How This Briefing Works
This dossier opens with key findings, then maps the gap between what Pitchbook discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 1 sites
vendor fires before consent
Briefing
Pitchbook operates as a financial data and research platform providing private equity, venture capital, and M&A intelligence. The platform tracks user research behavior, content consumption patterns, and search queries to refine data delivery and build usage profiles. Deployment reveals session recording, device fingerprinting, and consent bypass patterns that capture detailed research activity and competitive intelligence needs.
What This Means For You
Investment and research teams face three core risks: (1) Research behavior analytics become distorted by platform over-crediting, making usage value calculations unreliable for renewal decisions. (2) Detailed deal research patterns reveal investment thesis, competitive analysis, and market focus to Pitchbook infrastructure—intelligence that could inform vendor strategy or competitive positioning. (3) Legal exposure from consent bypass and session recording creates GDPR/CCPA liability that compliance teams cannot fully mitigate while maintaining platform access.
Risk Channel Breakdown
Pitchbook tracks research query patterns and data consumption that reveal user information needs and deal focus areas (25% signal corruption). These signals can distort usage analytics by over-crediting platform interactions while missing actual research value delivered.
The platform captures detailed search behavior including company research, deal tracking, and competitive analysis patterns (90% CAC subsidization). This intelligence reveals what deals you are evaluating, what companies you are researching, and what market segments you are analyzing—data valuable to competitors and vendors.
Expands attack surface
Session recording with consent bypass creates complete GDPR/CCPA exposure (100% legal tail risk). The vendor processes detailed research behavior and query data without transparent consent controls, leaving organizations liable for privacy violations.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Ignoring CMP signals
Device identification
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed Pitchbook's public claims against observed runtime behavior and identified 1 contradiction.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
5 for current users · 5 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →