Documentation
Operator Guide
This manual explains what to put into BlackBox, what the system checks, and how to read the result. Use it before you submit a report and before you act on one.
01 · Scope
What this is, and what it is not
BlackBox generates a structured operational intelligence briefing from a short form submission. Reports are typically 13-19 pages, take under five minutes to generate, and can be downloaded as a PDF.
It is not an investigation firm. There are no human agents, physical surveillance, non-public data, or sanctions screening. Every source is public. The report tells you where to look and who to engage; it does not do the engagement.
Your role
Treat the briefing as a decision and research aid. Verify facts, credentials, legal positions, and current availability yourself before you rely on them or engage anyone.
02 · Input
Writing the brief
The situation brief is the highest-leverage field. Write at least 100 characters; three or four sentences is the practical floor. State four things: the quantum, the forum, what has already been tried, and the actual question you need answered.
The brief is also read by the identity resolver. Put any company number, registration number, or date of birth you know into it. Those identifiers can be used to confirm retrieved records against the subject.
✗ Weak brief — generic output
Need to find someone in Dubai who owes us money.
No quantum, no nationality, no timeline
No existing assets identified
No specific question asked
Report defaults to generic UAE debt recovery framework
✓ Strong brief — targeted output
Former business partner absconded with €340,000 from a joint venture. Last confirmed contact was from Dubai Marina 6 weeks ago. He is a British national with known UAE business connections. We have a UK court judgment in hand and need advice on enforcement options in the UAE, whether asset freezing is viable, and which local law firms handle cross-border enforcement. Subject may be aware of our intentions.
Quantum, nationality, location, timeline all present
Existing legal position stated (judgment in hand)
Specific questions asked (enforcement, freezing, local counsel)
Operational constraint flagged (subject may be aware)
✗ Weak brief
Background check on a business partner in Singapore.
No indication of what is known or suspected
No decision being made — why does this matter now?
Report cannot calibrate risk or urgency
✓ Strong brief
Pre-acquisition due diligence on a Singapore-based fintech founder. Unverified rumours of a prior insolvency in Australia and possible sanctions-linked entities in the corporate structure. We are committing €4.2 million and need a structured enhanced due diligence framework, beneficial ownership mapping, and MAS regulatory standing check before closing. Timeline is 10 days.
Specific risk hypothesis stated
Quantum at stake makes urgency clear
Specific deliverables listed
Hard deadline given
✗ Weak brief
CFO travelling to Caracas. Need security advice.
No personal risk factors provided
No duration, no purpose of travel
Generic Venezuela security output
✓ Strong brief
CFO — dual US-Venezuelan national who has not visited Venezuela in 8 years — is travelling to Caracas for 3 days of PDVSA meetings in July. Her family background is known to some local officials which creates a potential coercive leverage vector. Need close protection, vetted driver, hotel security assessment, and emergency extraction protocol if the situation deteriorates.
Dual nationality flagged — changes legal exposure
Personal risk factor identified
Specific deliverables listed
Trigger condition for escalation given
✗ Weak brief
Money laundering investigation into a local politician in Bulgaria.
No specific allegations or known facts
No company names, no connected entities
AI has nothing to anchor the analysis to
Report describes process, not intelligence
✓ Strong brief
Due diligence investigation into Pencho Milkov, Mayor of Ruse, Bulgaria, ahead of a commercial investment in the city. He is alleged to have awarded a municipal airport concession to a company with undisclosed connections to his family. We need a structured framework for accessing Bulgarian public procurement records, his mandatory asset declarations via KPKONPI, and commercial registry searches for connected entities. Subject must not become aware of the investigation.
Subject named with role and jurisdiction
Specific allegation stated
Specific databases named
Critical constraint flagged
The four questions to answer
Quantum — how much money, value, exposure, or consequence is involved
Forum — where the matter will be decided or used
Already tried — what you have done, who you contacted, and what happened
Actual question — the decision or deliverable you need from the report
Forum — where the matter will be decided or used
Already tried — what you have done, who you contacted, and what happened
Actual question — the decision or deliverable you need from the report
03 · Form reference
The fields that change the report
Optional fields do more than add background. Each one switches on a different routing, validation, or enrichment step.
Subject nationality
Routes jurisdiction-specific sources by nationality as well as location. A British subject living in Dubai still triggers Companies House and the UK insolvency and disqualification registers. This is the most useful and least obvious behaviour in the system; set it whenever you know it.
Known identifier
Use a DOB, company number, or LEI. This is what turns a record from UNCONFIRMED into MATCH CONFIRMED. Without one, almost every record stays unconfirmed by design. If you have one, supply it.
Last known location
Used separately from the target location. It affects source routing and news relevance filtering. Use it when the subject is believed to be somewhere different from the operation.
Domain
Resolves to an IP and geolocates the hosting. Use it when the subject has a website or other domain you want to place geographically.
Email
Runs a breach check against HaveIBeenPwned. The result is about whether the supplied address appears in known breach data.
