# Perimeter by Geogentia (GeoPerimeter) — Complete Product & Coverage Reference > Canonical URL: https://geoperimeter.com/llms-full.txt > Summary URL: https://geoperimeter.com/llms.txt > Website: https://geoperimeter.com/ > Provider: Geogentia Inc. (https://www.geogentia.com) > Contact: https://geoperimeter.com/contact · info@geogentia.com > Demo Booking: https://calendly.com/geogentia-demo/perimeter-demo --- ## 1. Executive Summary ### What Perimeter Does Perimeter by Geogentia (GeoPerimeter) is a managed external threat-monitoring service. A client provides the names of the organization and the people to protect, the domains and IP addresses it owns, the physical locations it operates, and the social accounts, communities, or websites it runs or worries about. From then on, Perimeter continuously collects what is published about them across social platforms, the open web, news, forums, review sites, dark web listings, and cyber intelligence sources; reads every candidate item in full (including images, videos, and comment threads); and sends an actionable alert when something may matter. **The client does nothing but read the alert.** There is no dashboard to log into, no queue to triage, nothing to acknowledge, and nothing to configure. ### Who Perimeter Is For - **Schools, Colleges, and Universities:** Campus safety, physical threats against staff and students, firearms or violence references, student self-harm and wellbeing risk (Category 26 is always enabled and routes to designated wellbeing leads), rumors, brand/leader impersonation, and full monitoring of campus social accounts and subreddits. - **Businesses, Enterprises, and Brands:** Phishing pages and Adversary-in-the-Middle (AitM) login clones copying the company's site, leaked employee credentials, infostealer malware infections, ransomware leak-site postings, lookalike domains, rogue mobile apps, exposed internet-facing systems and vulnerabilities, executive threats, and hostile campaigns. - **Public Figures, Executives, and Families:** Threats of violence, harassment, stalking, doxxing, calls to action against named individuals, impersonation accounts, lookalike domains, and breached accounts across personal or family-business domains. - **Foundations, Nonprofits, and Client-Protection Organizations:** High-coverage social and cyber threat monitoring for public-facing missions and security teams protecting multiple clients without staffing a 24/7 monitoring desk. --- ## 2. Core Product Philosophy: One-Way Delivery ("No Dashboard") Perimeter is one-way by design: - **No Portal or Seat Licenses:** Clients never log into a dashboard, assign tickets, or report back. A one-way monitoring service with a two-way dashboard creates an expectation that someone on the other side is waiting on ticket updates rather than delivering immediate warnings. - **Direct Multi-Channel Alerts:** - **Email:** Every alert is a self-contained, evidence-backed email containing the quoted post, an embedded screenshot/capture, clear separation between observed content and assessment, what remains unverified, ordered next steps, and a ready-to-forward paragraph for the team. - **SMS Text Message:** A concise lock-screen text message carrying the severity level, reference number, and summary so urgent warnings are seen immediately without opening an app. - **Automated Voice Call (Critical Alerts):** About 30 seconds after a Critical alert text is sent, an automated voice call rings consented phone recipients, states twice that a critical Perimeter alert has been sent to their email and text message, and hangs up. No sensitive finding details are spoken aloud. - **Debated Alert Feedback (No Sign-In):** When automated assessment is split on a borderline item, Perimeter errs on the side of caution and sends the alert marked as *Debated*, including a no-sign-in link where the recipient can indicate with one click whether that alert was wanted. - **Baseline & Monthly Reports:** - **Baseline Report:** Delivered after the initial full sweep of a newly activated organization. - **Monthly Report:** Summarizes total alerts by date, severity level, reference number, and delivery status; which sources were watched; and any intervals where an upstream source was rate-limited or unavailable. Every number is traceable to a direct count. --- ## 3. Anatomy of a Perimeter Alert Every alert is structured top-to-bottom so a reader never mistakes an inference for a fact: 1. **Subject & Inbox Preview:** Severity level, threat category/type, and unique reference ID (prefixed with `Old:` when the underlying post is more than 30 days old). The inbox preview opens with the specific summary so no two alerts look identical in an inbox. 