From record
to entity.

The pipeline

Publictrace turns heterogeneous public records into a consistent, traceable entity graph. Raw records are retained so normalization never destroys the publisher’s original statement.

Collection

We pull from 27 federal sources on each agency's native cadence, more than 22 million records in all. SEC EDGAR and SAM.gov refresh daily; OSHA inspections (federal plus all 22 state-plan programs, not just the federal feed) and IRS Form 990 refresh weekly. Federal court dockets refresh on the FJC's quarterly release schedule. We do not invent a faster cadence than the agency publishes.

Raw responses are archived before parsing. If an agency retroactively edits a record (it happens), we keep the version we ingested and surface the change as a new event rather than overwriting silently. Parsed rows carry the original public URL where the agency exposes one.

We do not scrape behind paywalls, login walls, or PACER. If a record requires a paid lookup to verify, we either skip it or store only the public summary the agency has chosen to release.

Identity resolution

Most public-record systems do not share an identifier scheme. The same company is "BOEING CO" in one filing, "The Boeing Company" in another, and "BOEING DEFENSE, SPACE & SECURITY" in a third. The job of resolution is to decide, record by record, when two strings refer to the same entity and when they do not.

Identifier-backed matches are preferred. Where a record carries a regulator-issued identifier (CIK, EIN, LEI, RSSD, FDIC cert, OCC charter), that identifier is the anchor. Two records with the same anchor identifier are the same entity, regardless of how the names differ.

Records that arrive without a strong identifier — OSHA inspections, agency press releases, and most consumer-facing notices identify a company by name and address only — pass through additional automated and manual review before attribution. The threshold for accepting a name-only match is materially higher than the threshold for an identifier-backed match. Records that fail to clear it are not attributed; they remain visible as possibly-related leads under their candidate entity, with the disclaimer that they need verification before they can be treated as facts.

Hierarchy

Subsidiary and parent relationships have their own provenance and effective dates. A match to a subsidiary is not automatically presented as a direct record of the parent.

Corrections

Resolution changes are versioned. Corrections can split an accidental merge, join duplicates, or reassign records while retaining an audit trail.

People

Person records are resolved by name within each company's filings. Cross-company linking happens only on a strong identifier — an SEC filer CIK, a validated NPI, or a sanctions-list ID; records that merely share a name are surfaced as explicitly-labeled unverified leads and are never merged automatically. Person data is corporate-governance evidence (officers, directors, reporting owners as filed) — it is not identity verification, and under our Terms it may not be used for any FCRA-covered purpose.

Enrichment

Resolution gives us a clean entity. Enrichment is what makes that entity useful: the structural and contextual data that a single record alone could never tell you.

Corporate trees

Public companies report their subsidiaries annually in Exhibit 21 of their 10-K. We parse the reported subsidiaries into directed parent-to-child relationships, resolve each subsidiary to a canonical entity in our graph, and expose the result through a single corporate-tree endpoint. Where Exhibit 21 disagrees with itself across years, we keep the most recent year's edge and mark the prior one as historical rather than overwriting.

Financials

For SEC-registered filers, we extract a small, stable set of income-statement and balance-sheet metrics from each company's most recent annual XBRL filing — revenue, net income, total assets, total liabilities. We do not synthesise ratios or trends; we expose the raw numbers and the filing they came from.

Sanctions memberships

Entities are cross-referenced against a consolidated sanctions dataset that unifies OFAC, OFSI, EU, UN, and other regulator lists. A sanction match in PublicTrace is a deterministic identifier or canonicalised-name join against that dataset; the underlying list source and the listing topic are surfaced verbatim so you can verify the basis directly.

Sanctions enrichment is informational. The authoritative record for any sanction is the originating list maintained by the sanctioning authority, and that list is the system of record for any compliance decision.

Possibly-related records

Some records resist deterministic attribution: an inspection at a regional facility might or might not belong to the parent's canonical entity, depending on ownership at the time of the event. Rather than guess, we hold these in a separate possibly-related view per entity and label them as exactly that.

Possibly-related rows are surfaced with a per-row confidence indicator and the disclaimer that they are leads to verify, not facts to cite. They never count toward an entity's risk score.