EU VAT number
Validates against EU VIES. GB-prefixed numbers are not in VIES post-Brexit; the report hands you the HMRC checker instead.
04 · Calibration
Budget is a ceiling, not a target
There are seven budget tiers. Each produces a materially different document. The report can recommend spending less than the stated budget when the matter does not warrant more. That is deliberate: a briefing that correctly tells you to spend €200 is worth more than one that manufactures a €10,000 engagement.
Free, Digital Field Kit
Drops the professional-services, legal-framework, and fee sections entirely. Returns a self-directed field kit: free tools with URLs, phone tactics, ten OSINT steps, free registries for the jurisdiction, a social media playbook, and a red-flags checklist. It is a different document, not a shorter one.
Under €500
Initial action planning for matters where the first steps should remain self-directed or tightly limited.
€500–€5,000
Limited professional engagement with a narrower scope and a controlled set of external steps.
€5,000–€25,000
Standard professional engagement with a broader recommendation and decision structure.
€25,000–€100,000
Comprehensive engagement planning for matters with greater value, complexity, or multi-party coordination.
€100,000+
Full-scale investigation planning where the value and complexity justify a large professional workstream.
Budget flexible
Results priority. The report still tests proportionality rather than treating an open budget as a reason to spend more.
05 · Read this first
Reading the threshold assessment
Before designing any approach, the report works through four questions. Read this section before the strategic approaches. The approaches follow from it.
What genuinely requires presence in the target jurisdiction? Examples include serving process, appearing before a local court, physically verifying premises, or accessing a registry with no remote route.
What can be done remotely or from your own jurisdiction? Document review, video interviews, and engaging a home-jurisdiction professional whose output is valid in the forum where it will be used may not require local presence.
What can you do yourself, today, for nothing? Check your bank, payment provider, insurer, chargeback and recall windows and deadlines, national fraud reporting body, the compliance function of any institution that touched the money, and your existing contractual rights. These are frequently faster than anything available in the target jurisdiction and are almost always overlooked.
Is any of it proportionate to the value at stake? The budget is a ceiling. The report should identify when the sensible next step costs less than the available budget.
Worked example
Use the Wirecard sample as the worked example. Its recovery routes are separated by jurisdiction and decision gate rather than presented as one undifferentiated engagement.
06 · Coverage
The fourteen sources, and the seven that do not run
The fourteen live sources are divided into three groups. Routing determines which jurisdiction-specific sources run; the six always-queried sources run on every enriched report.
Always queried — every enriched report · 6
Interpol Red Notices
Live
Separate check for public Interpol Red Notice records.
ICIJ Offshore Leaks
Live
Panama Papers, Pandora Papers, Paradise Papers, Bahamas Leaks, and Offshore Leaks data.
GLEIF LEI Registry
Live
Global Legal Entity Identifier records and structured entity details.
Wikidata
Live
Structured knowledge graph used for entity facts and disambiguation.
Wikipedia
Live
Public profile search with identity-resolution review.
Google News RSS
Live
English-language news search using subject name and location.
Routed by subject location or nationality · 5
Companies House UK
Routed
UK location or nationality; company and officer records.
UK Insolvency & Disqualification
Routed
UK location or nationality; insolvency and director-disqualification records.
SEC EDGAR
Routed
US location or nationality; SEC filings and issuer records.
SAM.gov Federal Exclusions
Routed
US location or nationality; federal exclusions records.
CourtListener
Routed
US location or nationality; public US court records.
Triggered by an optional field · 3
HaveIBeenPwned
Email
Runs when you supply an email address.
EU VIES VAT
VAT
Runs when you supply an EU VAT number.
IP Geolocation
Domain
Runs when you supply a domain and resolves its hosting location.
Seven sources that do not run
These functions exist as roadmap items but return no live result and are not queried: OpenSanctions, OpenCorporates, OFAC SDN Direct, FCA Register, NSOPW Registry, Bureau of Prisons, and Username Sweep.
What BlackBox does not screen
BlackBox does not perform sanctions screening, PEP screening, or watchlist screening. No sanctions source is queried, and no report will describe sanctions status as clear, clean, or checked. Interpol Red Notices is a separate check, reported as such — it is not sanctions screening.
Screen your subject yourself before any commercial or operational commitment. Use these direct links: OpenSanctions, UK OFSI consolidated list, US OFAC SDN search, and EU consolidated list.
Screen your subject yourself before any commercial or operational commitment. Use these direct links: OpenSanctions, UK OFSI consolidated list, US OFAC SDN search, and EU consolidated list.
07 · Results
Reading the source manifest
Every enriched report carries a manifest of every source queried, what triggered it, and what it returned. Check it before relying on any section of the report.
Matched
The source returned records. Those records then go through identity resolution.
No match
The source ran and holds no record matching the search string. This is a fact about one database. It is not evidence of absence of risk, and for a small private company it is the normal result.
