How the work is done.One custodian, both trails.
Two disciplines, one operating posture. The framework below is what holds the open-record work and the lineage work to a common standard — and what the dossier is built against, at intake and at closing.
The two methods below are not interchangeable: open-source practice grades a public claim; primary-source genealogical practice grades a record. Both have to hold before a dossier is citable.
For a principal-tier subject — a family whose name, image, and holdings surface in more registers than the average dossier sees — this dual discipline is what keeps one trail from quietly cross-referencing the other. The work below is what carries that posture from intake to certificate of destruction.
OSINT source validation
Every open-source claim is graded before it lands in a dossier.
Public records, search-result snippets, broker registries, social posts, archived snapshots — each is evaluated against the same four-part rubric before it becomes a load-bearing assertion in an engagement file. The rubric exists so the dossier reads cleanly to a later reviewer: a counsel, a notary, a subject three years on.
The four-part rubric applied to every open-source claim:
Provenance chain
01Who first published, when, and who has re-shared it. Open records are treated as a graph, not a list — a single-source claim requires that single source to be named, dated, and link-stable.
Corroboration requirement
02Adverse claims require at least two independent sources. Single-source adverse claims are kept on the record but explicitly flagged as such; they do not become the basis of a takedown or a notification without independent support.
Re-validation cadence
03A source class carries a decay timeline. Search-engine snippets decay fastest; primary-record snapshots decay slowest. Each entry in the dossier carries the date it was last re-validated, not the date it was first found.
Toolchain transparency
04Search operators, archive snapshots, broker-lookup tooling, and the public-record indices queried are all recorded inline with the claim. Methodology is reproducible by a third party — that is the privacy posture.
Genealogical evidence standards
Identity-defining claims hold only to primary sources, never to derivative databases.
Where the digital practice audits what an open record says about the subject, the lineage practice audits what an authoritative record says about the subject's family. Both are evidence work, both are held to the same standard: a defensible, citable, notarised record at closing. The framework below cites the Genealogical Proof Standard as the working standard.
The four disciplines applied to every record before it enters the dossier:
Primary-source-only rule
01Identity-defining claims are sourced from the record itself: civil registries (birth, marriage, death), parish and sacramental registers, court records, census enumerations, and naturalisation or citizenship instruments. Derivative databases — family trees, online genealogy aggregators — are treated as leads to be confirmed against an original, never as evidence on their own.
Conflict-resolution protocol
02When records disagree, the heaviest-weight source wins. Birth, marriage, and death entries from the subject's own civil jurisdiction trump church transcriptions and family-tree claims. The exception is logged in the dossier: which record was preferred, why, and what weight the alternative was given.
Citation discipline
03Every dossier footnote names the record, the holding repository, the image or folio identifier, and the access date. A dossier reads like a verifiable trail — any reviewer can follow it back to a single named source. This is the Genealogical Proof Standard applied record-by-record.
Reproduction-grade output
04Closing deliverables — the evidentiary dossier, the family-tree narrative, the citizenship or estate brief — are produced to a standard that will stand up in a civil registry, a consulate, or a probate filing. The work is built to be referenced, not re-done.
Integration for dual-scope engagements
When an engagement spans both trails, evidence flows between them under one custodian.
Most engagements begin on one trail. Many end on both. A citizenship case opens as a digital-takedown scope and closes as an inheritance brief. A stubborn-takedown case opens as a search-engine scope and closes as a reunification contact. The unified engagement is distinct from a generic data-removal shop — which applies takedown without evidence grading — and distinct from a hobby genealogist, whose derivative-tree position is not held to the Genealogical Proof Standard. The integration discipline below keeps the two trails in lockstep under one custodian: same reader, shared ledger, single acknowledgement.
Three integration moves that distinguish a unified, credentialed engagement from a takedown-only or hobby-genealogy alternative:
Evidence propagates between disciplines
01A verified birth record disambiguates a digital alias cluster; a takedown-confirmed account shutdown clears the way for a reunification contact. When a fact is settled in one discipline, it is travelling consent for the other — and the dossier records it that way. A data-removal shop does not carry facts across; a hobby genealogist does not carry facts back.
Shared ledger, single acknowledgement
02One custodian runs both engagements. Notes do not fragment across teams; the next reader is the same person who audited the open record. This is the privacy posture, and the audit trail — at intake, mid-engagement, and at closing. Neither a takedown-only vendor nor an unfunded hobby-tree can offer the same single-reader continuity.
Sealed handoff at closing
03When a dual-scope engagement closes, the combined dossier is sealed under a single certificate of destruction. The subject receives a single reconciliation record — not two separate reports and not two contradictory ones. A unified custody engagement closes once; a fragmented engagement closes twice, and the second report rarely agrees with the first.
GDPR / CCPA posture
Every engagement is held under a defined lawful basis, a bounded retention, and a written posture.
A privacy posture is not a footer note — it is the operating constraint that runs through every practice above. The framework below names the lawful basis, the data-subject rights, and the close-out commitments that govern all research, both open-source and lineage, regardless of jurisdiction.
The five-point posture applied to every engagement:
Lawful basis
01Legitimate interest is the standing basis for open-source research; consent is sought for any subject-provided material. Where the basis shifts — a takedown request against a data broker, a record request against a registry — the new basis is recorded in the dossier before the work continues.
Minimisation
02Only the field needed for the claim is collected. Personal identifiers are isolated, not aggregated; sensitive attributes are recorded only where their absence would weaken the evidence. The aim is fewer, better-grounded fields rather than fuller files.
