UTMStack

Know who you are doing business with before you sign

An independent investigation of a company and the people who run it: who owns it, how sound it is, from filed accounts to its credit score, what courts, regulators and the press have said, and how exposed it is online. Every finding is sourced and dated, with the questions to ask before you commit.

  • The company and its leaders

    One report covers the company in 20 sections and adds a separate report on each director or key person you name.

  • Every finding sourced and dated

    Each fact cites where it came from and when it was read, and the report lists every search, including the ones that found nothing.

  • Questions to ask, not just facts

    It ends with recommendations: what to ask the company, what to check in the contract and what to keep watching.

Read a real report before you order one

The sample is a complete corporate due diligence report on a UK telecoms and IT group and its five directors. It comes from a real investigation, with every company, person, address and identifying figure replaced, so you see exactly the depth you will receive.

pages
197
pages
findings
93
findings
searches run
33
searches run
watch lists screened
73
watch lists screened
reports on directors
5
reports on directors
data tables in the appendix
26
data tables in the appendix
Open the sample (PDF, 1.6 MB, 197 pages)

Teluvia Limited and the people in the sample are fictional.

  • Cover of the sample report: an exposure signature with 93 findings across 20 sections, for the fictional TELUVIA LIMITED
  • At a glance page: overall risk position Medium, company facts, internet-facing hosts, breach records and findings over time
  • Executive summary page of the sample report
  • A findings page: each finding with its confidence and detail

What the company report covers

Twenty sections in five areas, each listed below with what it contains. A section that finds nothing still appears, with what was searched, so a clean result is a documented result rather than a gap.

Identity and background

Who the company really is, as it describes itself and as the records show.

Party details provided
The company name and web domain you give us, the starting point of every search.
Party details developed from open sources
Legal name, registration number, date of incorporation, registered office, group parent, revenue, staff numbers and owners.
Background information
What it sells and to whom, how it was formed, investors and funding, acquisitions since founding, chief executives over time, customer reviews and ratings, modern slavery statement, dependence on key suppliers and offshore operations.
Address identification
Head office and other sites, shown on a map, and the addresses of related businesses.

Financial health

Whether the company is sound, how it pays, and who it owes.

Corporate profile and filed accounts
Company status and filing record; up to seven years of group accounts (revenue, EBITDA, profit or loss, net liabilities, average staff, highest-paid director); the trading company’s own accounts; debt and leverage; audit opinion and any going-concern warning; acquisition payments still owed; board pay; subsidiaries; and trading with the owners’ other businesses.
Commercial credit reports
Credit score and rating for the company and each group company, recommended credit limit, county court judgments on file, and payment practices: average days to pay suppliers, the share paid within 30 and 60 days or late, and whether payment reports were filed on time.
Registered charges and lender security
Every charge registered against the company and its parents, who holds it, when it was created and what has been released.
Bankruptcy and insolvency searches
Administration, liquidation, receivership and winding-up searches, official gazette notices, and the personal insolvency register for the owners.

Legal, regulatory and reputation

What courts, regulators, screening lists and the press have said about it.

Civil litigation
Court cases and employment tribunal claims, the company’s role as claimant or defendant, amounts claimed, counterclaims and the outcome so far.
Criminal case searches
Prosecutions of the company or its group companies.
Legal judgment searches
Money judgments against the group and published court judgments.
Securities and regulatory searches
Listed shares or bonds, legal entity identifier, and regulated status.
Watch list screening
The company, its related companies and its directors screened against sanctions, law enforcement, regulatory enforcement and politically exposed person (PEP) lists (73 in the sample). Name matches that could not be tied to the subject are listed separately, never counted against it.
Adverse media
Regulator fines and penalties, and press coverage tied to the company, its owners and related companies by name, role and company.
Other adverse information
Related-party deals, advertising regulator rulings, political donations, complaints about connected businesses and the credit standing of the owners’ other companies.

Ownership and control

The chain up to the people who own and control it, and what else they run.

Ownership and beneficial interests
The ownership chain to the ultimate beneficial owners (UBO), people with significant control, shareholders by class and number of shares, voting rights and the events that change them, lenders that also hold shares, and the owners’ businesses outside the group.
Directors and officers
Current directors of the company and the group board, chief executives over time, sanctions, politically exposed person and disqualification screening, their other appointments, and insolvencies among the companies they have served.

Cyber exposure

How the company looks to an attacker: what it exposes on the internet and what has leaked.