Could not be reached
The source failed or timed out. This is the absence of a fact, not a clean result. The report never describes an unreachable source as having returned nothing.
08 · Disambiguation
Identity resolution and name collisions
Retrieved records are compared with your brief by a second model call. Shared name, nationality, or job title is never enough to confirm identity.
MATCH CONFIRMED
A positive discriminating identifier matched. The identifier must distinguish the subject from other people or entities.
DIFFERENT SUBJECT
A retrieved fact contradicts your brief. The record is listed in the Excluded Identity Collision Artifacts section for auditability and excluded from analysis.
UNCONFIRMED
The record is compatible with your brief, but nothing confirms it. This is the default and the honest answer most of the time.
John Smith is not a confirmation
A John Smith result with the right nationality or job title is still not confirmed. The Known identifier field is how records move out of UNCONFIRMED. If you do not have an identifier, the report tells you which one to go and get.
09 · Base rates
When absence means nothing
No LEI, no Wikipedia entry, no Wikidata record, and no news coverage is the ordinary condition of a small or mid-size private company. None of it is a red flag.
The report is instructed never to present ordinary absence as an adverse finding. Hold the same line when reading it. A source that has no record has told you only what that source does not contain.
News scope
The Google News query searches English-language sources only. Absence from that query is not evidence that no local-language coverage exists.
10 · Recommendations
Why you will not get a phone number
The report gives root domains and contact routes, never street addresses, phone numbers, or email addresses. Those details cannot be verified reliably and are wrong more often than not.
Where the system is not confident that a firm exists under that exact name, it omits the firm and gives you a directory pathway instead: the national bar association, the ACFE CFE Finder, or the relevant professional institute's member search. A directory pathway you can work is worth more than a name that may not exist.
Standing instruction
This is deliberate, not a gap. Verify every credential, current operating status, scope of practice, and conflict position before engaging anyone.
11 · Retention
Retention
Reports are never written to a database. A finished report is held in server memory for up to 15 minutes so your browser can collect it, then discarded.
Download the PDF before you navigate away, because nobody can recover it afterwards.
12 · Reference
FAQ and roadmap
Why are the recommended contacts not verified?
BlackBox gives root domains and contact routes based on available public information. These are recommendations, not verified active contacts. Check that a firm exists, is currently operating, and is appropriate for your matter before engaging it.
What does "name collision detected" mean?
A retrieved record was rejected as a different person or entity with the same or a similar name. Shared name, nationality, or job title is not enough to confirm identity. Use the Known identifier field to provide a discriminating identifier.
Why does my report feel generic?
Usually the brief does not contain enough specific information. Add the quantum, forum, what has already been tried, and the actual question. Include names, dates, identifiers, jurisdictions, and constraints where you know them.
Can I run the same subject more than once?
Yes. Each report is independent. Different operation types, locations, briefs, or live-source results can produce different outputs.
Should I run a report without enrichment?
Only if you have no subject name. Without enrichment the report is generated from the model's own knowledge with no live data and carries a banner saying so. With a subject name, always enable it.
What does "Could not be reached" mean?
The source failed or timed out. It does not mean the source returned no records and it is not a clean result. Check the manifest and use the manual links supplied in the report.
What is the Free, Digital Field Kit?
It is a different report format for zero-budget matters. It omits professional-services, legal-framework, and fee sections and returns free tools with URLs, ten OSINT steps, free jurisdiction registries, a social media playbook, and a red-flags checklist.
Is this a replacement for a professional investigator or lawyer?
No. BlackBox does not perform the engagement. It gives you a structured account of the problem, the relevant jurisdiction, possible routes, and questions to take to a qualified professional.
Where is my report stored?
Almost nowhere, and not for long. Your report is never written to a database. It is held in server memory for up to 15 minutes so your browser can collect it, then deleted. Nobody at BlackBox can retrieve it afterwards, and neither can you. Download the PDF before you navigate away.
How do access codes and credits work?
Access & credits. Report credits are redeemed with the access code issued at checkout. There are no user accounts or passwords — the code is the only credential. If you are running reports across sessions, or a code is shared within a team or firm, treat it as a bearer instrument: whoever holds it can redeem the remaining credits. There is no automated recovery for a lost code; contact support@blackbox.fyi and we will assist where possible, though this is handled case-by-case rather than as a standard account-recovery process.
Roadmap items are not live sources
The following items are not queried today. They are listed here only as future work.
Coming Soon
OpenSanctions
Future sanctions and PEP data integration.
Coming Soon
OpenCorporates
Future global corporate registry integration.
Coming Soon
OFAC SDN Direct
Future direct US Treasury list integration.
Coming Soon
FCA Register
Future UK Financial Conduct Authority register integration.
Coming Soon
NSOPW Registry
Future US public registry integration.
Coming Soon
Bureau of Prisons
Future US federal inmate-locator integration.
Coming Soon
Username Sweep
Future public username-search integration.