Answers about Norphluchs

A responsible background-intelligence workflow

The strongest background-intelligence process starts with the decision, not the data source. Use the workflow below to keep each assessment focused, proportionate and reviewable.

1. Define the decision and purpose

Write down why the assessment is being performed and what decision it is intended to support. Avoid broad research without a clear business purpose.

• What do we need to verify or understand?
• Why is this information relevant to the role, transaction, relationship or documented concern?
• Who is authorized to initiate and review the assessment?

2. Select a proportionate scope

Choose the modules that answer the specific question. A focused assessment should use fewer data categories than a broad one. Scope can depend on the person’s role, level of access, jurisdiction, internal policy and the questions your team needs answered.

3. Collect and structure findings

Norphluchs searches the selected intelligence and verification environments and presents the available results in a structured form. Automated modules may return findings within minutes; candidate-led or third-party steps can take longer.

4. Validate before relying on a finding

• Confirm that the result relates to the correct person or organization.
• Review the underlying source, retrieval date and surrounding context where available.
• Distinguish a verified fact from an indicator, possible match or unresolved discrepancy.
• Do not treat a lack of results as proof that no relationship, exposure or concern exists.

5. Clarify material discrepancies

Where a finding could materially affect a decision, give the relevant person an appropriate opportunity to explain or correct the information where required by the applicable process.

6. Make and document the human decision

The responsible organization makes the final decision. Document the purpose, scope, sources considered, relevant clarifications and the reasoning that led to the outcome.

Account approval, user access and security

Norphluchs access is restricted to approved professional users. Accounts are individual, attributable and intended to support controlled use of person-related intelligence.

Who can register

Norphluchs is intended for companies, public authorities and other organizations acting in an official capacity. Registration details are reviewed before access is approved.

Named-user accounts

• Each account should be assigned to one authorized user.
• Credentials should not be shared across a team.
• Access from multiple approved devices may be possible, but the account remains attributable to one person.
• Separate user accounts improve access control, accountability and auditability.

Password recovery

1. Use the password-reset function available from the sign-in flow.
2. If self-service recovery is not sufficient, contact the Norphluchs team through the approved support channel.

Multi-factor authentication

Multi-factor authentication adds a second verification step and is obligatory.

Good account hygiene

• Use an individual business email address.
• Do not share passwords or verification codes.
• Remove access promptly when a user changes role or leaves the organization.
• Use the least amount of access needed for the user’s responsibilities.

Units, pricing and on-demand use

Norphluchs uses a modular usage model so organizations can run focused checks without purchasing a separate product for every intelligence layer.

How units work

Units are usage credits for individual checks and intelligence modules. A focused assessment typically uses fewer units than a broader assessment across multiple data environments.

What determines the price of an assessment

• The intelligence and verification modules selected.
• The number and type of identifiers or entities entered.
• The workflow or deployment model agreed with the customer.
• For enterprise use, expected volume, integrations, support and contractual requirements.

Can we start with one case?

Yes. On-demand use is intended for individual or occasional cases where an organization needs a purpose-defined background or exposure check without committing to a broader deployment.

How long are purchased units valid?

Under the current commercial terms reflected in the Help Center, purchased units are valid for 12 months from the purchase date unless a different period has been agreed in writing. Unused units expire after that period.

What happens if an account is deleted?

Account deletion can affect remaining units and access to platform data. Export any information that must be retained under your own policies before deleting an account, and confirm the commercial consequences in the applicable agreement.

Results, exports, bulk workflows and API access

Different teams need findings in different operational environments. Norphluchs can support browser review, structured exports, bulk initiation and API-based integration depending on the product and deployment.

Ways to access results

• Within the Norphluchs browser platform.
• As a PDF report.
• As structured CSV or JSON output where supported.
• Through an approved API integration.
• Through supported bulk workflows.

Bulk workflows

Certain workflows can be initiated in bulk using a spreadsheet-based upload. Each person or entity should be represented as a separate case with the identifiers required for the selected check. Available limits, file formats and report options can vary by deployment.