Risk score

For entities with attributable enforcement signal, we compute a single composite score on a 0–100 scale, broken into four dimensions:

• Enforcement — formal regulator actions, securities and consumer-protection orders.
• Sanctions — listings on US or allied sanctions and exclusion programs.
• Workplace — workplace-safety and wage-and-hour findings.
• Environmental — environmental-enforcement actions and reporter-class violations.

The scale is severity-anchored. A terminal regulatory fact — a binding sanctions designation, or federal debarment / exclusion that bars an entity from doing business with the government — sets a high base score on its own; lesser signal (penalties, enforcement orders, safety and environmental findings) accumulates on top of that base toward 100. An entity with no such terminal fact cannot reach the top band through accumulation alone. This keeps the worst real outcomes near the ceiling instead of clustering in the middle of the range.

Scores are source-backed — each contribution traces to a specific agency record visible in the entity's profile. They are recency-aware — older events contribute less than recent events of the same kind. And they are versioned — each score records the methodology version under which it was computed. Older scores stay attached to the version that produced them; we do not silently re-score historical data to make a new methodology look correct in retrospect.

Tier labels (low / medium / high / critical) are intentionally conservative. The score is a triage signal for analyst attention; it is not a clearance.

Provenance and verification

Records we serve carry:

• The source agency and the dataset within that agency the record came from.
• A direct URL to the original record, where the agency exposes one. For sources whose URL is constructable from a stable identifier (SEC EDGAR per-filing, Senate LDA filings, etc.) we construct and store it.
• The record date as the agency reported it, with a documented fallback to the ingest timestamp only when the agency-reported date is missing.
• A stable record ID so the same row can be referred to across requests and across releases.

This provenance chain is the contract. If an entity's PublicTrace profile says it has an OSHA violation, the violation row carries the OSHA case number and a deep link back to OSHA's public site. If the agency takes the record down, the link will break — and that is, deliberately, evidence in itself.

Cadence and freshness

Each source has a documented refresh cadence (see the per-source detail on /sources). The per-entity profile and the public sources status page surface the timestamp of the most recent ingestion for each source. If you need to know whether the data underneath an entity is less than 24 hours old, less than a week old, or older, that information is available without asking.

What this is — and isn't

PublicTrace is a structured access layer over public US federal records. It is built to make analyst work faster and to make integrations possible without bespoke scrapers per agency. It is not:

• A consumer reporting agency. Per our Terms, PublicTrace data may not be used as a consumer report or to make employment, credit, insurance, housing, or government-licensing decisions about an individual.
• A sanctions screening clearance. Sanctions memberships are surfaced as evidence; the regulator's own list is the system of record.
• An exhaustive global picture. We cover US federal sources. Foreign regulator lists, state-level enforcement, and private-sector adverse-media databases are out of scope.
• A legal opinion. Disposition codes, enforcement outcomes, and tier labels reflect machine-readable agency reporting. They do not constitute a legal interpretation of liability.

What we make easy to verify

No public-records corpus is complete, and a methodology page that pretends otherwise is not worth reading. Rather than list a moving census of internal gaps, we make the live state of the corpus directly inspectable so you can evaluate it against your own use case:

• The sources page documents each dataset in the corpus, the agency it comes from, the refresh cadence we run, and the timestamp of the most recent ingestion.
• Entity profiles show their evidence inline: the source records, their dates, and a link back to the original agency URL. You can see what we have on a given counterparty before relying on it.
• The possibly-related view per entity surfaces leads we could not deterministically attribute, so you can see what we know we are missing on the specific entity you care about, rather than reading our averages.
• Each risk score exposes the methodology version and the timestamp at which it was computed, so you can decide whether it is fresh enough for your decision.

If you spot an attribution that looks wrong on a specific record — a sanction listing on the wrong entity, an enforcement action mis-dated, a subsidiary edge that contradicts the source filing — please write to [email protected] with the entity ID and the record ID. Specific corrections ship faster than abstract feedback.

Methodology versioning

We version the rules behind this pipeline. Each risk score carries a methodology_version. Material changes get a new version number and are announced before they ship. Older scores stay attached to the version under which they were computed; we do not silently re-score historical data to make a new methodology look correct in retrospect.

This page itself is dated at the top. When the methodology moves materially, the date moves with it.