Breach Monitoring
Kit checks your team's login emails — and extra addresses you choose to monitor — against the Have I Been Pwned breach database every day and alerts you when one turns up in a recent leak.
Why It Matters
Reused and leaked passwords are the most common way accounts get taken over. If a team member’s email and password were exposed in a breach somewhere else, an attacker can try the same credentials on your Kit account. Breach monitoring gives you an early warning so you can rotate the password before that happens.
Note
Breach monitoring is included on paid plans. It runs automatically — there’s nothing to set up.
How It Works
Once a day, Kit checks every team member’s login email against Have I Been Pwned, the industry-standard database of known credential breaches.
- The check covers the login emails of people on your account — not candidates, prospects, or other contacts.
- The first time an email is checked, Kit records its existing breaches quietly as a baseline. You are not alerted about old, historical leaks.
- After that, you’re alerted only when an email turns up in a breach that was newly added to Have I Been Pwned recently — a genuinely new exposure.
Monitoring Extra Addresses
Team logins are covered automatically, but breaches don’t stop at logins. You can also watch addresses that aren’t anyone’s Kit login — a shared support inbox, a billing alias, a role account like [email protected].
- Account admins manage the list under Account Settings → Monitored Addresses.
- Every address must be confirmed by its owner before any scanning starts. Kit emails a confirmation link to the address itself, and only confirmed addresses enter the daily scan — so nobody can quietly monitor an inbox they don’t control. The link expires after 3 days; admins can re-send it from the list.
- When a monitored address turns up in a new breach, account admins are alerted, in-app and by email.
How Many Addresses You Can Monitor
The allowance scales with your subscription: 3 monitored addresses per paid seat.
| Paid seats | Monitored addresses |
|---|---|
| 1 | 3 |
| 5 | 15 |
| 10 | 30 |
The settings page always shows how much of your allowance is in use.
Note
If you reduce seats and end up over your allowance, nothing is deleted — existing monitored addresses keep working and keep being scanned. You just can’t add new ones until you’re back under the limit: remove an address, or add a seat.
What Triggers an Alert
A new, recent breach for a team member’s email. When that happens:
| Who is notified | How |
|---|---|
| The affected team member | In-app notification + email |
| Account admins | In-app notification + email |
This lets the person act on their own account and lets admins enforce a reset across the team.
What to Do When You’re Alerted
Warning
Treat a breach alert as a prompt to act today, not later.
- Change the password on the affected Kit account immediately.
- Turn on two-factor authentication if it isn’t already.
- Stop reusing that password anywhere else — use a unique password per site.
Your Privacy
Have I Been Pwned only reveals which sites were breached — never your actual password. Kit never sees or stores your credentials, and stores only the names of the breaches an email appeared in. No passwords, ever.
Controlling Notifications
Breach alerts are part of the Security alerts category in your notification settings. You can adjust email delivery from Email & Notification Preferences — though we strongly recommend leaving security alerts on.
Quick Checklist
- Confirm your account is on a paid plan (monitoring is automatic).
- Make sure your team’s login emails are current.
- Add shared inboxes and role accounts as monitored addresses — and have their owners confirm them.
- Keep Security alerts enabled in your preferences.
- Have a password-reset plan ready for when an alert arrives.