Digital footprint and exposure
Domain registration and expiry, every domain and subdomain, public certificate history, internet-facing servers with their open services, software versions and known weaknesses, databases or remote access exposed to the internet, email spoofing protection for the company and related domains, internal systems named in public, and the pages the company publishes.
Breach and dark web exposure
Breach and dark web records for the company’s email addresses, by source; readable leaked passwords, shown masked; logins stolen by malware; and captured logins to the company’s own sites.
Professional verifications
Staff discoverable online with name, role, department, seniority, email and phone (the raw material for phishing and impersonation), the qualifications of key officers, gender pay gap reports and staff reviews.

Every report also includes

  • An exposure signature on the cover: one spoke per section, sized by what was found, with adverse findings marked
  • An at-a-glance page: risk gauge, key facts, most exposed ports, breach records by source, searches run and findings over time
  • An executive summary in plain language
  • An overall risk rating with the reasoning behind it
  • Red flags marked on every adverse finding, with its severity
  • A confidence grade on every finding: confirmed, probable, possible or unverified
  • Answers to the key questions, such as who owns it, is it creditworthy and has a regulator penalised it
  • A relationship map of the companies and people involved
  • Screenshots of the key records as evidence: website, company register, ownership register, map and press
  • Recommendations: what to ask the company, what to check in the contract and what to keep watching
  • Every search run, including those that found nothing
  • Sources, with the date each was read
  • Method and limitations, stated plainly
  • Marked confidential on every page, prepared for the client named on the cover
  • A full data appendix (26 tables in the sample): accounts, credit scores, payment practices, charges, court cases, ownership, directors, hosts, services, domains, certificates, staff, breach records and the lists screened

Reports on the people who run it

For each director, owner or executive you name, a separate 13-section person report sits inside the company report, with a credit check on each key person. The sample has five.

Person reports matter because a company's risk often lives with its people: a founder's earlier insolvencies, a director's other businesses dealing with the company, or an executive's leaked password that opens a door into the network.

  • 01ProfileFull name, month and year of birth, nationality, career and reported wealth
  • 02AddressesKnown addresses from filings and the press
  • 03Leaked credentialsWork and personal email addresses found in breach data
  • 04Social media presenceAccounts confirmed as theirs
  • 05Phone detailsPublished phone numbers
  • 06Personal blogPersonal sites and writing
  • 07Family, friends and associatesSpouses, business partners and co-investors
  • 08Articles and interviewsPress coverage, quotes and awards
  • 09Other online presenceProfiles, charities and foundations
  • 10Corporate affiliationsEvery company appointment, shareholdings and control, and loans to their own companies
  • 11Watch list and sanctions screeningSanctions, politically exposed person and disqualification lists, the bankruptcy register and political donation records
  • 12Adverse mediaPast companies that failed and what creditors lost, past allegations and how they ended
  • 13Litigation and regulatory mattersCourt cases, and court judgments on the companies they direct

When a due diligence report pays for itself

Any time you are about to trust a company you do not control with your money, your data, your customers or your name.

  • Vendor and supplier due diligence

    Check a supplier before it gets access to your data, systems or customers, with independent evidence instead of a self-assessment questionnaire.

  • Agents, distributors and joint ventures

    Third parties acting on your behalf carry most bribery risk under the US Foreign Corrupt Practices Act (FCPA) and the UK Bribery Act. A documented check of who owns them, who runs them and what is known about them is the core of an anti-bribery program.

  • Customer onboarding (KYB and AML)

    Enhanced due diligence on higher-risk business customers for anti-money laundering rules: ultimate beneficial owners, sanctions and PEP screening, adverse media and the people in control.

  • Mergers, acquisitions and investment

    Pre-transaction due diligence on ownership, debt, litigation and related-party dealings, so you arrive at the negotiation with the questions that matter.

  • Partner and reseller onboarding

    Know who stands behind a company that will carry your name to market, and whether its owners have a history of failed businesses.

  • Credit and payment terms

    Combine credit scores, filed accounts, court judgments and payment practices before extending credit or long payment terms.

  • Third-party risk for compliance

    Document supplier checks for ISO 27001 supplier controls (Annex A 5.19 to 5.22), SOC 2 vendor management (CC9.2), PCI DSS service providers (12.8), and the third-party and supply chain duties in DORA and NIS2.

  • Supply chain and human rights laws

    Ownership, adverse media and published modern slavery statements support the supplier checks expected under modern slavery and supply chain due diligence laws.

  • Executive hires and board appointments

    Person reports on candidates for senior roles: corporate history, insolvencies, litigation, sanctions and adverse media.