Data-subject rights
03Access, rectification, erasure, and objection are honoured on request within a defined response window. The subject can ask, at any point in the engagement, what is held, what is undergoing takedown, and what is sealed. Requests do not require justification.
Takedown posture
04Broker removals are pressed under Art. 17 (GDPR) and §1798.105 (CCPA) where the regime applies, and under equivalent state-privacy statutes where it does not. The takedown letter carries a notebook — record, basis, expected response window — that lives in the dossier.
Retention & cross-border transfer
05Working copies are engagement-bounded. On closing, the dossier is sealed, the working copies are destroyed under a written protocol, and a certificate of destruction is issued. Cross-border transfers are minimised: data moves only to the jurisdiction where the next step is taken, and the legal basis is recorded there too.
Investigator vetting & practice discipline
Every engagement runs under a vetted practitioner — no team, no subcontract, no handoff.
A unified engagement lives or dies by the practitioner who carries it. The vetting pipeline below is the standing gate every Threadkin practitioner passes before running a desk — and the practice discipline is the posture every engagement is held under from intake to certificate of destruction. The principle is single-custodian: one vetted reader takes the brief at intake and seals the dossier at closing; the notes do not fragment across teams and no part of the work is subcontracted.
The four-part vetting and practice discipline applied to every practitioner on the desk:
Vetting pipeline
01Each practitioner enters through a four-stage gate — open-source source-validation training under the same rubric applied in §i, genealogical record-handling training under the Genealogical Proof Standard applied in §ii, supervised first-cycle work on a paid engagement under the owner's review, and a signed practice-discipline undertaking that includes the no-handoff clause. A practitioner who has not passed every stage does not run an engagement.
Ongoing re-credentialing
02Vetting is not a one-time event. Practitioners re-attest annually to the source-validation rubric and the Genealogical Proof Standard application; sample audits are run on a quarterly cadence against prior dossier work to confirm the same standard is being applied. A practitioner whose drift is more than five percent on any standard is moved off the desk until the drift is corrected and re-tested.
Single-custodian, no-handoff rule
03One practitioner runs the engagement from intake to certificate of destruction. The brief is not re-read by a second analyst mid-engagement; the dossier is not passed to a junior for closure; no part of the OSINT or the genealogical work is subcontracted to a third party. The single-reader continuity is the privacy posture, and the audit trail — at intake, mid-engagement, and at closing.
Conflict-of-interest check
04Every engagement opens with a written conflict-of-interest check against current and prior dossier subjects, broker-letters in flight, and contemporaneous lineage work in the same jurisdiction. A conflict that cannot be cleared by re-assignment is the ground for declining the brief at intake, not at closing — the subject is not re-disclosed to a different reader because the first one was unavailable.
Sealed-at-rest practice
05Working notes, drafts, the fielded takedown letters, and the lineage-citation log are held at rest in an encrypted working ledger under the assigned practitioner only. No shared team drive, no shared team in-tray, no third-party hosted workspace for any draft stage of the work. The dossier is sealed on closing under a written protocol that names what was held, what was destroyed, and on what date.
What Threadkin does NOT coverThe boundary of the practice.
The framework above describes the published methods. The points below set out what those methods do not promise. Read them with the common questions for service information.
§ vi
No guarantee of broker removal.
A takedown letter is a request under a named statutory basis; the response is the controller's, not the practitioner's. Re-collection from a different source displaces a prior opt-out without notification. The dossier records each removal against the controller named at the time of the letter; it does not promise permanent redaction against re-ingestion by the same controller or by a third party downstream.
No legal advice.
Threadkin does not practise law and does not create a solicitor–client or attorney–client relationship. Letters are drafted from a verified record and addressed under the named regime; the client owns the responsible use of the letter and confirms the applicable regime, the controller's identity, the identity verification required, and the lawful basis for filing before it is sent.
No licensed investigation until the Victorian clearance is in place.
Fielded investigation activity — interviews, on-the-ground record retrieval, surveillance-grade work — is outside the published methodology until the assigned practitioner holds the Victorian private investigator licence (or an equivalent licence in the jurisdiction where activity would occur). This page describes desk-based use of open and primary sources; it does not invite fielded work.
No handling of protected or sensitive personal data without consent.
Special-category personal data — health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, data concerning sexual orientation or sex life — is not collected, stored, or graded against the dossier without the subject's recorded consent, captured at intake or, where the surface appears mid-engagement, before the field is opened. Where consent is withheld, the field is left closed and the dossier records the closed field rather than the substitute.
Read these limits alongside the common questions. Use contact for a general question about the published information.
About the framework
Two trails.
One custodian.
The framework above describes the published research methods and their boundaries. It explains how digital and ancestral source trails are treated separately and documented against named methods.
More on the practice: the engagement tiers and the standing answers.
Read the brokerage opt-out playbook for the bounded takedown scope, jurisdictional cadence, and the notebook fields the dossier holds to.
Read the lineage verification methodology for the three classes that enter the workflow — informal inheritance claims, credentialed genealogical documentation, and public lineage sources — and the boundary the verification is held to.
Read the digital-footprint mapping methodology for the public source classes, explicit exclusions, and audit-period snapshot delivered at close.
Where the practice sits
The two methods, applied.
The OSINT rubric and the Genealogical Proof Standard meet at the closing dossier. The work between is held the same way.
Choose your next step
Explore the service information, ask a general question, or get updates when launch news is available.