Have I Been Pwned Due Diligence

Run due diligence on Have I Been Pwned: check compliance and get alerts when suppliers change.

Australia · haveibeenpwned.com · 12 vendors

Have I Been Pwned (HIBP) is an online service that allows individuals and organizations to check if their personal data, such as email addresses and passwords, has been compromised in data breaches. It aggregates billions of records from publicly disclosed breaches to help users understand their exposure and take protective measures.

Resilience scores

Technology vendors

Services catalogue

5 services in catalogue across 3 categories; runs on 12 sub-vendors.

Insights

Last updated 2026-05-12

12 direct vendors, 162 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Compliance

4 in-scope frameworks identified; showing 3.

Australian Privacy Act 1988 — Evidence found

Evidence: https://haveibeenpwned.com/Privacy

SOC 2 (source) — No public evidence

Evidence: https://haveibeenpwned.com/Privacy

GDPR (source) — Evidence found

Evidence: https://haveibeenpwned.com/Privacy, https://haveibeenpwned.com/DPA, https://haveibeenpwned.com/OptOut

Financials

Three-year financials

Financial Resilience Score: 7/10

Have I Been Pwned (operated through Superlative Enterprises Pty Ltd) demonstrates strong qualitative financial resilience despite the absence of disclosed financial figures. As a small Australian proprietary company, it is exempt from public financial lodgement with ASIC, but Troy Hunt has publicly stated the business is profitable and self-funded with no external debt or VC overhang. The cost base is extremely low due to in-kind infrastructure sponsorship from Microsoft Azure and Cloudflare, which shields HIBP from major bandwidth and CDN expenses. Recurring revenue from API subscriptions (Pwned 1-5 tiers starting at US$3.50/month) and enterprise domain monitoring subscriptions provides predictable cash flow. The brand has become the de-facto standard for breach notification, integrated into 1Password, Mozilla Monitor, and major IAM tools, with institutional partnerships including the UK NCSC, US FBI, and Australian Signals Directorate. However, resilience is constrained by significant key-person risk centered on Troy Hunt personally—a dependency that contributed to the failed 2019-2020 'Project Svalbard' sale process. The business has no product or geographic diversification, depends heavily on Azure/Cloudflare in-kind support, and faces a monetization ceiling because public lookups remain free by founder philosophy. Regulatory exposure around handling stolen credential data also represents a latent risk.

Key strengths: Profitable and self-funded with no external debt or VC backing, Extremely low cost base due to Microsoft Azure and Cloudflare in-kind sponsorship, Recurring API and enterprise subscription revenue, De-facto industry standard brand integrated into major identity products (1Password, Mozilla Monitor), Institutional credibility via partnerships with UK NCSC, US FBI, and Australian agencies, 13 billion breached accounts indexed across 800+ breaches as of 2024

Risk factors: Key-person risk concentrated on Troy Hunt personally, Legal/regulatory exposure handling stolen credential data, Heavy dependence on Azure and Cloudflare in-kind infrastructure support, Monetization ceiling because public lookups remain free by design, No product or geographic diversification—single product, single founder, single jurisdiction, Failed 2019-2020 sale process highlighted buyer concerns about founder dependency

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report