Tools

What the software has to do.

We build for one team and one problem at a time. What follows is what the tools do rather than what they are called. Ownership, licensing and exclusivity are set by contract, not implied here. For each: what it does, what it identifies, how it mitigates, and who it is for.

01

Awareness

See what is watching, and what is leaking

Device and network visibility

What an endpoint is actually talking to, attributed to the app that opened the connection and resolved to a place without asking the internet for help.

Identifies
An app sending your location or data somewhere it should not — including a hostile country.
Mitigates
Allow or block by address, by application or by country, both directions; a flow-by-flow record you can export.
For
Executives · principals · field officers
Proximity and tag detection

The work is not seeing one cheap tracking tag; it is telling the tag that belongs there from the tag that keeps reappearing.

Identifies
Repeat presence judged across time and distance, not a single hit, against a register of what is expected.
Mitigates
The alert goes to the person being followed, not to a console — in time to act and preserve it.
For
Principals · protectees · field officers
Detection that runs on the device

Classification performed on the endpoint, so the decision does not wait on a link and nothing has to leave the device to make it.

Identifies
A threat — a face, a plate, a pattern — recognised in the hand, with stated, testable thresholds.
Mitigates
Alerting gated by the classifier, so the operator is never trained to ignore it.
For
Field and protection teams
02

Coordination

One picture, over links you control

A shared picture without infrastructure

Position and status across a team, carried over links the team itself controls, with what each member sees governed by their role.

Identifies
Where the team is and who is out of place, with no carrier account, cloud or third-party map service.
Mitigates
Role-scoped visibility; degrades to local links rather than going dark.
For
Teams · protection details
Duress and distress signalling

A way to say something is wrong that does not look like saying it, and that holds the message until there is a path to send it.

Identifies
An operator in trouble, signalled in a way that resembles ordinary use of the device.
Mitigates
Queued until delivery is possible, and separately routed from normal traffic.
For
Officers · principals · protection details
03

Evidence

Records that hold, training that improves

Records that can be shown to be unaltered

Signed baselines and hash-chained logs let a product of the field be shown to be the product of the field.

Identifies
Whether a record is genuine or has been quietly changed after capture.
Mitigates
Signed at capture, verified by anyone holding the public key; verification fails loudly, with a reason.
For
Investigators · trainers
Exercise control and after-action

Running a scenario, scoring it while it runs, and producing something at the end that survives a debrief and compares against the next run.

Identifies
What a team actually did versus what it should have — scored live, not from memory.
Mitigates
An after-action product that names what changed and what did not, from a baseline kept for the re-test.
For
Trainers · units
04

Fleet and delivery

Issue and reset, off the grid

Provisioning, policy and sanitisation

Bringing devices to a known state, holding them there, and returning them to a clean one on command, without a management service on the internet.

Identifies
A device carrying more than it should, or drifting from its safe state.
Mitigates
Provisioning and policy applied offline; sanitisation verified rather than assumed.
For
Security managers · programs
Build delivery on closed networks

Getting software onto devices that are not allowed to reach a store, without loosening the reason they are not allowed to.

Mitigates
Enrolment by physical presence; pinned trust; delivery over a local link, or none at all.
For
Closed and air-gapped programs