Three deployment models.
No per-seat pricing.

Threat actors delete posts after disseminating them — to clean their trail. Credential leaks, pre-attack coordination, recruitment messages, and disinformation seeds disappear from Reddit's own API within hours. Our archive captures and indexes content before deletion. For investigations, this is often the difference between a full behavioral record and a gap in the timeline.

Yes. The legal framework rests on five pillars. (1) GDPR Art. 6(1)(f) legitimate interest: the three-part test is met — legitimate purpose (security intelligence, threat detection, investigative support), necessity, and proportionality (only publicly accessible data, no individual commercial profiling). All collection occurred without bypassing authentication controls. An Art. 14 GDPR notice is published on our site with a deletion request mechanism. (2) Terms of service are unenforceable against a non-signatory: CA Paris, 2 Feb. 2021 (LBC France v. DIRECTANNONCES, n° 17/17688) rejected all of LeBonCoin's ToS, sui generis and unfair competition claims despite scraping 89% of its listings multiple times daily. Meta Platforms v. Bright Data (N.D. Cal., Jan. 2024) confirmed ToS do not apply to logged-off scraping of public data — Meta subsequently dropped all remaining claims including for millions of Instagram records. (3) Ghost data was lawfully collected: content was publicly accessible at the point of archiving; no authentication barrier was crossed. hiQ Labs v. LinkedIn (9th Circuit, Apr. 2022) confirms public data scraping does not constitute unauthorized access. (4) Sui generis database rights (CPI Arts. L.341-1/L.342-1, EU Directive 96/9/CE): substantial investment in building and maintaining the archive creates an independent layer of protection. (5) No US CLOUD Act exposure: data is hosted and incorporated in Europe under French law and is not compellable by the US DOJ (18 U.S.C. §2523) — a structural requirement for European government and defence customers.

Nothing. We do not collect, track, store or process any inbound or outbound customer data. Only API request volume and type are counted, for billing purposes.

Yes. The Sovereign Instance tier deploys on-premise or in your sovereign cloud, with dedicated compute and storage. No multi-tenancy, no data egress, full air-gap support; built for classified and Five Eyes-compliant environments.

THINKPOL is not a consumer product. Access requires vetting and a contractual agreement. We work with national security, law enforcement, CTI teams, defense agencies, regulated financial institutions and corporate security functions.

Sub-300ms API response times, 99.9% hardware uptime SLA, 10-second data refresh rate. Hosted on Hetzner EU. Empty or zero results are eligible for prorated SLA reimbursement on request.

The space between the open internet and the dark web. Reddit, Telegram, Discord and unindexed forums where threats, counterfeits, leaked credentials and coordinated campaigns take shape — in plain sight, but outside the reach of conventional monitoring tools.