API integration

The API is designed to add selected Norphluchs capabilities to an existing operational environment rather than forcing the organization to replace its core systems.

Typical integration environments include:

• Applicant-tracking and HR systems.
• Security and case-management platforms.
• Compliance and due-diligence solutions.
• Internal enterprise applications.
• Approved partner and white-label products.

Design principle

Keep the decision logic in the customer’s process. The integration should transport inputs and findings, preserve traceability and support human review rather than converting Norphluchs outputs into an automatic decision.

Data retention, hosting and privacy responsibilities

Norphluchs is designed around data minimization and controlled access in order to support GDPR-aligned workflows The customer still remains responsible for defining a lawful, proportionate use of the platform.

Assessment-data retention

Under the current platform terms reflected in the Help Center, assessment data is retained for up to 30 days. Customers may delete it earlier. Exported reports become the customer’s responsibility and should be handled under the organization’s own retention and security policies.

Hosting

The Norphluchs platform is hosted in Germany.

Customer responsibilities

• Define the purpose of the assessment.
• Establish the appropriate legal basis.
• Select a relevant and proportionate scope.
• Meet applicable transparency or notice obligations.
• Restrict access to authorized users.
• Validate material findings before relying on them.
• Apply the organization’s own retention and deletion rules to exported results.

Norphluchs' role

Norphluchs provides the software and processes data according to the agreed service arrangement. Applicable controller/processor roles and other responsibilities should be documented contractually and assessed for the specific jurisdiction and use case.

Pre-Employment Screening overview

Coordinate six independent screening modules within one candidate case, while keeping the final hiring decision with the responsible organization.

The six screening modules

Checks complete at different speeds

Automated research may return within minutes. Candidate-led identity steps and reference responses can take longer. Treat the candidate case as a coordinated workflow rather than a single synchronous search.

Use only what the role requires

Not every position requires all six modules. Select the checks according to the documented purpose, role, level of responsibility, jurisdiction and internal policy.

Human review remains essential

Norphluchs does not decide whether a candidate should be hired. A finding can indicate a discrepancy or potential match that requires review; it should not be treated as an automatic rejection.

CV Verification

Use CV Verification to review professional history, education and timelines for plausibility, completeness and consistency before relying on the information in a hiring process.

When to use it

CV Verification is useful when the role, level of responsibility or internal policy justifies a structured review of the candidate’s stated professional background.

What the module reviews

• Employment history and stated employers.
• Job titles and professional timelines.
• Education and stated institutions.
• Gaps, overlaps and other internal inconsistencies.
• Where appropriate and available, selected public professional sources and company/register information.

Typical findings

• Unexplained employment gaps.
• Overlapping full-time roles.
• Employers, positions or institutions that require clarification.
• Education claims that cannot be verified from the available sources.

How to interpret a discrepancy

A discrepancy is a review prompt, not proof of misrepresentation. Source coverage can be incomplete, company names can change, job titles can vary across records, and education programmes may not be verifiable from public information.

Document Verification

Use Document Verification to examine whether submitted supporting documents are internally consistent and whether they show indicators that deserve closer human review.

Typical documents

• Academic degrees and diplomas.
• Professional qualifications and training certificates.
• Employment certificates and records.
• Reference letters.
• Other role-relevant supporting documents.

What the module can help identify

• Internal inconsistencies in the document.
• Indicators of alteration or manipulation.
• Metadata or structural signals where available.
• Possible artificially generated elements where the selected analysis supports this.

What the result means

Document-analysis findings are indicators for review. A technical signal alone should not be treated as proof that a document is fraudulent. Compare the result with the document context, the candidate’s explanation and any available issuer verification.

Identity Verification

Identity Verification confirms the person behind the application using a separate candidate-led verification process.

When to use it

Use Identity Verification where confirming the person completing the application process is relevant and proportionate to the role or workflow.