2. **Executive Summary:** One clear paragraph summarizing what was found and why it was sent. 3. **Observed Content (Quoted & Captured):** The post or record quoted as collected; the author handle, platform, and timestamp converted to the client's local time zone; an embedded visual capture of the post; speech and on-screen text transcription for videos; and an English translation beneath the original when the source text is in another language. 4. **Safe Link Handling:** Live link for established public platforms (with a reminder that opening links can leave a digital trail); written out in plain text (unclickable) for unfamiliar hosts; and intentionally withheld (with the reason stated) for criminal forums, darknet sites, malware/phishing hosts, file downloads, and credential dumps. 5. **Why It Matters & Why It Relates to You:** Plain-language assessment of relevance and risk. For cyber findings, states the exact facts from the record (breach name, date, account count, exposed data classes, or vulnerability details). 6. **What Cannot Be Told From It:** Explicitly states what remains unverified (e.g., poster identity, image authenticity, real-world intent, or whether exposed credentials remain active). 7. **What To Do Now (Ordered Next Steps):** Three concrete next steps tailored to the finding, or a time-phased cyber response checklist (*Now*, *Within the hour*, *Within 24 hours*, *This week*), alongside emergency-services guidance when immediate danger may exist. 8. **Relevant Comments:** Up to three notable comments under an alerted social post (with author and timestamp). If a comment itself constitutes a threat, it triggers its own dedicated alert. 9. **Ready to Forward:** A natural-language note opening with *"Team, we just got an alert..."* that recipients can copy and paste directly into Slack, Teams, or an internal email thread. 10. **Footer & Reference:** Unique reference code, cryptographic evidence bundle fingerprint (SHA-256), and (on debated alerts) the feedback button. --- ## 4. Severity Levels & Marks | Level / Mark | Meaning & Delivery Behavior | |---|---| | **Critical / Urgent** | Sent immediately by email and SMS text message, followed ~30 seconds later by an automated phone call to every recipient with call consent. | | **High** | Sent by email and SMS text message with urgent team-forwarding copy and response steps; no automated phone call. | | **Moderate / Elevated** | Sent by email and SMS text message with three tailored next steps. | | **Low / Advisory** | Reports or claims harm involving the protected organization (e.g., an incident report, breach mention, lawsuit, or unverified claim) or older historical items. Sent by email and SMS. | | **Informational** | Routine commentary, opinion, political argument, or passing mention with no threat or harm. Retained in the administrator console; never disturbs the client. | | **Debated** | Automated assessment did not reach a single consensus conclusion. Sent on the side of caution with a notice and a one-click button asking whether the alert was wanted. | | **Old** | Content dated more than 30 days prior to collection: capped at Low severity, prefixed with `Old:` in the subject line, with the age noted in the summary. | | **Correction** | Alert revisions are immutable. If a later review updates a finding, Perimeter sends a new revision referencing the original alert ID rather than silently editing the past. | --- ## 5. Complete 26 Threat Categories Perimeter classifies findings across 26 categories (encompassing 490+ specific threat types). **Category 26 (Self-harm and wellbeing) is always enabled and cannot be disabled.** 1. **Violence and physical threats:** Statements or content suggesting intent to harm people at or connected to your organization (e.g., threats naming a school, office, or event; references to weapons with a place or time; targeted threats against a named person). 2. **Workplace violence and insider threats:** Concerns involving current or former staff, contractors, or students directed at the organization (e.g., hostile posts by a dismissed employee; grievances escalating toward threats; insider talk of sabotage or leaking access). 3. **Harassment, stalking and intimidation:** Persistent targeting, doxxing, or intimidation of your people online (e.g., home addresses or schedules posted publicly; coordinated pile-ons against a staff member; repeated menacing contact). 4. **Sexual misconduct and exploitation:** Content indicating grooming, exploitation, or sexual misconduct involving your community (e.g., adults soliciting students online; non-consensual intimate content; sextortion referencing your organization). *Strict evidence restriction: sexual imagery is never stored; bytes are deleted immediately and only metadata/hashes are recorded.