Trust Center
What we collect, what we refuse, and how to hold us to it
Reputation work affects real people — our customers, and the reviewers, journalists and commenters who write about them. This page explains what Spy Monk processes, what it will never do, how AI is used, which security controls exist and which are still being built, and how to raise a concern. It is reviewed on every product, policy or legal change.
Updated By Drive Digital Editorial
Last reviewed 8 November 2026 · Legal claims sourced in our editorial log · Spy Monk does not give legal advice
Direct answer
What are Spy Monk's trust commitments?
Spy Monk processes only the data needed to run audits, monitoring and cases; never buys or sells personal data; never accesses private content without explicit permission; never tries to identify anonymous people; labels every AI output as an estimate; requires an authorised approval before anything leaves the platform; and refuses customers who use it to suppress genuine criticism.
- Archiving a mention in Spy Monk never deletes it at the source — and we say so everywhere
- Legal escalation requires review by a qualified professional before it can proceed
- If you believe Spy Monk is being misused against you, the grievance page is open to non-customers too
Data boundaries
The minimum needed to do the work
What we process
- Your account details: name, email, mobile number, organisation and team members.
- The entities you ask us to check: names, aliases, brands, websites and keywords.
- Publicly available content found in the sources covered by your audit or monitoring.
- Evidence and notes you upload to cases.
- Billing records needed to verify payments and credits — never card or UPI details, which stay with the payment provider.
What we do not do
- We do not buy or sell personal data, and we do not build advertising profiles.
- We do not access private messages, closed groups or accounts without your explicit permission through the platform's official consent screen.
- We do not try to identify anonymous reviewers or authors.
- Archiving a mention in Spy Monk does not delete it at the source, and we never claim otherwise.
Permissions and approvals
You decide who can see and do what
- Available now
Roles control access
Owner, Admin, Analyst and Viewer roles control who can view data, create cases and approve actions. Seats are set by your plan.
- Available now
Approval before anything leaves
No report, correction request, reply or legal step leaves Spy Monk without an approval recorded by an Admin or Owner naming the action and the recipient.
- Available now
Two-factor authentication
Available for every account with an authenticator app, with ten single-use recovery codes stored hashed. Required for platform administrators.
- Phase 2
Connectors through official permission screens
Connecting your own accounts will always use the platform's consent screen and show exactly what Spy Monk can read. Account connections are coming in Phase 2.
AI and human controls
AI sorts. People decide.
AI in Spy Monk does one job: it helps sort large volumes of public content so a person can look at the right things first. Sentiment, topic and risk labels are AI estimates and are labelled as such wherever they appear; when no AI provider is configured, a simpler English and Hindi word-list method is used and labelled too. A label is a prompt to read the source, not a conclusion about it.
AI output is never a legal opinion, never a finding that content is false, and never a verdict on a reviewer. The Reputation Health Index is deterministic arithmetic over those estimates — the formula is published and never changes between runs — so the AI influences inputs, never the score itself.
Two human controls sit above the automation. Every audit shows which sources were covered and which were not, so you can judge how complete the picture is before you act on it. And any legal escalation requires review by a qualified professional before it can proceed; until that review workflow exists, the platform refuses to mark a legal escalation as submitted rather than imply that a professional looked.
DRS does not train models on your data, and the only thing sent to an AI provider is the public text being classified — never your account details. The provider, its terms on API inputs and its data residency are checked when the provider is chosen and recorded in the privacy notice before launch.
Anti-abuse commitments
What we will refuse, and close accounts for
Spy Monk exists to help people and organisations understand and respond to what is said about them — fairly, lawfully and with evidence. We will refuse requests, and close accounts, that use Spy Monk to:
- write or buy fake reviews, or flood a business or person with coordinated reviews or reports;
- pressure, threaten or pay reviewers to change or delete genuine feedback;
- suppress accurate journalism, lawful criticism or public-interest information, or ask journalists to disclose confidential sources;
- create fake legal notices, impersonate lawyers, courts or authorities, or misrepresent court orders;
- stalk, profile or harass private individuals, or monitor anyone the customer is not authorised to represent.
