Not all removal services are equal: why security engineering changes the result

01Same label, very different work

The question heard most often is whether all removal services are basically the same. They are not. The label online content removal describes a result, not a method, and the method is where providers differ. Nothing on a website tells you which kind you are dealing with, and every provider sounds confident on the first call.

The difference shows a few weeks later. A video that was reported comes back under a new address. Your name still pulls up the same results. Or you are told reports were filed, but nobody can show you which URLs actually came down. Those are the symptoms of a service that works by hand and stops when the first route fails.

Moving right across the table, people do not do less. They do different work. Repetition goes to software, and human time goes to the decisions software cannot make: whether a person in a frame is really the client, and which ground will actually be accepted.

02How distributors hide content

People who spread leaked footage or coordinated abuse are more methodical than most victims expect. The same file goes onto several mirror sites at once. The sites sit behind a content delivery network so the real server is not visible. When a notice arrives, the operator moves to a new domain and reopens.

• Mirrors: one upload copied to many domains, often run by the same operator.
• CDN fronting: the address you see belongs to the network in front, not to the host.
• Domain hopping: a reported domain is dropped and the content reappears on a fresh one.
• Disguise: new titles, removed names, cropped or mirrored frames so search does not match.

This is why a name search finds so little. It only catches copies that still carry the name, on sites that search engines have indexed. The copies that do the most damage are often the ones stripped of every identifier, and they are found by matching the face or the file, not the words around it.

Beating that requires knowing how the other side builds it. That is what security work is: watching how attackers get in and cover their tracks. SARAZIM LLC's founder came from Palo Alto Networks and uses the same habits in reverse, reading where a site is hosted, what sits in front of it and who manages its domain before deciding where to send anything.

03When the site operator ignores you

A manual service tends to stop when an overseas site does not answer, and calls it impossible. The structure behind the site usually offers other doors. Cloudflare, for example, states that it does not host content passing through its security and CDN services and cannot remove what it does not host. What it does is forward the complaint to the website operator and the hosting provider, and give the hosting provider the origin IP address so it can locate the material.

Registrars accredited by ICANN must keep an abuse contact, publish an abuse email address, and take reasonable and prompt steps to investigate and respond to abuse reports. None of these layers is a guaranteed removal, and each needs the right evidence. The point is that a silent operator is the start of the work, not the end.

Reading that structure is technical work: resolving where a domain points, separating the CDN from the origin host, identifying the registrar, and choosing which of them has both the ability and a policy reason to act. A manual service rarely gets past the first layer, so a single unanswered email becomes the final answer.

04Five certifications and what they prove

SARAZIM LLC's founder holds five international security certifications. They are not course certificates bought for a fee. Each is issued by an outside body after either verified work experience or a proctored exam.

In plain terms, CISSP and CISM cannot be earned by passing a test alone. ISC2 requires another certified professional to endorse the applicant's experience, and ISACA counts only experience gained within the ten years before the application. CEH tests knowledge of attack techniques.

OSCP is the practical one. The candidate is placed in a private network of vulnerable machines, has almost a full day to break into them under a proctor, and then has another day to document how. GIAC states that all of its exams are web-based and must be proctored.

Do the certificates remove anything? No. The management credentials mean the person knows how sensitive client data should be handled. The offensive credentials mean the person can read and trace the structures distributors hide behind. Built into a reporting system, that is where the difference in level comes from.

05Client data is part of the job

Hiring a removal service means handing over the material you most want hidden: photos of your face, the addresses where footage sits, your name and contact details, sometimes the whole story. Few providers explain where that goes or when it is deleted. Some ask for the original video.

SARAZIM LLC does not ask for footage. It searches by face recognition from two or three photos, keeps no footage, and records only the metadata and hash values needed for matching. Personal data is permanently destroyed a set period after the work ends. A removal job must not become a new leak.

The same principle runs through StopNCII.org: the hash is created on your own device, only the hash is shared with participating platforms, and the image itself stays with you. A serious provider should be able to explain its own handling just as clearly.

06Manual removal, one form at a time

Manual removal looks like this: search for the address, open the site, find the report button, fill in the form, take a screenshot, attach it, submit, and move to the next URL. Each one takes minutes, and every platform's form is different, so practice does not speed it up much. In our experience 1,000 URLs is about a week of one person's full-time work.

