Use Case Guide

Scenario-led workflow

Start a Basic Due Diligence Workflow on a Small Company

Editorial

A practical small-company due-diligence workflow for confirming the entity, its footprint, and obvious public risk signals.

Problem

You need a disciplined first-pass due-diligence workflow for a small company before deciding whether a deeper investigation is justified.

Suggested workflow

Confirm entity -> examine web footprint -> test staff and domain context -> review public exposure signals -> decide whether deeper diligence is warranted.

Best for

Analysts, reporters, and researchers doing early-stage vetting on a company, vendor, or small business partner.

Verification boundaries

The best early diligence combines entity records, domain history, public presentation, and one independent risk or contact signal.

Workflow notes by depth

Beginner: Get the legal entity right before you start reading the website as if it were proof.

Intermediate: Use archives and domain context to see whether the company's public story is stable over time.

Advanced: When risk indicators appear, distinguish between evidence of sloppiness, evidence of active compromise, and simple public exposure noise.

Practical cautions

Even small-company diligence can touch individuals, employees, and sensitive exposure data. Keep the workflow narrow and evidence-led.

Editorial position: Use the related company research comparison and collections when you need to choose between registry-first, document-heavy, or domain-led workflows.

Useful tool lanes: Archives & Historical Web, Breach & Exposure Intelligence, Company & Corporate Research, Email Intelligence, Public Records & Registries

Suggested Tool Stack

Start with tools that fit this job.

Confirm the legal entity first, compare its public claims over time, then test its operating footprint and contact context. Risk-list matches remain unresolved until identifiers and official sources agree.

Browse all tools

Step 1

OpenCorporates

Role: Confirm the legal entity

Start with the registered name, jurisdiction, identifier, and source registry so similarly named companies do not get mixed together.

Editorial
Open profile
Wayback Machine official-page screenshot

Official-page screenshot

Internet Archive

Verified 2026-05-27

Historical web captures for deleted or changed pages

Verification: Editorial review Workflow: Archiving Pricing: Free

Best for: Historical web-page review, Save Page Now capture, deleted-page recovery, source preservation, claim timelines, profile changes, and before/after web…

Editorial

Step 2

Wayback Machine

Role: Compare earlier public claims

Review archived products, team pages, addresses, and contact details for changes that need explanation or corroboration.

Editorial
Open profile

Step 3

BuiltWith

Role: Inspect the operating web footprint

Use current and historical technology clues to understand the public website while keeping technical detections separate from legal facts.

Editorial
Open profile

Step 4

Hunter

Role: Test business contact context

Check whether the company domain and public professional-email pattern support the claimed operating identity.

Editorial
Open profile
OpenSanctions official-page screenshot

Official-page screenshot

OpenSanctions

Verified 2026-05-27

Sanctions, PEP, and watchlist context with source links

Verification: Editorial review Workflow: Verification Pricing: Freemium

Best for: Sanctions, PEP, watchlist, vessel, company, and public-interest screening where structured entity data and source lists matter.

Editorial

Step 5

OpenSanctions

Role: Run proportionate risk screening

Check relevant public-interest lists by identifiers and aliases, clearly labeling possible matches until official sources confirm them.

Editorial
Open profile

Small-company due diligence is rarely about one perfect database. It is about stitching together enough registry, domain, staff, and exposure context to know whether the company deserves deeper scrutiny.

Recommended sequence

  1. Confirm the legal entity and jurisdiction first with public company-record sources.
  2. Check the company web footprint, archived claims, and related domains to understand how the business presents itself over time.
  3. Test public work-email patterns or contact context only when it helps confirm whether the company appears operational and coherent.
  4. Use breach or exposure signals carefully as risk context, not as automatic proof of poor governance.

What usually goes wrong

Analysts over-index on a polished website, ignore the legal record, or treat one public exposure result as a full operational verdict on the company.

Before you publish

Separate confirmed legal facts, operating-footprint clues, and risk indicators. Those buckets should not be blended into one unsupported judgment.

Read alongside

Collections

Reviews

Compare next

Best for: Due Diligence Analysts, Journalists, Researchers

Methodology note

This guide is a first-pass filter. It helps decide whether a company deserves deeper work, not whether it has passed a full investigation.