System Operational Cyber Helpline: 1930
Our Process

How SPIN Works

You tell us what happened. We help determine what needs to happen next.

You do not need to know the technical name of your problem or which SPIN service you need before reaching out to us.

Tell us what has happened, what concerns you, what digital information or evidence may be available, and what you are trying to achieve.

SPIN helps understand the situation, identify the type of assistance that may be appropriate, connect you with a suitable independent cyber investigator or forensic specialist, and support the matter through assessment, investigation, monitoring, recovery or forensic examination — depending on what the case requires.

01Your journey with SPIN
STEP 1
Tell us what happened
Explain the problem in your own words. Tell us what happened, what you are concerned about, what information or evidence may be available, and what help you are looking for. You do not need to diagnose the problem yourself.
Reach out to SPIN
STEP 2
We understand the situation
SPIN conducts an initial assessment to understand:
  • What may have happened.
  • Whether immediate action is needed.
  • What evidence should be preserved.
  • What type of technical assistance may be appropriate.
  • Whether another authority, platform, bank or professional may also need to be involved.
STEP 3
We identify the right service
Your requirement is mapped to the appropriate SPIN service:
SPIN Investigate — When something has already gone wrong.
SPIN Protect — When you want to assess or continuously monitor digital exposure.
SPIN Business — When the issue affects your organisation.
SPIN Forensics — When specialist examination of digital evidence is required.
SPIN Legacy — When assistance is needed with the digital estate of a deceased person.
A matter may move from one SPIN service to another as it develops.
STEP 4
We match you with the right Specialist
SPIN identifies an independent cyber investigator or forensic specialist suited to the matter.
Case allocation may consider:
  • Relevant expertise.
  • Nature and complexity of the case.
  • Required specialisation.
  • Availability.
  • Geography; where relevant.
  • Potential conflicts of interest.
STEP 5
We agree what needs to be done
Before substantive work begins, the scope of assistance is defined. This may cover:
  • What will be examined.
  • Information or evidence required.
  • Expected activities.
  • Expected deliverables.
  • Confidentiality requirements.
  • Applicable authority or documentation requirements.
  • Timelines.
  • Commercial terms.
STEP 6
The work begins
Depending on your requirement, the service may involve:
Assessment | Investigation | Investigation & Recovery Assistance | Specialist Forensic Examination | Ongoing Monitoring
Relevant evidence is identified, its preservation is facilitated, the agreed work is performed, and findings or outputs are documented.
02How different SPIN services work
Type of Service

Assessment

Understand the situation before deciding what comes next.

Review → Assess → Identify Findings → Recommend Next Steps

Used where the immediate need is to understand a defined issue, exposure or piece of digital evidence.

Type of Service

Investigation

Follow the available digital trail and understand what happened.

Facilitate preservation → Investigate → Reconstruct → Document → Recommend Next Steps

Used where an incident has occurred and relevant activity needs to be examined.

Type of Service

Investigation and Recovery Assistance

Investigate the problem and support legitimate recovery.

Facilitate preservation → Investigate → Identify Recovery Path → Assist Recovery → Secure

Used where the matter also involves recovering an account, device, digital asset or authorised access.

Type of Service

Specialist Forensic

Examine digital evidence using specialised forensic techniques.

Identify → Facilitate preservation → Examine → Reconstruct → Document → Report

Used for complex technical, legal, corporate or highly sensitive matters.

Type of Service

Ongoing Monitoring

Keep watch instead of waiting for another incident.

Set Scope → Monitor → Detect → Assess → Alert → Respond

Used where digital exposure or threats need to be watched over time.

03What happens to your Digital Evidence?
Identify
Preserve
Examine
Document

Where digital evidence is relevant, SPIN seeks to ensure that it is handled using appropriate forensic practices intended to preserve its:

  • Integrity
  • Authenticity
  • Traceability
  • Evidentiary Value

Depending on the matter, evidence may include digital communications, files, devices, account records, transaction information, media, metadata or other relevant electronic material.

For matters that may proceed to law-enforcement or judicial processes, careful handling and documentation become particularly important.

04SPIN's role during the Engagement

The Independent Specialist

The assigned investigator or forensic specialist conducts the technical work independently within the agreed scope.

