Chargement...
Native collection on Linux and Windows. macOS: roadmap. Continuous visibility, controlled execution - only authorized actions run.
The Challenge
Without connectivity, detection and response stop. Remote sites are blind.
Learn moreActions requiring a cloud round-trip introduce latency and a single point of failure.
Learn moreEndpoint data must leave the site for analysis, violating data sovereignty requirements.
Learn moreSecurity operations need to continue everywhere - not just where the cloud reaches.
Detection and automation capabilities run locally. Decision authority remains centralized. The endpoint never decides alone.
Detection engines run locally on the endpoint. Behavioral analysis, signature matching, and correlation happen where the data is.
Context and evidence are collected locally. Full traceability preserved even offline.
Pre-approved playbooks execute locally. New decisions require connectivity to the governed decision layer.
When connectivity returns, evidence is synchronized to the evidence chain.
Local observation. Central governance. Evidence chain continuity.
Deployment
A lightweight runtime runs on Linux and Windows - remote sites, industrial networks, or isolated environments.
Storage
All detection findings and evidence are stored locally with cryptographic hashes.
Resilience
Pre-approved playbooks execute during connectivity loss. No new decisions without the governed decision layer.
Continuity
Evidence syncs automatically when connectivity returns. Evidence chain continuity is verified.
End-to-end evidence chain continuity - online or offline.
The endpoint never holds decision authority. It executes pre-approved playbooks and local detection during connectivity loss. All new decisions require connectivity. When the endpoint reconnects, evidence is synchronized with the ProofChain and its continuity is checked - even in degraded mode, governed actions remain controlled and verifiable.
Presence on the ground, governance at the center.
Lightweight, offline-capable runtime for endpoints and remote environments.
Core detection engines run locally. Behavioral, signature, and IOC analysis.
Pre-approved playbooks execute during connectivity loss. No external component holds decision authority.
Evidence and findings sync with integrity verification. Evidence chain continuity is checked.
Built for intermittent connectivity. Operations continue during network outages.
Planned: centralized management, policy distribution, and health monitoring across endpoint instances.
Evidence cycle
From context to outcome, each stage is connected only through the records that are actually available. Observation, execution, and effect are kept distinct.
Signals and assets associated with the situation
Applicable policy and authorization context
Operational record associated with the authorized action
Execution and observed effect distinguished
The endpoint observes and executes authorized actions. It never decides.
Security operations continue during network outages, maintenance, or isolated-environment requirements.
Evidence stays local until secure sync. No forced cloud dependency.
The endpoint executes without ever acquiring decision authority. Human oversight maintained.
Planned: centrally manage endpoint instances with policy distribution and health monitoring.
Start with a personal account or talk to our team about your deployment requirements.
