What is the CRD Engine?

CRD Engine is the proprietary infrastructure CRD uses to operate its content-protection workflows. It brings detection, DMCA reporting, follow-ups, surveillance, removal confirmation, and deindexing into one system across 500+ platforms.

How does CRD use the pipeline?

CRD uses the Engine to detect and classify results, identify the platform, prepare and send the appropriate DMCA report, monitor the reported URL, schedule follow-ups, confirm removal, and initiate search deindexing when applicable.

How can I use the CRD API?

The CRD API is live and included for verified agency accounts. It connects your software to creator management, scans, direct reports of leaks or impersonation accounts, CRD’s removal workflows, eligible deindex requests and signed webhooks. The API supports leak and impersonation tracking, customer-safe activity history and signed status webhooks. Paid legal escalation for leak cases is available in private rollout, on request. Manage keys, webhook receivers and usage in the agency dashboard, and find integration guides in the API documentation.

How can agencies access CRD Engine workflows?

Verified agencies use the agency portal and can connect their own software to the same CRD creators and cases. Software providers follow the same agency account model. Agency onboarding and KYC verification are required; each creator must also meet CRD’s onboarding, authorization and protection requirements before scans can start.

What version is CRD Engine on?

CRD Engine is on v4.8, released in 2026. This release expands the agency API with more reliable invitations, direct leak and impersonation reports, profile photos, per-creator domain whitelists and additional on-demand scans. Paid legal escalation for leak cases is in private rollout. The full release history from v1.0 onward is published on this page.

What technology does CRD Engine run on?

The public layer uses standard, widely adopted infrastructure: a mainstream web framework and database, managed edge hosting, a regulated payment provider, and the search engines CRD files de-indexing requests with. The layers that decide what gets detected, matched, filed and removed are proprietary. Sources, query strategies, models and vendors are documented for partners under NDA, not published.

How often does CRD Engine scan for new leaks?

Scan cadence follows the plan: weekly on entry plans, several times a week in the middle tiers, and daily on the top tier. A deeper scan also runs when an account starts and at each renewal. Independently of that schedule, every URL already reported stays under continuous monitoring until removal is confirmed.

Does CRD Engine handle search engine de-indexing?

Yes. Confirmed infringing URLs are submitted for removal from search results and image results. A hygiene gate filters out anything that should never be submitted, duplicate protection prevents the same URL being sent twice, and the engine reads the responses that come back so domains that keep getting rejected are suppressed automatically. Acceptance is tracked as a live score.

What happens when a platform ignores a DMCA notice?

The engine re-checks the URL before doing anything else, so a page already taken down is never chased. If it is still live, follow-ups go out on a three-day escalation interval with increasing urgency, up to three times. After that the case is escalated for legal review rather than looping silently.

Sending a DMCA is easy. Getting the takedown is not.

The proprietary infrastructure behind every CRD removal. For each platform: who to contact, what to send, when to follow up, when to escalate, how to verify.

See what’s new

The original sketch.

Drawn by the founder in CRD’s earliest days.

Instagram
TikTok
Reddit
Telegram
X · Twitter
Forums
Mirrors

01Leak discovery02AI detection03DMCA automation

social + leak sitesmatch + evidencenotice + follow-upsRemoval verified

795Documented platformsCRD Index 4Search enginesCRD Intel

150K+DMCA notices sent

88.1%

<2hAverage first action

0Manual steps required

Pipeline

Six steps. Zero manual work.

Every step runs autonomously, 24/7, from the first scan to the confirmed removal and the search de-indexing that follows it.

Detection

Find what’s out there.

AI scanners run continuously across leak sites, forums, mirrors and file hosts to spot new leaks quickly.

Images, profiles and links are matched before the result enters the queue.

The outcome

An identified result, ready for processing.

Frontend

Next.js 16Public web
React 19Interface layer
TypeScriptTyped application
Tailwind CSSVisual system
Framer MotionInterface motion

Backend & Data

SupabaseManaged backend
PostgreSQLPrimary database
Edge FunctionsServerless compute
Row Level SecurityData isolation
DenoRuntime

Integrations

ResendEmail delivery
StripeBilling
VercelWeb delivery
AppleiOS app
CloudflareNetwork & DNS

Search ecosystem

Coverage across major search engines.