Depending on the selected procedure, verification may include

• Government-issued identity-document validation.
• Data extraction and consistency checks.
• Live-photo capture.
• Face matching.
• Liveness verification.

What HR should review

Focus on whether the identity step completed successfully, whether any inconsistencies need clarification and whether the result relates to the same candidate case. Avoid expanding the check beyond the documented purpose.

Timing

Identity verification requires candidate participation and may therefore complete later than automated research modules.

Image Verification

Image Verification helps reviewers assess whether a submitted image may be manipulated, artificially generated or reused elsewhere on the web where the use case and applicable requirements allow.

Depending on the selected scope, image verification may include

• Indicators of manipulation or alteration.
• Indicators associated with AI-generated images.
• Image consistency and plausibility checks.
• Metadata analysis where available.
• Reverse-image research for identical or visually similar images where permitted.
• Contextual review of relevant online findings.

How to interpret image-analysis results

Treat image-analysis outputs as indicators, not automatic conclusions. Compression, editing, screenshots, platform processing and incomplete metadata can all affect technical signals.

Reference Checks

Reference Checks bring structured third-party responses into the same candidate case so they can be reviewed alongside the candidate’s stated history.

What the reference process may cover

• Employment period.
• Position and responsibilities.
• Performance-related questions.
• Eligibility for rehire where legally permitted.
• Questions defined by the hiring organization.

Why reference checks finish later

Reference checks depend on third-party responses. A reference can remain pending while other modules are already complete. Do not delay review of available findings simply because every module has not finished.

How to compare a reference with the CV

Look for material differences in dates, role, responsibilities or other facts relevant to the hiring decision. Small wording differences are not automatically meaningful. Where the reference conflicts with the candidate’s account, clarify the discrepancy before relying on it.

OSINT and Compliance Check

Use the OSINT and Compliance Check to add role-relevant public, official, media, company/register and compliance intelligence to the candidate case.

The scope can include

• Selected clear-web research.
• Selected deep-web research.
• Media coverage.
• Company and register information.
• Sanctions, black and watchlists.
• Politically exposed person screening.
• Selected exposure or dark-web indicators where proportionate to the role and purpose.

Scope it to the role

A senior role with elevated financial, security or reputational responsibility may justify a different scope from a standard operational role. Define the reason for each module before enabling it.

What not to do

Do not treat broad internet visibility, personal opinions or unrelated private activity as automatically relevant to employment. Review only information that is appropriate to the documented purpose and applicable legal framework.

Exposure Checks and ECHO-360 overview

Exposure Checks make the digital footprint around a person visible in a structured, point-in-time assessment. ECHO-360 brings selected intelligence layers together around known identifiers.

Typical inputs

• Full name.
• One or more email addresses.
• One or more telephone numbers.
• Relevant companies or organizational relationships.

What an Exposure Check can help answer

• What information is publicly visible?
• Which accounts or identifiers may be connected?
• Where has personal or professional information been exposed?
• Which organizations or company roles are associated with the person?
• What public reporting exists?
• Which findings deserve closer professional review?

Underlying intelligence environment

Coverage figures are useful scale indicators, not a promise that every source will return a result for every person. Data availability, selected modules and identifiers determine the actual output.

Point-in-time, not a permanent verdict

An Exposure Check reflects the available information within the selected sources at the time of retrieval. It should be repeated only when there is a documented reason to do so.

Clear-Web Intelligence

Clear-Web Intelligence helps connect selected publicly available information around known identifiers such as names, emails, phone numbers, usernames or other supported selectors.

Best for

• Understanding a person’s publicly visible digital footprint.
• Identifying public profiles, registrations or aliases connected to known identifiers.
• Adding context to an Exposure Check or other authorized assessment.

What may be returned

Depending on source availability and privacy settings, results can include public profiles, professional information, websites, forum activity, aliases, images or other publicly accessible context.

What 'live' means

Clear-web lookups are live/current searches rather than a static historical archive. That means the result can change over time and deleted or inaccessible content may not appear.