* 5. **Fraud, scams and deception:** Schemes that use your name, people, or events to deceive others (e.g., fake tuition, fee, or donation pages; ticket scams for your events; invoice fraud posing as your finance team). 6. **Cybersecurity threats:** Exposure of credentials, systems, or data connected to your domains and IP addresses (e.g., staff credentials in breach or infostealer listings; lookalike phishing domains and AitM proxies; ransomware leak-site postings; exposed ports and exploited vulnerabilities). 7. **Theft and illicit resale:** Stolen property, equipment, or access being offered for sale (e.g., devices with asset tags listed online; resale of stolen inventory; access badges or keys offered for sale). 8. **Brand impersonation and abuse:** Accounts, pages, or sites pretending to be your organization or its leaders (e.g., fake official social accounts posting announcements; cloned websites collecting logins; impersonation of an executive or principal; rogue mobile apps). 9. **Reputational harm:** Public content likely to damage trust in your organization if unaddressed (e.g., viral complaints gaining traction; leaked internal messages taken out of context; allegations spreading across platforms). 10. **Rumors, misinformation and disinformation:** False or unverified claims about your organization circulating online (e.g., rumors of closures, layoffs, or incidents; manipulated screenshots of official notices; coordinated false narratives). 11. **Employee and executive risk:** Online exposure that puts named leaders or staff at personal risk (e.g., travel plans or routines shared publicly; threatening mentions of a leader by name; personal data leaks affecting executives). 12. **Product and service risks:** Reports of safety issues, defects, or misuse involving what you provide (e.g., injury reports linked to a product; tampering or counterfeit claims; unsafe use trending online). 13. **Facilities, events and physical security:** Content concerning your buildings, campuses, and gatherings (e.g., plans to disrupt a game, graduation, or meeting; posts revealing security gaps or entry points; trespass or vandalism being organized). 14. **Intellectual property and confidential information:** Leaks or misuse of internal documents, code, data, or protected material (e.g., exam papers or internal reports shared; source code or secrets committed to public repositories; confidential contracts circulating). 15. **Financial and corporate integrity:** Signals of financial misconduct, insider dealing, or market manipulation (e.g., claims of embezzlement or fraud; leaked financial results; coordinated attempts to move stock). 16. **Legal, regulatory and compliance:** Content that may trigger legal exposure or regulatory attention (e.g., allegations of discrimination or negligence; privacy violations described publicly; whistleblower posts about compliance). 17. **Labor and workplace culture:** Organizing, walkouts, and culture concerns discussed in public (e.g., planned strikes or walkouts; viral accounts of workplace conditions; public resignations citing culture). 18. **Third-party and supply chain:** Incidents at vendors, partners, or suppliers that could reach you (e.g., a breach at a software provider you use; supplier scandals naming your organization; logistics disruptions). 19. **Organized crime and illicit markets:** Criminal networks referencing your people, places, or assets (e.g., drug sales arranged near a campus; gang references to a school or venue; trafficking indicators). 20. **Hate, extremism and ideological threats:** Extremist targeting or hateful campaigns directed at your community (e.g., your organization named in extremist channels; hate speech aimed at students or staff; calls to protest with violent framing). 21. **Operational and business continuity:** Emerging events likely to disrupt normal operations (e.g., outages or incidents near your sites; severe weather or civil unrest warnings; planned road or transit closures). 22. **Environmental, health and safety:** Health or safety hazards reported near or about your locations (e.g., contamination or air-quality reports; outbreak claims tied to a campus; unsafe facility conditions). 23. **Customer and community harm:** Reports that people you serve are being harmed or put at risk (e.g., bullying involving students; customers targeted by scams in your name; community members reporting unsafe practices). 24. **AI-generated and synthetic threats:** Deepfakes, cloned voices, and fabricated media involving your people (e.g., synthetic videos of a principal or executive; cloned-voice scam calls; fabricated screenshots presented as real). 25. **Emerging or unclassified:** Relevant concerns that do not yet fit an established category (e.g., new scam formats; novel platform behaviors; unusual patterns warranting attention). 