Coverage

GoogleSearch + Images
BingSearch coverage
YahooSearch coverage
YandexWeb search

What this supports

AI detection
Cross-platform coverage
DMCA notices
Continuous monitoring
Follow-up management
Verified removals
Duplicate protection
Delivery monitoring

Need the public architecture brief? Contact support

APILive

CRD Engine API

Connect your software to CRD: creators, scans, reports and removals, all in one agency workspace.

One connected workflow

Your software. Our engine.

Connect your agency
Create a scoped key in your agency dashboard.
Use the existing workflow
Your creators and leak cases stay synchronized with the CRD portal.
Follow every stage
Read case status or receive signed events in your software.

API documentation

API access is included for verified agencies. Manage keys, webhooks and usage in your dashboard.

Access through your agency

Explore the API

REST / v1

Profiles stay in sync with the portal. Protection follows CRD authorizations.

CRD processes your requests. Paid legal escalation is available on request.

Track leak cases through the API. Receive updates through signed webhooks.

Build log

How the engine got here.

Every release that changed how leaks get found, filed and removed. Nothing here was replaced. All of it still runs inside v4.9.

v4.9 v1.0

v4.92026CURRENT RELEASE

Your own photos, recognised on leak sites

v4.9 teaches the engine to recognise a creator’s own photos on leak pages. A link is confirmed when it carries her content, and removal checks look for the photos themselves, not just the page.

What changed7 changes

Photo fingerprints: every photo on a leak page gets a fingerprint that stays the same when the photo is resized or recompressed. A creator’s photos are learned from leaks already confirmed as hers, with nothing for her to do.
A photo only counts once it has been seen on two different leak sites, and never on another creator’s page. Logos, ads and “similar creators” suggestions are never mistaken for her content.
A link that does not name her is confirmed when it carries her photos. Otherwise it stays with our team: your dashboard only shows leaks confirmed as yours.
Removal checks by content: we go back to reported pages and check whether your photos are still there, instead of guessing from the page text.
Analysis runs in an isolated browser on CRD infrastructure. No page or image is kept, and it is not facial recognition: no biometric data is processed.
Mirror domains run by one operator (Bunkr and its extensions) are handled as a single platform: one contact, one follow-up, one report.
Google de-indexing for an agency model starts as soon as the model is activated, with no waiting period.

v4.82026

Your software, connected to the protection workflow

v4.8 expands the agency API with creator management, direct reporting of leaks and impersonation accounts, on-demand scans and case tracking. Operations use the same records and workflows as the CRD portal.

What changed7 changes

More reliable email invitations: fixed a delivery failure found in an end-to-end test. An invitation sent through the API can also be cancelled before it is accepted.
Report a leak or impersonation account directly from your software. Leaks enter the usual reporting and removal workflow, and reporting the same URL again does not create a duplicate case.
Profile photos by URL: the image is imported into CRD and appears in the portal, in the same place as a photo added during onboarding.
Per-creator domain whitelist: add, read or remove an allowed domain in the same list the CRD team already manages.
Additional on-demand scans include Yandex, capped at five per creator in a rolling seven-day window. Automatic monitoring follows the creator’s CRD plan without running a second schedule alongside it.
Leak case tracking stays synchronized with CRD, with signed webhooks for observed changes. Delivery attempts and replays are available in the agency dashboard.
Paid legal escalation for leak cases: share a payment link with the agency or creator and track its status. In private rollout, available on request.

v4.72026

A takedown notice that can't be waved off on a technicality

A notice missing a return address or the words “penalty of perjury” gives a host's legal team an excuse to do nothing, whether or not the claim is real. v4.7 removes the excuse, and tightens what happens after it's sent.