  • Executive and VIP exposure

    See what an attacker can find about your own company and leaders: leaked passwords, exposed services, staff email addresses and personal details.

Built to stand up to scrutiny

A due diligence file is only as good as its defense when an auditor, a regulator or your board asks how you reached a decision. Every report is written for that moment.

  • Records read in full

    Filings, accounts, judgments and regulator decisions are read in full, not summarized from search results, and key records are kept as screenshots.

  • Every finding graded

    Each finding carries a confidence grade (confirmed, probable, possible or unverified) and, when adverse, a severity, so you can tell fact from indication.

  • No guilt by name

    Records under the same or a similar name that cannot be tied to the subject by role, company or date are listed separately and never counted against it.

  • An audit trail of every search

    Every search is logged with its outcome, including the ones that found nothing, and every source is cited with the date it was read.

  • Limits stated plainly

    The method and its limitations are written into the report, so nobody reads more certainty into it than the evidence supports.

  • Confidential and lawful

    Built from public records and licensed data only. The subject is not contacted, every page is marked confidential, and we confirm the purpose of each report before we start.

How it works

  1. Step 1

    Tell us who and why

    Name the company, the people you want covered and what the report is for: a supplier review, a deal, an appointment.

  2. Step 2

    We agree the scope

    We confirm which countries, registers and people are in scope, and send you a quote.

  3. Step 3

    We investigate

    We read the records in full, not just search results: filings, accounts, judgments, regulator decisions, screening lists and breach data. The company is not contacted.

  4. Step 4

    You receive the report

    A PDF report with the executive summary, findings, evidence, recommendations and the full data appendix, ready to file with your due diligence records.

Once a supplier is approved, the risk keeps moving. UTMStack's dark web monitoring watches for new leaks of your own and your suppliers' credentials, and the threat intelligence in UTMStack flags their addresses if they turn hostile.

Questions buyers ask

What is a due diligence report?

An independent investigation of a company, and optionally the people who run it, before you enter a relationship with it. It establishes who owns and controls the company, whether it is financially sound, what courts, regulators and the press have said about it, whether it or its people appear on sanctions and enforcement lists, and how exposed it is to cyber attack.

Is this enhanced due diligence (EDD)?

Yes. Standard due diligence confirms who a company is and screens it against sanctions and watch lists. Enhanced due diligence goes further for higher-risk relationships: ultimate beneficial owners, the people in control, litigation, regulatory history, adverse media and finances. This report covers all of that, and adds credit standing and cyber exposure, which are often sold as separate services.

How deep does the research go?

Depth follows the risk. A low-risk supplier may need only the company and its directors; a joint venture partner or an acquisition may need the whole group and a person report on every key individual. We agree the depth with you before we start, and the report records every search it ran.

How is it different from a security questionnaire or a credit check?

A questionnaire records what a supplier says about itself, and a credit check gives one number. This report gathers independent evidence across ownership, finances, litigation, regulation, media and cyber exposure, cites the source of every finding, and ends with the questions to put to the company. It is the evidence that makes a questionnaire meaningful.

Which sources do you use?

Company registers and filed accounts, registers of owners and of lender security, commercial credit reports, court records and published judgments, insolvency registers and official notices, regulator decisions, sanctions, law enforcement and politically exposed person lists, news and web searches, domain and certificate records, internet scanning data, staff directories, and breach and dark web collections. The report lists every search and the date each source was read.

Can you investigate companies outside the UK?

Yes. The sample is a UK company, and the registers and courts available differ by country. When we scope your request we tell you which sources we can search for that country, and the report records each search, including the ones that found nothing.

Do you contact the company or the people in the report?

No. The research uses public records and licensed data sources only, so the subject is not told that it is being researched.

How do you handle personal data?

We prepare reports for a legitimate business purpose, such as supplier due diligence, a transaction or an appointment, and confirm that purpose before we start. Leaked passwords are never shown in full: the report shows only enough to tell whether a password was readable.

Is the sample a real report?

It is a real investigation with every company, person, address, web address and identifying figure replaced, and screenshots blurred. Teluvia Limited and the people in it are fictional. The structure, depth and method are exactly what you receive.

How much does a report cost?

It depends on the scope: one company or a group, how many people, and which countries. Tell us what you need and we will reply within one business day with the scope and a quote.

Request a report

Tell us which company, which people and what the report is for. We reply within one business day with the scope and a quote.

Download the sample report first

We reply within one business day. See our privacy policy.

Protected by reCAPTCHA: the Google Privacy Policy and Terms of Service apply.