You

Spy Eye Intelligence Network LLP (SPIN)

SPIN provides the organisational framework around the engagement, which may include:

  • Case onboarding and allocation.
  • Case monitoring.
  • Coordination where required.
  • Review of work deliverables.
  • Quality-assurance checks.
  • Operational escalation.

This allows SPIN to support service consistency while preserving the professional independence of the specialist conducting the technical work.

05What you may receive

Depending on the service, outputs may include:

Assessment Reports.
Investigation Findings.
Exposure Reports.
Monitoring Alerts.
Incident Summaries.
Evidence Inventories.
Digital Timelines.
Forensic Examination Reports.
Recovery Recommendations.
Reporting Support Packs.
Digital Estate Maps.
Recommended Next Actions.

Not every matter will require every type of output.

06What happens after the findings?

Once the agreed work is completed, the next step may be to:

  • Close the Matter — Where no further action is required.
  • Continue Investigation — Where additional evidence or deeper investigation is needed.
  • Proceed With Recovery — Where an authorised recovery or restoration process is underway.
  • Begin or Continue Monitoring — Where ongoing visibility would be useful.
  • Escalate the Matter — To a bank, platform, law-enforcement agency, legal professional, court, tribunal or another appropriate institution.

SPIN may assist with the relevant technical information, evidence or documentation needed for the next stage, where applicable.

07Service-specific journeys

SPIN Investigate

Understand → Facilitate preservation → Investigate → Recover / Contain → Report / Next Action

SPIN Protect

Assess → Monitor → Alert → Respond

SPIN Business

Assess Risk → Investigate → Facilitate preservation → Understand Impact → Respond

SPIN Forensics

Identify → Facilitate preservation → Examine → Reconstruct → Document → Report

SPIN Legacy

Contact → Identify → Map → Establish Authority → Access / Transfer → Preserve / Memorialise / Close

08The Assurance behind the Process

SPIN's Commitment to Excellence and Professional Integrity

SPIN's framework is designed to support professional integrity, service consistency, forensic discipline and accountability.

SPIN's framework involves:

  • Investigator Verification and Empanelment — Specialists are subject to SPIN's verification and empanelment processes.
  • Expertise-Based Case Allocation — Cases are matched with specialists based on relevant capability and geographical proximity; wherever relevant.
  • Conflict-of-Interest Safeguards — Potential conflicts are considered during case allocation.
  • Appropriate Forensic Practices — Relevant evidence is handled using suitable forensic practices.
  • Confidentiality and Data Protection — Client and case information is handled strictly in adherence to applicable confidentiality and data-protection requirements.
  • Case Monitoring — SPIN provides operational oversight of engagements.
  • Quality Assurance — Investigation outputs undergo appropriate review before completion.
  • Grievance and Escalation — Mechanisms are available for raising and escalating service-related concerns.
09Handling of Privacy and Sensitive Cases

Some matters require additional privacy, sensitivity and safeguarding.

Depending on the case, controls may include:

  • Restricted investigator access.
  • Minimal-necessary disclosure.
  • Minimal duplication of sensitive content.
  • Secure evidence handling.
  • Controlled transfer.
  • Confidentiality safeguards.
  • Additional safeguarding or reporting procedures; where required.
  • Where children are involved, applicable safeguarding and reporting requirements take precedence over ordinary investigation procedures.
10What SPIN will NOT do!

SPIN does NOT:

  • Obtain unauthorised access to accounts, devices or systems.
  • Bypass passwords, private keys or legitimate security controls.
  • Guarantee identification of anonymous persons.
  • Guarantee recovery of money, accounts or digital assets.
  • Guarantee that every threat or exposure can be identified.
  • Guarantee platform takedowns or content removal.
  • Replace law-enforcement agencies, courts or legal advisers.
  • Determine legal liability, ownership or succession rights.
  • Guarantee the admissibility or evidentiary weight of evidence before a court or authority.

SPIN operates within the lawful and technically available scope of each matter.

11Not sure where to start?

You do not need to choose the right service before speaking to us.

Tell us:

  • What happened.
  • What concerns you.
  • What information or evidence you have.
  • What you are trying to achieve.

We can help identify the appropriate starting point.

Let's figure out what you need