Platforms build their forms for individuals, not volume. X lets a user report up to five posts at once through its intimate media flow. YouTube states that a copyright removal request must be sent for each allegation of infringement, and that a request cannot cover a whole channel or playlist.

Time is not the only cost. A person repeating the same task a thousand times skips a URL, picks the wrong ground, forgets an attachment. Meanwhile the content keeps spreading, and by the time the first thousand are filed, hundreds of new addresses have appeared.

Manual services also struggle to report back. If filing is done by hand, checking is done by hand too, and it is usually the first thing dropped. The client hears that reports were submitted, but there is no list showing which addresses were confirmed removed, which were rejected and why, and which are still live.

07Programmatic removal: 800 to 1,000+ an hour

SARAZIM LLC uses an automated reporting system built by its founder. For malicious posts it can file 800 to 1,000 or more reports per hour, the volume a manual service needs about a week to work through. The work runs in six stages.

1. Find: searches, site crawling and face recognition from two or three photos, because titles change and names are stripped.
2. Filter: drop what is not the client and collapse duplicates by hash. A person makes the final identity check.
3. Sort: group by platform and by the ground that platform accepts: copyright, privacy, intimate imagery, harassment.
4. Draft: generate each report in the platform's own format, with URL, time checked and hash attached.
5. File and track: submit through each platform's procedure and log reference numbers and replies.
6. Confirm and watch: reopen every URL to confirm removal, then keep looking for the same file elsewhere.

Two stages stay with people on purpose. Identity checks and the choice of ground are judgement calls, and getting either wrong wastes a report or worse. Everything that is pure repetition, from filling in fields to reopening URLs, is handled by the system, which is how volume rises without accuracy falling.

In the United States, the TAKE IT DOWN Act requires covered platforms to remove non-consensual intimate images, and known identical copies, within 48 hours of a valid request; the FTC began enforcing it in May 2026. That clock only starts when a valid request is in, which is why filing fast and correctly matters most in the first days after a leak.

08Fast is useless if it is wrong

Some people hear automation and picture the same complaint blasted at every URL. That fails. Reports on the wrong ground are rejected, and reporting someone else's legitimate content is an attempt to remove lawful speech. YouTube warns that misusing its process, for example with false information, can lead to account termination.

So the system is built to file accurately, not loudly. A person verifies identity, the ground is chosen for each platform, and reports go in through each platform's own procedure. Rejections are logged and fed into the next draft. That loop is behind the 98.2% removal rate SARAZIM LLC publishes, across 914+ platforms and an average of 52,142+ removals a month.

09Re-uploads are a job for software

Removal is not the end. Footage that has spread already sits on phones and other servers, and it returns weeks later at a new address. With a manual service, you find out when you stumble on it yourself, by which point it has spread again.

SARAZIM LLC keeps the hash values and face-recognition reference from the first search and checks every monitoring cycle for the same file or the same face appearing somewhere new. People cannot search every day. A program can.

Platforms run their own matching too, and it helps to know its limits. Google says in its explicit image removal help that for sexual imagery removal requests it does its best to find and remove duplicates from Google Search. YouTube's Copyright Match Tool flags full or nearly full re-uploads on other channels, but only for the channel that uploaded first and filed a valid copyright removal request, and it may not surface short clips. StopNCII hashes reach only its participating platforms.

That is why monitoring has to cover more than one platform's own tools. A copy blocked on one service moves to a site that has no matching at all, and only an independent search keyed to the same hash and the same face follows it there. Each cycle's findings go back into the same filing process.

10Five questions to ask a provider

Advertising will not show you the difference. These five questions will, usually within the first call.

1. Who does the work? What is their real background, and which certifications can be checked with the issuer?
2. How do you find copies? Is there anything beyond searching my name?
3. How do you report results? Will I get a URL-by-URL report confirming what came down?
4. What happens when it comes back? Do I have to find it, or do you monitor?
5. When are my photos and files deleted?

Be careful with anyone who repeats guaranteed removal but cannot explain the method. Removal is decided by the platform. An honest provider tells you first what is likely to work and what will be hard.

A provider with real structure answers these without hesitation, and its answers can be checked: a named person, a named method, a sample URL-by-URL report, a monitoring schedule and a deletion date for your data. Vague answers to any of the five tell you more than any advertisement.