Six decisions that separate this from a search box.

Where the local press cannot report freely, an empty result is not a finding. It is a gap.

NegativeNewsSearch carries the press freedom index and derives a search decision from it: past a defined rank the local lane no longer suffices and international research runs alongside. The rank applied and the lanes that actually ran are recorded in the result. That lets you show in an audit not merely that you searched, but that you accounted for how reliable the available sources were. We are not aware of a second vendor that treats press freedom as a controlling input rather than as background knowledge.

The OR expansion comes from a curated set — not from a language model inventing spellings.

Before the search runs, the name is resolved against a maintained alias set and submitted as an OR block. Deliberately not a model call: a language model would invent plausible variants that never existed, and slightly different ones on each run. A screening whose search query changes between two runs is not reproducible — and correspondingly hard to defend in an audit. The set also covers names in non-Latin scripts, which in practice is the single most common reason a hit gets missed.

We see the question, but not who asked it. That is not a self-imposed policy; it is a property of the method.

Access runs on blind-signed tokens per RFC 9474. Your system generates the tokens itself and has the server sign them in blinded form — the server signs a value it never sees in the clear. At redemption it verifies its own signature but holds no record connecting the redeemed query to the issuance. Why this matters to a bank: the mere fact that you are screening a particular name is confidential information — about a customer relationship, an acquisition target, a prospective counterparty. What nonetheless remains visible is set out openly on the privacy page; we think the precise claim is more defensible than a grand one.

Four dimensions, scored 0 to 3, rationale drawn from the text, source and date on every statement.

The analysis is expressly constrained to use nothing that is not in the article text — no additions, no speculation, no prior knowledge. It has to state the connection to the subject even where none exists, and it has to disclose when an article could only be retrieved in part. The result is therefore comparable across cases and documents how it came about: query, variants, domains, lanes, hit counts.

36 months of theme-filtered holdings — on top of whatever a search still surfaces today.

Current search results are a slice of the present; reporting from two years ago is often no longer findable, even though it is frequently the reporting that matters for a risk assessment. We run our own continuous mirror of the GDELT feed, filtered to 13 relevant themes and stored as immutable daily files. That is also a fairness argument towards the source: one politely paced consumer, rather than a service that re-downloads on every request.

No SDK, no crypto library, no runtime dependency in the production path.

A token is an opaque string; possession is the access. Your application writes it into a header and is done. All of the cryptography lives in a monthly, offline step that produces an allowance of tokens. For a bank’s IT function that is a procurement argument: there is no third-party library entering the production path to be maintained and reviewed for the rest of its life.