Professional profiles
Current positions listed on professional networks and portfolio sites, compared with dates and archived versions.
Overemployed OSINT Checks for Undisclosed Dual Employment
An overemployed OSINT check looks for public, work-related evidence that a current employee is holding a second full-time job they have not disclosed. We run it only for HR and legal teams with a specific, documented concern, review only professional signals, and report in a form that supports a fair process with the employee.
- Remote staff and contractors
- Exclusivity and conflict concerns
- Public professional signals only
- No covert monitoring
Short answer
An overemployed OSINT check reviews public, professional traces such as profiles, company team pages, public code, talks and press for signs that the same person holds two overlapping jobs. It is appropriate only when a contract clause, conflict policy or billing integrity is at stake and the concern is specific. It never covers private accounts, devices or personal life, and findings go to HR and counsel, not managers.
When an Overemployment Concern Justifies a Check
A second job is not unlawful in itself. A check is justified when the second job may breach a contract or policy and there is a concrete reason to suspect it.
Typical triggers are an exclusivity or moonlighting clause, a conflict-of-interest policy the second employer would breach (a competitor, supplier or client), contractor hours billed to you that may overlap with another employer's, and roles with access to confidential code or customer data. The concern usually starts with something specific, such as the person appearing on another company's team page.
Lower output, missed meetings or a camera that stays off are management questions, not grounds for an investigation on their own. Nor is membership of an online community where people discuss holding two jobs: discussing pay and working conditions can be protected activity, as the legal section below explains.
Public Signals Overemployed OSINT Can Check
Only professional traces that the person or another employer has made public. Each one is a lead to verify, not a finding.
Team pages and press
Another company's staff pages, announcements, case studies or webinars naming the person in a current role.
Public code contributions
Commits and reviews under another organization's public repositories, with their dates.
Talks, papers and patents
Conference talks, publications and patent filings that list another employer as affiliation.
Registered side businesses
Directorships or consultancies in public registries that sell the same services to others.
Freelance marketplaces
Active contractor profiles offering the same skills, with visible recent engagements.
Reading OSINT Evidence: Innocent Explanations First
Most single signals have an ordinary explanation. A report should show the strongest innocent reading next to each finding.
| Signal | What it may show | What it does not prove |
|---|---|---|
| Two current roles on a profile | Overlapping employment | Profiles are often out of date, and advisory or part-time roles may be permitted |
| Commits to another company's repository in working hours | Work for another organization | Open-source contribution can be allowed by policy, and time zones distort timestamps |
| Name on another company's team page | A current role | It may be a namesake, an old page or a former role never removed |
| An active freelance profile | Paid side work | It says nothing about hours or conflict unless the clients or work overlap with yours |
Each finding is tied to the employee with identifiers HR already holds and graded; a possible namesake is reported as unconfirmed.
How a Proportionate Overemployment Check Runs
The concern and the legal basis are written down before any research starts, and the employee gets a chance to respond before any decision.
- Document the concern and the ruleHR and counsel record what triggered the concern and which clause or policy the second job would breach.
- Set a narrow scopeOne employee, a defined period and public professional sources only. In the UK and EU, the employer considers a DPIA first.
- Collect and captureAnalysts search public professional sources and capture each relevant page with its date.
- Verify and weighEach signal is matched to the employee, checked for namesakes and set against its innocent explanation.
- Report to HR and counselA senior analyst reviews the report. It goes to the people running the process, who decide how to put it to the employee.
Moonlighting Clauses, the NLRA, FCRA and GDPR
Employment law decides what you may do with a finding, and data-protection law decides how far the check may go. Counsel should confirm both before the work starts.
- The contract. Check what the clause actually prohibits. Some jurisdictions limit action over lawful off-duty conduct; in California, for example, the Labor Commissioner takes claims for lost wages after demotion, suspension or discharge for lawful conduct during nonworking hours away from the employer's premises (Cal. Labor Code §96(k)). How that applies to a second job is a question for counsel.
- Protected activity in the US. Section 7 of the NLRA protects concerted activity about employees' interests as employees, and employers may not spy on protected activity or create the impression of doing so (NLRB). We do not monitor forums or groups where workers discuss pay or second jobs.
