Open-source intelligence is central to due diligence: registries, filings, court records, press, a company's web footprint. But open does not mean free to use. When we reviewed a widely used public directory of open-source research tools on 4 October 2026, 539 of its links were relevant to due diligence. Only a minority could be used by a service that returns data to its clients: many tools are active, target individuals or prohibit commercial use, and 102 links (19 %) were dead, unreachable or obsolete on the day of the check.
AnKre therefore applies a set of safeguards before any source is used in a file. They are part of the product, not a policy document next to it.
A single, documented purpose
- A source is called only within an open file and its scope: the target, its group, its directors, owners and counterparties. There is no exploratory search on a person outside a file.
- Each purpose has a documented legitimate-interest assessment. Where a client is under a legal obligation, such as anti-money-laundering screening, that obligation is the legal basis (GDPR Article 6(1)(c)).
- For a natural person, data is minimised to what the purpose needs: name, role, mandate and, where a register publishes it, a partial date of birth. Never a home address, personal contact details, photos or private life.
- No profiling outside the purpose: no people-search engines, no username enumeration, no facial recognition and no personal reputation score.
- Court decisions about companies may be used; for individuals, a public ruling is linked within the scope of the file, with human validation, and no file is built on the person (GDPR Article 10).
- The framework includes transparency towards the people concerned: a notice on open-source research and a register of the sources used (GDPR Article 14).
Licences and terms of use
- Returning data to a client is redistribution. A licence for internal or personal use is not enough.
- Free tiers that prohibit commercial use serve, at most, to evaluate a source.
- No scraping where the terms prohibit it, and text-and-data-mining opt-outs are respected (Directive (EU) 2019/790, Article 4(3)).
- No circumvention of paywalls, CAPTCHAs, rate limits or anti-bot protection: a source that refuses becomes manual or contractual.
- Data under share-alike licences stays in separate layers, displayed with attribution.
No data from leaks, passive observation only
Databases of stolen credentials and sites publishing stolen documents are excluded outright. AnKre's agents do not browse the dark web. A target's technical footprint is observed passively: no scan of its infrastructure without a written mandate.
Every value cites its source
- Each call to a source is logged with the request, the purpose, the time of collection and a fingerprint of the response.
- Every displayed value cites its source, its collection date and a link to the original.
- An aggregator and the primary source it copies do not count as two independent sources.
- The output of a language model is never cited as a source.
These rules have a cost: fewer sources, more manual steps, more licences. They are also what makes a finding defensible when the person concerned, a regulator or a court asks how it was obtained.