obtained quietly cannot be shown to a regulator. If it cannot be shown, it is not diligence.
Where the line between us falls
We provide the collection, the correlation and the record. The legal basis for running a search on a given person is yours: your obligation, your policy, your regulator.
That division is deliberate. We can tell you that a source is public and that a search happened at a given moment. Only you can say why that person was in scope.
What the record proves
Every search leaves a trace with its sources and its timestamps. Months later, when someone asks why a file was flagged, the answer is a document rather than a recollection.
What we do with what you ask
Your queries are yours. We do not train our models on customer material by default, we do not sell personal information, and we never use one customer's queries to serve another. A search run for your compliance team stays a search run for your compliance team.
How long a report lives
Reports live for the retention period you configure, then they are deleted. That period is a decision about your obligations, so it is set by you rather than fixed by us.
When a person exercises their rights
A person asking for access, rectification or erasure goes to you, as the controller. Any request that reaches us is passed straight to you, and we support you in answering it. The same line that divides the legal basis divides the relationship with the person searched.
- Public sources only: registries, published press, open web data and public profiles.
- No login-walled content, no breach data, no sensitive inferences.
- No training on your material by default, no resale, no sharing between customers.
- Retention you configure, and rights requests routed to you as controller.
Questions about OSINT and the law
Is OSINT legal under the GDPR?
It can be, when the sources are public, the search serves a defined purpose such as a legal obligation, and the data is kept no longer than needed. The pipeline handles the first part; the purpose and the legal basis belong to the organisation running the search.
Who is responsible for the search?
You are, as the controller who decides why a person is searched. 247IQ provides the collection, the correlation and the record, and routes any request from the person searched back to you.
Does 247IQ use our searches to train its models?
Not by default. Customer material is not used for training by default, personal information is not sold, and one customer's queries are never used to serve another.
How long are OSINT reports kept?
For the retention period you configure, after which they are deleted. The period follows your obligations, so it is yours to set.