- FCRA for third-party investigations. A report by an outside firm on suspected employment misconduct can fall outside the definition of a consumer report if it meets set conditions, such as going only to the employer; if you then take adverse action, you must give the employee a summary of its nature and substance (15 U.S.C. §1681a(y)).
- UK GDPR and GDPR. The ICO says a DPIA is required before monitoring likely to be high risk, that covert monitoring is unlikely to be justified in most circumstances, and that workers' expectation of privacy is significantly greater at home (ICO).
This is a summary, not legal advice.
What We Will Not Do, and What You Receive
No private accounts, no fake recruiters, no devices and no contact with the other employer. You receive a sourced report from 10 business days.
We do not view private or friends-only content, create fake profiles, approach the employee with a fake job offer or recruiter message, contact the suspected second employer under a pretext, track devices or locations, or look into the employee's home or family life.
The report sets out the sources searched, each finding with its capture, date, confidence and innocent explanation, and the gaps only the employee could close. A focused check takes from 10 business days, and narrow questions can sometimes be answered in one. The quote is fixed after written scoping, urgent delivery costs 50% more, and the fee goes down if we miss the agreed date.
If the concern is about leaked data or sabotage rather than a second job, it belongs in a cyber investigation. For new hires, employment verification and remote candidate identity verification catch problems before the offer. Security teams can see our wider OSINT services for corporate security.
Bring the Concern to HR and Counsel First
Send the role, the clause or policy at stake and what triggered the concern. We reply with a lawful scope, a delivery date and a fixed quote.
Overemployment Check FAQ
One of our remote engineers appears on a competitor's team page as a current employee — can an overemployed OSINT check confirm whether she really holds both jobs without us spying on her?
Yes, within limits. An overemployed OSINT check looks only at public professional traces, such as team pages, archived versions, professional profiles, public code and talks, and tests whether they belong to her and are current. We do not view private accounts or devices. The report gives each finding with its date, confidence and innocent explanation, so HR can put it to her fairly.
Our contract has a moonlighting clause, but the employee lives in California — can we still discipline him if your check shows he works a second job for another company?
That is a question for employment counsel before you act. California's Labor Commissioner takes claims for lost wages after discipline or discharge for lawful conduct during nonworking hours away from the employer's premises, and the answer depends on the clause, conflicts and how hours overlap. Our report documents the facts; counsel decides what you may do with them.
Several of our developers are members of an online overemployment community where people swap tips about holding two jobs — can you monitor that group to find out which of our staff are doing it?
No. Discussing pay and working conditions with other workers can be protected concerted activity under the NLRA, and employers may not spy on it or create the impression of doing so. Membership of a community is also not evidence of a breach. We only run checks on one named person with a specific, documented concern, using public professional sources.
We're a UK company and suspect a contractor billing us full-time hours is also employed elsewhere — what does UK GDPR require before we ask you to look into it?
Record the concern and the contract term at stake, keep the scope to public professional sources, and consider a DPIA, which the ICO says is required before monitoring likely to be high risk. Covert monitoring is unlikely to be justified in most circumstances, so make sure your policies tell staff and contractors that conflict checks can happen.
Could your team just message our employee from a recruiter profile and offer him a job to see whether he admits having two roles?
No. Approaching an employee under a false identity is pretexting, which we do not do. It can also undermine any later disciplinary process and expose you to claims. If HR wants to ask the employee about outside work, the honest route is to ask directly, ideally after reviewing what public sources show.
If you find evidence that our employee is overemployed, what exactly will we receive, and how quickly can we have it before a scheduled HR meeting?
You receive a report with each public finding, its capture and date, how it was tied to the employee, a confidence grade and the most likely innocent explanation, plus the questions that only the employee can answer. A focused check takes from 10 business days; urgent delivery costs 50% more. Narrow questions can sometimes be answered in a business day.
Sources and Notes
- NLRB: Interfering with employee rights (Section 7 and 8(a)(1))
- California Labor Code §96
- 15 U.S.C. §1681a(y): exclusion of certain communications for employee investigations
- ICO: Data protection and monitoring workers
Sources checked 10 October 2026. Figures about third-party firms and tools are as published by them or by the cited source on that date.