These are not slogans; they are written into the Acceptable use policy, enforced by the approval gate and the audit log, and reflected in how we write: a reviewer we cannot match to your records is "unverified", a disputed article is "disputed". If you believe Spy Monk is being misused against you — whether or not you are a customer — contact us through the grievance page and we will look.
Security controls in place today
Protection you can check
Verified on the production stack; the detailed register with commands and results is maintained by our operations team. The platform page goes deeper.
- Available now
Workspace isolation
Each organisation's data is kept separate, and every request is checked against the organisation it belongs to.
- Available now
Encrypted secrets
Two-factor keys, account tokens and provider credentials are encrypted at rest with AES-256-GCM.
- Available now
Fingerprinted evidence
Uploaded evidence is fingerprinted with SHA-256 so changes can be detected; files are never overwritten.
- Available now
Rate limits and audit log
Sign-in attempts are rate-limited and key actions — authentication, billing, case transitions, member changes — are written to an audit log.
- Available now
Verified payments
Payments are verified with the payment provider's signature before credits or plans activate; production refuses to run without real gateway keys.
- Available now
Hardened hosting
TLS 1.2 and 1.3 only, strict security headers, non-root services on read-only filesystems, encrypted backups with a rehearsed restore.
Still being built
Controls we have not finished
We publish these so nobody has to take our word for the rest. Each is a production precondition with an owner.
- Real-time malware scanning of uploaded evidencePhase 2Executable file types are refused today.
- Write-once (object-lock) evidence storagePhase 2Evidence is already immutable through the API and the interface.
- Independent penetration testPending feasibilityA production gate.
- Manual screen-reader accessibility passPhase 2Automated accessibility checks pass today.
- Counsel review of the policy draftsPending feasibilityEvery policy page carries a visible draft banner until then.
- Phase 2
- Phase 23 items
- Pending feasibility
- Pending feasibility2 items
Security incidents
If something goes wrong
If we become aware of a personal data breach affecting you, we will tell you in plain language what happened, the likely impact, what we have done and how to reach us, and we will notify the Data Protection Board of India and each affected person as the Digital Personal Data Protection Act, 2023 requires.
To report a security concern, use the contact channel on the grievance page. Describe what you found and how to reproduce it. Please do not include passwords or one-time codes.
Questions
Trust questions
Does Spy Monk guarantee that negative content will be removed?
No. Platforms, publishers, search engines and courts make their own decisions under their own policies and the law. Spy Monk helps you prepare a clear, lawful, evidence-based request and records the decision, whatever it is. Any service that promises removal is promising something it does not control.
Will Spy Monk tell me who wrote an anonymous review or post?
No. We do not attempt to identify anonymous people and we do not combine public content with private data sources. Where the law allows, only a court or a competent authority can direct a platform to disclose such information.
Is Spy Monk a law firm?
No. Spy Monk is software that organises evidence and tracks cases. It does not give legal advice, and automated assessments are not legal opinions. Legal escalation requires review by a qualified professional, and consultations with independent advocates are pending feasibility.
I am mentioned in content shown in Spy Monk. What are my rights?
Public content about you is shown only to the customer who asked for the audit, with its source. If you want to raise a concern or make a personal-data request, use the grievance page; you do not need to be a customer. The draft privacy notice explains the legal basis and the questions still with counsel.
What is the right first step if I face extortion or threats?
Spy Monk is not an emergency or law-enforcement service. For cyber crime, including extortion or online harassment, report at cybercrime.gov.in or call the national helpline 1930. If anyone is in immediate danger, contact the police. Preserve evidence first; Spy Monk can hold it for you.
How often is this page reviewed?
On every product, policy or legal change and at least quarterly. The date in the header is the last review.
Hold us to this
If anything on this page is not true in your experience, tell us through the grievance page. We would rather fix it than defend it.
No card needed