Coverage

1,500+ selected clear-web sources.

Interpretation

A connection between an identifier and an online account should be validated before it is attributed to a person. Shared names, recycled usernames and outdated information can create false associations.

Adverse Media

Adverse Media helps surface public reporting that may be relevant to due diligence, compliance, exposure or other professional assessments.

What adverse media is

Adverse media, sometimes called negative news, is public reporting that may indicate allegations, investigations, enforcement action, misconduct or other risk-relevant events relating to a person or organization.

Why it is useful

• It can surface context that has not yet appeared in a sanctions or watchlist result.
• It can show how an issue developed across multiple reports.
• It can support a more complete due-diligence picture when reviewed alongside official and structured sources.

Articles are not conclusions

A media mention can describe an allegation, opinion, historic event or unrelated namesake. Review the publication, date, person match, status of the matter and the relevance to the specific assessment.

Coverage

Norphluchs covers more than 140,000 media outlets across approximately 60 languages. Exact historical lookback and source availability can vary by module and deployment.

Dark-Web and Exposure Intelligence

Use Dark-Web and Exposure Intelligence to identify whether known selectors appear in large exposure datasets or archived dark-web data environments.

Best for

• Checking whether an email, domain, phone number or other supported selector appears in exposure data.
• Supporting digital-exposure reviews for executives, key personnel or approved security-awareness use cases.
• Adding breach/exposure context to a broader person-level assessment.

Why results can vary

• New data may be added and old data may become unavailable.
• Large result sets can be limited by result buckets or backend constraints.
• Temporary maintenance or timeouts can affect returned volume.
• Different deployments can use different approved backend configurations.

Source visibility

Archived data may not always expose exact origin metadata beyond the bucket, title or source information shown in the report. Treat provenance as part of the reliability assessment.

Telegram Intelligence

Telegram Intelligence provides structured access to large-volume Telegram data for approved professional research and threat-intelligence use cases.

Coverage

Norphluchs covers billions of Telegram messages from relevant threat-intelligence groups and channels.

Search modes

• Post search using supported keyword modes.
• User search using available identifiers such as username, phone number or unique user ID.
• Group/channel context where available.
• File search where the deployment exposes indexed files.
• Advanced Boolean or regex search where supported by the Telegram module.

How to use the result strategically

The presence of a name, username or identifier in a threat-intelligence-related group does not by itself establish intent, ownership or misconduct. Validate the identifier, review the surrounding conversation and determine why the result is relevant to the approved purpose.

File-safety warning

Reddit Intelligence

Reddit Intelligence helps authorized users find relevant posts, comments, users and communities within a large indexed Reddit data environment.

Coverage

The current coverage is 30 billion+ Reddit data points.

What you can investigate

• Posts and comments matching relevant criteria.
• Reddit users where the identifier or activity is relevant to the assessment.
• Subreddits and discussion context.

Interpretation

Do not assume that a username belongs to the person under review without corroboration. Reddit content is contextual, conversational and often pseudonymous; account attribution requires additional evidence.

Company and Register Intelligence

Company and register intelligence helps connect individuals with organizations, official roles and business information across approved company-data environments.

Coverage

The current global coverage indicator is 260+ business-data jurisdictions.

DACH context in the source material

• Germany: company data and registered-entrepreneur information are described as available.
• Austria: enhanced company, person, association and compliance information is described as available.
• Switzerland: basic company information is described as available.

Potential company-level information

Depending on jurisdiction and module, company data can include registration details, addresses, legal form, organizational roles, ownership information, financial information, trade data and other register-derived facts.

Austrian compliance reports

Norphluchs offers enhanced Austrian compliance reports offdered by Compass-Verlag for companies, associations and individuals, including sanctions/PEP information, insolvency, Russian-state affiliation and selected ownership or role data.

Strategic use

Company data is most useful when it answers a defined question: whether a claimed employer existed, whether a person held a stated role, whether an affiliation requires further review, or whether a transaction has relevant person-level connections.