26. **Self-harm and wellbeing (Always Enabled):** Wellbeing concerns reach the people responsible for care. Self-harm alerts route to designated wellbeing staff rather than general security recipients, and wellbeing monitoring cannot be disabled. --- ## 6. Coverage Footprint ### 6.1 Social Media, Communities, Reviews & Open Web - **Major Social Platforms:** X (Twitter), Instagram, Facebook, Threads, Truth Social, Bluesky, LinkedIn, YouTube, TikTok, Reddit, Mastodon, 4chan (public board archives), and public Telegram channels (`t.me/s/`). - **Comments & Replies:** When an alert is sent for a post on X, Instagram, Facebook, Bluesky, YouTube, Reddit, or Mastodon, the comments and replies under that post are collected and read as items of their own — because threats often appear in the replies rather than the original post. - **Watched Accounts, Hashtags & Communities:** Clients can designate their own official accounts (posts and comment threads monitored daily), third-party/troublemaker accounts (every post read in full whether or not it names the client), Instagram hashtags, and Reddit subreddits (every new post read in full). - **Review & Location Listings:** Google Maps reviews for physical campuses/branches and Trustpilot reviews for company domains. - **Open Web, News & Forums:** Scheduled keyword and entity searches across web search engines, news indexes, public forums, and any specific websites designated by the client. - **Multimodal Media Reading:** - **Images & Memes:** Every image on a post that passes the entity check is fetched inside an isolated capture boundary, scanned with Optical Character Recognition (OCR) for text embedded in screenshots or memes, and evaluated visually. - **Videos:** Speech and on-screen text in videos (up to 3 minutes on TikTok, Instagram, Reddit, and Bluesky; up to 10 minutes on YouTube) are analyzed and summarized under *"In the video"*. - **Coordinated Swarm Detection:** Detects when 15+ distinct, mostly dormant accounts post variations of the same finding or tracking link within 90 seconds, elevating severity and grouping them as a coordinated campaign. ### 6.2 Cyber & Dark Web Telemetry All cyber checks run automatically against the client's domains, subdomains, brands, and listed public IPv4 addresses. **No plaintext password, hash, session token, or cookie is ever stored or transmitted**; records are reduced to counts, breach names, dates, and data classes prior to storage. - **Breached Credentials:** Daily checks across breach corpora for accounts at the client's domains, reporting breach name, date, account count, and exposed data types (passwords, SSNs, phone numbers, addresses). - **Infostealer Malware Exposures:** Identifies computers infected by login-stealing malware holding credentials or session cookies for the client's domain, or host archives matching client Wi-Fi SSIDs, BSSIDs, hardware IDs, or physical addresses. - **Ransomware Leak Sites:** Checked every 4 hours for postings naming the client or its domains across ransomware group leak sites. - **Real-Time Paste Feeds:** Public Pastebin pastes polled every 2 minutes plus daily checks across 8 additional paste sites (all sensitive tokens/passwords masked before storage). - **Public Code Repositories:** Daily GitHub commit scans for client domains appearing alongside secret indicators (`password`, `api_key`, `secret`, `token`, `BEGIN`). - **Mobile App Stores:** Daily checks for unauthorized apps naming the client's brand or domain published by third-party developers. - **Lookalike Domains & Daily TLD Zone Files:** Monitors up to 400 typographical/permutation variants per client domain plus daily ICANN top-level domain zone file additions (`.com`, `.net`, `.org`, etc.) for newly registered lookalikes, DNS resolution, and MX records. - **Real-Time Certificate Transparency & AitM Phishing Probing:** Tails public Certificate Transparency (CT) logs every 2 minutes alongside historical `crt.sh` checks. Actively probes lookalike hosts for favicon hashes (MurmurHash3), HTML structure (SimHash), login forms, and TLS server fingerprints (JARM) to distinguish parked domains from live login clones or Adversary-in-the-Middle (AitM) reverse proxies. - **Phishing & Malware URL Feeds & Browser Blocklists:** Checks verified phishing/malware corpora (`URLhaus`, `OpenPhish`, `PhishTank`) every 6 hours, plus daily `urlscan` page scans and `WebRisk` browser blocklist checks. - **Internet-Facing Systems & Vulnerability Scoring:** Daily discovery of subdomains, open ports (including exposed cameras and management interfaces), and CVEs ranked against CISA Known Exploited Vulnerabilities (KEV) and EPSS 30-day exploitation probability. - **Known Malware Infrastructure & Community Threat