What changed6 changes

Every notice now carries a physical address and phone number, alongside the accuracy declaration made under penalty of perjury: the two elements a platform could reject a notice over on a technicality, closed for good
Notices now list only the paid platforms that actually establish ownership, capped at three, instead of a dozen social handles that add nothing to the legal claim
Subject lines now say what they are: every notice, every follow-up, opens with “Official DMCA Takedown Notice” instead of a vague description a host's abuse queue has no reason to prioritize
The verification sweep now runs every hour instead of once a night, and checks leaks that were never even reported: a page that quietly died before a notice went out no longer sits stuck as “Found” indefinitely
Sites hiding behind a bot-challenge page are no longer mistaken for either removed or still live: the engine recognizes the challenge itself and re-checks through a route that actually sees the page
Adding several accounts on the same platform (a second OnlyFans, a third Instagram) now works the same everywhere: the app, onboarding, and the web all stopped hiding a platform after its first username

v4.62026

A leak that comes back no longer slips through

A site that puts the same content back after a takedown was counting on nobody looking twice. v4.6 looks.

What changed5 changes

A leak taken down once and quietly reposted is caught on the next sweep and its case reopened, instead of being filed away as solved
Every reappearance goes past a person before anything is sent: a site that republishes after complying is handled deliberately, not with a second automatic notice
Image surveillance on every sweep, across the full breadth of results: about a third more sites surfaced
Identity matching rebuilt around how leak sites actually write a creator's name: about 2.5x the sites found
Google de-indexing widened on images, where a single set of photos is re-cropped and re-hosted dozens of times

v4.52026

The engine goes where others give up

Some platforms accept no email at all: only a form, buried three pages deep. v4.5 files there anyway.

What changed8 changes

Assisted filing on platforms that only accept a web form, the ones where an email never gets an answer
Every reply that comes back is read and sorted automatically: removal confirmed, exact link requested, counter-notice, or dead address
A confirmed removal closes its own case and updates what the engine knows about that platform's response time
Deepfake and AI-generated content built from a client's face is treated like any other leak: detected, qualified, filed
Country mirrors and photo-by-photo URLs collapse into one case, so a leak is filed once instead of forty times
Impersonation sweep on a second search engine, the one still indexing what Google has already dropped
Scans skip official creator platforms, review sites and our own domains before anything is classified
Scan frequency follows the plan, with daily sweeps on the top tier

v4.42026

Finding what search forgot

A leak that has dropped out of search results has not gone anywhere. v4.4 goes and finds it where it actually lives.

What changed6 changes

Wider search coverage: the engine now surfaces leaks that fell out of standard results long ago
Verified platform-contact database considerably expanded, so far more sites are reportable from the very first scan
New leak sites are added to the database automatically as they appear
Sharper matching on multi-word stage names and every spelling variant of a handle
Reliable capture of leak pages on file hosts and CDNs, where the content hides behind a direct link
Fewer false escalations: the pipeline routes correctly for platforms that already have a working abuse contact

v4.32026

De-indexing that learns from Google

The engine stopped guessing what Google accepts. It reads Google's own replies and adjusts what it submits.

What changed4 changes

Feedback loop: Google's replies are read, and domains it keeps rejecting are suppressed automatically
Live removal score computed from Google's actual decisions (currently ~77%)
On-demand de-indexing: scans fire when there is something to submit, not on a fixed calendar
Full-profile extraction: the engine walks an entire stolen creator profile to capture every post, not just the first page

v4.22026

Zero wasted submissions

Every de-index submission counts. v4.2 stopped spending them on nothing.

What changed3 changes

Pre-submission hygiene gate: homepages, search engines, studios and tubes are filtered out automatically
Duplicate protection: the engine reads the replies it gets and never resubmits a URL already handled
Auto-record on submit, so no submission is ever lost on the way out

FAQ

Frequently asked questions.

The infrastructure behind CRD.

Built for CRD's own removal operations. Agencies run their whole roster on the same engine through our partnership program and agency app.

Agency access

Sending a DMCA is easy. Getting the takedown is not.

The original sketch.

Six steps. Zero manual work.

Find what’s out there.

The right contact. For every platform.

A notice ready for action.

Sending is a start. Verification follows.

No response? The follow-up continues.

Removal confirmed. Evidence preserved.

Built on what works.