Mailbox exposure monitoring

Adding an address

iOS: Exposure, the plus button at the top or Watch a mailbox in the list. The sheet offers the cadences the plan allows.
API/MCP: POST /api/darkweb/emails with { email, cadence }; tool add_dark_web_email.

Any valid address can be added, up to the plan's limit. The one refusal: an address at a domain that another DomainGuard account tracks and this account does not ("That domain is managed on another account"). The account's own verified sign-in address is always allowed. The rule keeps one customer from reading the breach exposure of addresses at a domain another customer manages.

Cadence

Cadence	Meaning
Manual	Checked only when you press Run check now
Weekly	Re-checked when the last check is more than 7 days old
Daily	Re-checked when the last check is more than a day old

Scheduled re-checks are included on every plan, Free included; Free's limit is the number of addresses (one), not the cadence. In the app a mailbox on a manual cadence reads "This mailbox: manual · daily available on Free".

Limits

Plan	Addresses	Manual checks per day
Free	1	1
Starter	5	5
Pro	10	10
Enterprise	50	50

Run check now (POST /api/darkweb/scan, tool run_dark_web_scan) refreshes every monitored address. When the day's allowance is used the button shows the server's own message with the reset time; existing results stay readable.

How a check works

DomainGuard sends the address to the XposedOrNot breach index to look it up. Results are cached for 24 hours and shared between accounts watching the same address, and the scheduled sweep spends a bounded number of upstream calls per hour (a paid index key lifts the cap). If the upstream refuses, the sweep stops for that tick and resumes on the next; nothing is recorded as "clear" because of a rate limit.

Storage and privacy

The address itself goes to XposedOrNot for the lookup. DomainGuard stores only a SHA-256 hash plus an encrypted copy that only the re-check can decrypt. Audit entries and push payloads carry the hash or a masked form (jo***@example.com), never the address. Removing an address (DELETE /api/darkweb/emails/:hash, swipe in the app) deletes both.

What is shown

Last check card: when it ran, how many exposures are waiting on you, and the cadence the watched mailboxes actually carry.
New and Reviewed exposures, grouped under the address they were found on, each row leading with the breach and when it happened.
Infostealer logs: any watched mailbox that turned up on a computer infected with password-stealing malware, from the same XposedOrNot results.
Watched mailboxes grouped by domain with cadence and last check. Swipe a mailbox to stop watching it; to change its cadence, remove it and add it again.

Alerts

A new breach listing a monitored address raises an alert on every plan. It lands in the Alerts feed and is pushed to the app (in the 8 a.m. summary while the morning summary is on), and it shows the address masked. A new infostealer log for the address raises its own "Password-stealing malware found" alert. There is no breach alert email. A first check of a newly added address never alerts.

Common questions

Can I watch my personal Gmail? Yes. Personal addresses are accepted; only addresses at a domain another DomainGuard account manages are refused, unless it is your own verified sign-in address.

A breach from 2016 showed up as new. New to this account: the address had not been checked before. Mark it reviewed once you have confirmed the password was changed since.