What people usually want to know before getting in touch.

No.

We do not need passwords, one-time codes, recovery credentials or private account access for our services.

If anyone claiming to represent Principia Works asks you for one of those things, do not provide it.

No.

A penetration test actively evaluates technical systems for vulnerabilities.

An Exposure Assessment looks from the outside at publicly accessible information and what that information reveals when connected.

The two services can complement each other, but they answer different questions.

The assessment includes recommendations for reducing relevant exposure.

Where something can be addressed externally and falls within the agreed scope, we may be able to assist.

Changes requiring access to your accounts or systems remain under your control.

We are not positioning Principia Works as a general device-hardening or IT-support service.

Searching your own name can be useful.

An assessment goes further by examining multiple sources, documenting evidence, connecting related findings and considering what the combined information could make possible.

The risk often sits in the relationship between several ordinary details rather than one dramatic discovery.

Automation is useful for searching and organising information.

It is not enough on its own.

Principia Intelligence combines technology with analyst review.

Significant findings are checked, evidence is documented and conclusions are separated from assumptions.

No.

Phishing is part of the problem, but social engineering can involve WhatsApp, phone calls, payment requests, voice cloning, compromised communication channels and other forms of impersonation.

Training is adapted to the audience and the organisation's needs.

No.

People need to use links to work.

We teach people to understand context, destination, purpose and verification rather than treating every link as automatically dangerous.

Yes.

Where appropriate, we review relevant public information and organisational context before building the session.

The exact depth depends on the agreed scope.

They can be included where appropriate.

The purpose is to improve behaviour and understand patterns, not embarrass individual employees.

How results are handled and reported is agreed before the simulation begins.

Yes.

Synthetic voice, video and AI-generated messages are relevant to modern impersonation.

The important lesson is not that nothing can be trusted.

It is that sensitive instructions should not depend on appearance or voice alone.

No.

We require a legitimate purpose and an appropriate basis for investigative work.

The research must have a defined scope.

We do not provide unrestricted personal investigations simply because somebody is curious about another person.

Employment-related research may be possible where it is lawful, proportionate, appropriately authorised and relevant to a legitimate hiring or risk question.

We do not support indiscriminate digging into somebody's private life.

The scope must match the reason for the research.

Principia Intelligence is designed to be capable of supporting authorised investigative work where the engagement falls within our competence and appropriate authority exists.

The fact that a request comes from an institution does not remove the need for scope, evidence handling and clear purpose.

Public information may sometimes help establish a timeline, location history or relevant activity.

Principia Works does not offer unrestricted real-time tracking of people as a general service.

Any location-related research requires an appropriate purpose, authority and scope.

No.

We do not bypass account privacy controls or use stolen credentials.

Not as part of the services described on this site.

Our work is based primarily on public or otherwise appropriately authorised information.

No.

Public information changes constantly.

Content can be removed, hidden, misreported, duplicated or unavailable to us.

A report describes what we were able to establish from the sources and scope available at the time.

We document the conflict rather than silently choosing the version we prefer.

Where possible, we look for additional sources.

If the conflict cannot be resolved reliably, the uncertainty remains part of the finding.

How material may be used in legal proceedings depends on the circumstances and applicable law.

We can document sources, methodology and evidence where the engagement requires it, but we do not provide legal advice or guarantee admissibility.

Speak to qualified legal counsel where that question matters.

Our standard research is based on information that is publicly accessible or otherwise lawfully provided or authorised for the engagement.

We do not bypass technical controls to obtain information.

No.

A collection of public information can become significantly more sensitive when it is brought together and analysed.

We treat resulting reports and case material accordingly.

After the engagement has been scoped and the required authority, approval or consent has been established.

We do not conduct speculative investigations on potential clients simply to demonstrate what we can find.

Retention and handling depend on the engagement and are defined in the relevant agreement.

We aim to retain sensitive research material only for as long as it is needed for the purpose for which it was collected.

The work depends heavily on scope.

A single-person exposure assessment, a leadership workshop and an investigation involving several organisations require very different amounts of research and analysis.

We therefore define the work first and provide the fee in writing before it begins.

It depends on the scope.

The proposal sets out the expected timeline before you commit.

Yes.

Research and briefings can be carried out remotely.

In-person training outside Windhoek can be arranged where practical.

Potentially.

Remote OSINT and advisory work can cross borders, but legal, privacy and data-handling requirements may affect what we can accept.

Principia Works is not an emergency incident-response service.

If money is actively at risk, contact the relevant financial institution immediately.

If systems are actively compromised, contact your IT or incident-response provider.

Where criminal conduct may be involved, contact the appropriate authorities.

We may be able to help investigate the social-engineering or public-information component after the immediate incident has been contained.