How This Briefing Works
This report opens with key findings, then maps the gaps between what Leadspace discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Analysis pending. Findings will appear here once intelligence collection is complete.
Claims vs. Observed Behavior
compliance
“ISO 27001 certified and SOC 2 Type II audited”
Security certifications cover Leadspace infrastructure and processes, but do not validate the data practices of the 30+ upstream vendors whose data feeds the graph. Security of the platform does not equal compliance of the data.
compliance
“GDPR compliant with opt-out mechanisms”
Opt-out options exist for individuals, but the 30+ source supply chain makes it difficult to verify that opt-outs propagate to all upstream providers or that previously-collected data is fully purged from the graph.
transparency
“Decision-quality data from 30+ best sources”
The specific identity of all 30+ data vendors is not publicly disclosed. Customers cannot independently audit the quality, consent status, or collection methods of each upstream source.
pending
“Open, flexible platform that can onboard any new data source”
Openness increases data flow surface area. Each new source added to the graph expands the consent and compliance burden without corresponding visibility for end customers. Awaiting scanner verification of runtime behavior.
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
Recommended Actions for Leadspace
- →- Request a complete list of Leadspace's 30+ data vendor partners and their respective data collection methodologies before deployment. - Audit Leadspace's data processing agreement to understand how your first-party CRM data is used within the graph and whether it informs enrichment for other customers. - Implement consent flag unification within Leadspace to ensure GDPR/CCPA opt-out status is respected across all enriched profiles before activation in outbound campaigns. - Evaluate data portability — confirm that your first-party data can be fully extracted from the graph upon contract termination, separate from third-party enrichment. - Review Leadspace's sub-processor list and ensure each upstream vendor meets your organization's data governance requirements.
Negotiation Leverage
- →When negotiating with Leadspace, focus on supply chain transparency and data isolation guarantees. As a 30+ vendor aggregator, Leadspace should be able to provide a complete sub-processor list with the specific data types each vendor contributes. Demand contractual commitments around data isolation — specifically that your CRM data, enrichment queries, and targeting patterns are not used to improve the graph for other customers or shared with upstream vendors.
- →Key questions to ask: Which of your 30+ data vendors have access to our first-party data as part of the enrichment process? How do you handle conflicting data from multiple sources — which source wins, and how is that decision made? What happens to our unified graph data upon contract termination — is it fully deleted or retained for platform improvement? Can we opt out of specific upstream data sources if they fail our internal compliance review? Ensure contracts include audit rights over the data supply chain, data deletion guarantees, and restrictions on using your first-party data to enrich profiles for other customers.
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
15 detection signatures across scripts, domains, cookies, and network endpoints