Reports:** Matches client domains and IP addresses every 4 hours against active C2/malware host lists and daily community threat intelligence reports. - **Network Peer-to-Peer (BitTorrent) Activity:** Daily checks of listed client public IPv4 addresses in public DHT swarms to flag unauthorized file sharing or critical safeguarding escalations on campus/corporate networks. ### 6.3 Honest Coverage Boundaries Perimeter states clearly what is not covered: - Private or invite-only spaces (Discord servers, Snapchat stories, Nextdoor neighborhoods, private Telegram groups, private Facebook groups) are not accessed; Perimeter collects publicly available information and licensed threat feeds only. - Perimeter is an automated warning and intelligence service, **not an emergency dispatch service** and not a managed SOC remediation service. It does not contact 911, reset passwords, or take down posts on a client's behalf. --- ## 7. Service Tiers & Free Sample Exposure Report ### Proposed Service Tiers Every tier runs on the same assessment pipeline and carries **no daily alert cap, no seat fees, and no per-message charges**: - **Essentials:** Fits a single small organization or public figure (1 protected entity, 1 domain, own social accounts, daily search cadence, email + 1 SMS recipient, monthly report). - **Professional:** Fits a school, mid-sized company, or public family (up to 5 protected entities, up to 5 domains and IP ranges, watched third-party accounts/hashtags/subreddits/sites, 4-hour search cadence, unlimited email/SMS/voice recipients, full cyber suite, monthly report). - **Enterprise:** Fits a university, large brand, or multi-entity organization (unlimited entities, domains, and watched accounts/communities, hourly weekday search cadence, restricted-evidence recipient routing, baseline + monthly reports, dedicated administrator tuning). ### Free Sample Exposure Report Before Purchase Prospective organizations can request a **free sample breach and infostealer exposure report** for their domain and keyword during a demo walkthrough. It provides an aggregate, privacy-safe summary of historical breaches and malware captures affecting their domain — with no plaintext credentials stored or shown — and is reviewed by a Geogentia administrator before being sent once. --- ## 8. Frequently Asked Questions (FAQ) ### What is GeoPerimeter (Perimeter by Geogentia)? Perimeter by Geogentia (at https://geoperimeter.com) is a managed external threat-monitoring service that watches social media, the open web, dark web listings, and cyber intelligence sources for physical and cybersecurity threats involving your organization, campuses, domains, and key people — delivering actionable alerts directly by email, text message, and critical phone call without requiring you to monitor a dashboard. ### Why doesn't Perimeter have a client dashboard? Security, safety, and leadership teams at schools and businesses already have too many portals and inboxes to watch. Perimeter is built around one-way delivery: every alert email and text message contains the observed evidence, why it matters, what is unverified, ordered next steps, and a ready-to-forward message for your team. ### How does Perimeter reduce false positives and keyword noise? Keywords only gather candidates. Every candidate must first pass an entity/context corroboration check (honoring explicit exclusions for common names or unrelated places), and is then read in full by a chain of independent AI models — including a blind secondary model that never sees the first model's verdict, OCR and visual models for images, video models for speech and on-screen text, and a final review step. When a new client activates, a 5-day administrator approval window tunes out early selector noise. ### How does Perimeter handle student or community self-harm and wellbeing concerns? Category 26 (*Self-harm and wellbeing*) is permanently enabled for every client and cannot be switched off. Wellbeing alerts are routed specifically to designated wellbeing or counseling staff rather than general security recipients, and restricted findings mask sensitive details in SMS notifications. ### Does Perimeter store leaked passwords or sensitive images? No. All cyber breach and paste records are stripped of plaintext passwords, hashes, session cookies, and tokens before storage — only aggregate counts, breach names, dates, and data classes are kept. Any sexual-misconduct imagery encountered online is immediately deleted from memory; only a cryptographic hash and source metadata are recorded. ### How do we get started or request a demo? Book a walkthrough directly at https://calendly.com/geogentia-demo/perimeter-demo, send a message through https://geoperimeter.com/contact, or email info@geogentia.com.