Follow the records.
Know the limits.

Start with the original record

Prefer court documents, regulatory filings, original security research and dated company disclosures. Identify mirrored documents and the precise paragraph or page. A complaint records allegations; an agreement records its terms; neither is automatically a judgment on every claim.

Show the connection and the response

Identify whether a person was an owner, director, employee or contractor at the relevant time. Attribute documented conduct and give the company’s published response. A former role, nationality or an association alone is not evidence of customer surveillance.

Track changes and missing evidence

Distinguish the operator at the time from later owners, retained records from new targeted collection, and one product from another. Record remediation as reported until independently checked. Unknowns stay visible. This first selection is not an exhaustive court-docket or beneficial-ownership investigation.

Keep commercial incentives out of findings

Providers with and without affiliate programs receive the same evidence treatment. Case counts measure this selection’s coverage, not risk. No secret-access claim, guilt score or “clean history” badge is inferred from missing information.