PEP, Sanctions, Blacklists and Watchlists

Structured compliance data can add an important layer to person-level research, but a possible match must be validated before it is used in a decision.

Coverage

The current coverage indicator is 380+ PEP, sanctions, blacklist and watchlist datasets.

What a PEP result means

A politically exposed person (PEP) result indicates a possible match to a person holding, or having held, a prominent public function or a relevant association. PEP status is not evidence of wrongdoing. It is a compliance signal that can trigger additional review where applicable.

What sanctions and watchlist results mean

Sanctions, blacklist and watchlist screening can surface possible matches to structured datasets maintained by governments, international organizations, enforcement bodies or other approved data providers.

Legal and policy point

Screening obligations and required follow-up depend on the jurisdiction, the organization, the transaction and the applicable regulatory framework. The customer remains responsible for the legal basis and compliance process.

OSINT and OSINF fundamentals

Open-source information is the raw material. Open-source intelligence is the result of collecting, validating and interpreting that information for a defined professional question.

OSINF

Open-Source Information (OSINF) is raw, legally accessible information such as public records, websites, public images, media reporting, forums and other open sources.

OSINT

Open-Source Intelligence (OSINT) is the structured process of turning selected open information into an assessment that supports a decision.

The practical difference

A six-step intelligence cycle

1. Planning and direction: define the question, purpose and scope.
2. Collection: gather only the information needed from selected sources.
3. Processing: organize, deduplicate and structure the returned data.
4. Analysis: validate identity, relevance and reliability; compare across sources.
5. Dissemination: present material findings clearly and traceably.
6. Feedback and review: refine the questions, scope and internal process for future cases.

Interpreting findings, false positives and no-result cases

The most important analytical skill is distinguishing a result from a conclusion.

A result can be one of several things

• A verified fact supported by an official or reliable source.
• A likely match that still requires identity validation.
• An indicator that suggests further review.
• A discrepancy between two sources.
• An unverified claim or contextual mention.
• A false positive caused by shared names, identifiers or outdated information.

How to handle a potential match

1. Confirm the selector or identity used in the search.
2. Check whether the source relates to the same person.
3. Review dates, locations, roles, aliases and other corroborating fields.
4. Assess whether the information is relevant to the documented purpose.
5. Seek clarification where the finding could materially affect the decision.
6. Document why the finding was accepted, rejected or left unresolved.

No result does not mean no risk

An absence of accessible information does not prove that no relationship, exposure or concern exists. Private, undisclosed, inaccurate, unregistered, deleted or inaccessible information may not be available to the selected sources.

No final risk score

Norphluchs is designed to provide structured findings for human review rather than a final 'go/no-go' score.

Why search results can change

Live and large-scale intelligence sources change continuously. A different result does not automatically mean the previous search was wrong.

Common reasons

• New data was added or old data became unavailable.
• The source platform or index changed.
• A result limit or bucket limit was applied.
• A temporary timeout reduced the number of records returned.
• Maintenance affected one source temporarily.
• The same input was normalized differently by a different module or backend.
• The person’s public visibility changed.

What to do

1. Confirm that the input selector is identical and correctly formatted.
2. Review the retrieval date and source category.
3. Use available filters to narrow large result sets.
4. Re-run only when the purpose justifies a fresh point-in-time check.
5. If a material discrepancy persists, document both retrievals rather than silently replacing the earlier result.

TracePanel and connected analysis

TracePanel is a graph-based environment for connecting findings across searches and documenting analytical context.

What it is useful for

• Visualizing relationships between people, organizations and digital identifiers.
• Adding selected findings from different research modules to one graph.
• Creating custom nodes when an important relationship cannot be represented automatically.
• Adding structured notes, context, source information or hypotheses to findings.
• Exporting or re-importing supported session data where enabled.

Strategic use

Use the graph to explain why two findings may be connected, not to imply that proximity in a graph proves a relationship. Connections should be backed by source evidence and clearly distinguished from analyst hypotheses.