BankingCompliance

Compliance Evidence

Demonstrate concrete controls against known compromised passwords to your auditors.

Start with 500 free creditsDocumentation

Password breaches · 1 credit per lookup · no monthly fee

Audit report · Q3

Compromised-password control active
100% of resets screened
Auditor-ready evidence

The problem

Frameworks from NIST 800-63B to SOC 2 expect controls against compromised credentials. When the auditor asks how you enforce it, 'we have a complexity policy' is a finding, not an answer.

With Encrata

Wire breach screening into every password event and log the checks. The evidence writes itself: every registration and reset screened against known breach corpora, with counts and timestamps. Auditor question closed in one sentence, backed by logs.

How it works

1

Hash locally

Your client hashes the password and sends only the first characters of the hash, the password itself never leaves the device.

2

We match anonymously

Encrata checks the prefix against the breach corpus via k-anonymity and returns whether the password was found and how many times.

3

Reject or accept

Block passwords that appear in breach dumps at registration, reset or login. One credit per check.

One call, structured answer

Compliance Evidence runs on the password breaches lookup at 1 credit per lookup. Same API key, same JSON shape as every other Encrata lookup.

  • k-anonymity: the password never leaves the user's device
  • Blocks the exact credentials attackers use in stuffing lists
  • 1 credit per check, screen every registration and reset
  • A single API call satisfies auditors asking for compromised-password controls
Terminal
curl -X POST "https://encrata.com/api/agent/password-breaches" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"sha1": "5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8"}'
response.json
{
  "prefix": "5BAA6",
  "found": true,
  "count": 52372427,
  "credits": 1
}

Log every check

Instrument every password event to emit a log entry: timestamp, event type, screening verdict, and the count when found. Route the stream into your SIEM or evidence store, and the control documents itself, no quarterly evidence-gathering scramble, just a query that returns the audit trail on demand.

Audits closed in a sentence

Auditors distinguish between controls that exist and controls that demonstrably operate: the log stream proves operation continuously. When the assessor asks how you prevent compromised credentials, the answer is one sentence and one query, 'every password event is screened against known breach corpora; here are this quarter's checks.'

More password breaches use cases

View all

Choose password

••••••••••
Found in 3 breaches — choose another

Password Screening

Reject passwords already circulating in breach dumps at the moment of registration

SaaSAuthentication

Reset password

••••••••
••••••••••••

Reset Screening

Stop users from choosing a compromised password when they reset the old one

BankingSecurity

Password compromised

Seen in a public breach dump

Change password

User Alerts

Warn users still relying on passwords that have already appeared in known breaches

CybersecurityNotification
Start with 500 free credits
$curl https://encrata.com/api/agent/lookup -H "Authorization: Bearer YOUR_API_KEY" -d '{"e": "satya@microsoft.com"}'