Data & Privacy
NatusAI OSINT is a front end over public data sources. It does not hold an intelligence database of its own: nearly every panel answers by querying somebody else's service in real time. That has a consequence worth stating plainly, because it is easy to miss.
YOUR QUERY LEAVES THIS INSTANCE
When you look up an email address, domain or IP, that value is forwarded to the upstream provider that answers the lookup. The provider sees what you searched for, and the search itself can reveal what you are investigating. Self-hosting NatusAI OSINT changes who operates the front end — it does not stop these outbound queries. If the subject of an investigation is sensitive, treat every lookup as disclosed to the provider listed below.
AUTOMATIC IP GEOLOCATION
Three seconds after the dashboard loads, the browser calls /api/geo. The server reads your apparent IP address from the usual proxy headers and asks an external geolocation provider where it is, so the map can open near you rather than on the middle of the Atlantic. Interacting with the page before that — a click, a key press — cancels the request and the map stays where it is. Nothing about the result is written to your account, because there are no accounts.
WHERE DATA GOES
| Service | What is sent | When |
|---|---|---|
| ipapi.co, freeipapi.com, ip-api.com | Your apparent IP address | As the dashboard loads, to fly the map to your city |
| api.xposedornot.com | The email address you search | Breach lookups |
| cavalier.hudsonrock.com | The email or domain you search | Infostealer lookups |
| internetdb.shodan.io, stat.ripe.net, rdap.org, dns.google | The host, IP or domain you search | Infrastructure lookups |
| crt.sh | The domain you search | Certificate transparency lookups |
| api.github.com | The username you search | GitHub account lookups |
| otx.alienvault.com, cve.circl.lu, cveawg.mitre.org | The indicator or CVE you search | Threat and vulnerability lookups |
| Google Gemini | The feed context you submit for analysis, including Live Alerts headlines | AI briefing, analysis and overview requests, when the instance has a Gemini key |
| Telegram (cdn*.telesco.pe) | Your IP address, as with any image request | When you expand a Live Alert that has a photo or video preview |
| NOAA nowCOAST (nowcoast.noaa.gov) | Your IP address and the part of the map in view, as with any map tile | Only while the Live Clouds layer is switched on |
| DigitalDon (widget.digitaldon.net) | The token you search, and your IP address, as with any page you open. No referrer or site name is sent | Only when you run a DonBot token scan, in Markets → Crypto or RECON → DonBot. Its page runs sealed in its own frame, and counts its own usage there |
| The AI provider you choose for NatusAI (OpenAI, Anthropic, Google, OpenRouter, Groq, DeepSeek, xAI, Mistral or Alibaba Cloud) | Your API key; for a forecast, your question and any data you add (pasted text, or the text of files you attach, read in your browser), with the NatusAI OSINT headlines picked for it; for NatusAI Assist, the conversation, where the map is looking, which layers are on, and what NatusAI found on the map for you. Sent from the NatusAI OSINT server, not your browser, so the provider sees our address, not yours | Only when you run an NatusAI forecast, talk to NatusAI Assist, check a key, or question the panel, on the key you supplied |
| GDELT (api.gdeltproject.org), Wikipedia (en.wikipedia.org) and the news sites they point to | A few search keywords drawn from your forecast question, and requests for the articles found. Sent from the NatusAI OSINT server, not your browser | When you run an NatusAI forecast with research and live intelligence switched on |
| photon.komoot.io, nominatim.openstreetmap.org | The place name searched. Sent from the NatusAI OSINT server, not your browser | When you search for a place, or NatusAI Assist looks one up to take you there |
| Your browser’s speech recognition (in Chrome and Edge, a Google or Microsoft service) | Your voice, while the microphone is on. NatusAI OSINT never receives the audio, only the words it becomes, which you then send to NatusAI | Only when you press the microphone in NatusAI Assist. Firefox has no speech recognition, so the button does not show there |
Each service applies its own privacy policy and retention to what it receives. NatusAI OSINT does not control, and cannot undo, what an upstream provider keeps.
AI FEATURES
Briefings and correlation are produced by Google Gemini from the feed context the request carries. Do not paste confidential source material into them. A briefing is a language model's summary of its input: fluent prose is not verification, and the claims inside still need checking against the underlying feeds.
NatusAI runs on your own key. It stays in your browser (only this tab, unless you ask to be remembered on the device) and goes to NatusAI OSINT in a request header when you start a run, check a key or question the panel. The server passes it to the provider you chose for that request and holds it only while your run is going: it is not written to disk, logged or shown back. A run itself is not private: anyone with its link can watch it, and it is kept in memory for three hours after it ends. Its forecast is a simulation by language models, not a prediction anyone stands behind.
NatusAI Assist keeps the conversation in your browser tab, and only for as long as the tab is open. Each time it thinks, the conversation so far goes to NatusAI OSINT and on to your provider; the server does not keep it. What NatusAI does on the map (where it flies, which layers it switches, what it marks) happens in your browser. Replies read aloud use your browser's own voice, on your device.
WEBSITE ANALYTICS
When analytics is configured, this instance loads self-hosted Umami at analytics.natusai.com to measure visits and page use. Browser and device information, the page path and referrer may be sent to the configured analytics service. Search text, API keys, raw IP addresses, map coordinates and investigation content are not included in custom analytics events. Page query strings and fragments are removed before page views are recorded.
SCANNING
Active scans are rate limited, restricted to a safe subset, and blocked against private and reserved address space. That is a safety floor, not permission: scanning infrastructure you are not authorised to test may be unlawful where you or the target are located, and authorisation remains yours to obtain.
Branding and analytics notice updated: 4 October 2026.