Loading ForensicBlock
Preparing your blockchain forensics platform...
Preparing your blockchain forensics platform...
Every credibility signal on this site maps to a verifiable rail. This page is the index — security posture, methodology, sealed-record contract, sub-processors, and the disclaimers we will not bury.
Active version: v1.7.0. Every sealed report cites its methodology version + SHA-256 content hash. Older reports stay reproducible against the version they were sealed under.
Methodology pageEvery report carries an evidence packet SHA-256 plus the certificate of authenticity hash. Both anchor the report against tampering.
Verify a sealed reportAnyone can verify a sealed report in a browser with no account, no platform login, no payment — opposing counsel, a court clerk, a regulator, a journalist.
Open the verifierTLS 1.3 across every public surface. HSTS preloaded. No mixed content; no third-party trackers on authenticated pages.
AES-256 at the database layer. Customer secrets (API keys, webhook secrets) hashed before storage; we cannot read them back.
Supabase Auth with row-level security on every tenant boundary. Sessions short-lived; service-role keys segregated and rotated.
Primary database in AWS us-east-1; CDN distributed via Vercel. Tenant data does not leave US/EU infrastructure.
Every status change, every finalize, every export anchored to fb_audit_log with hash-chained entry_hash. Tamper-evident across the matter lifecycle.
We are not SOC 2, ISO 27001, or HITRUST certified today. We do not pretend otherwise. The methodology page + verifier + audit log are our receipts in the meantime.
We do not hide the vendor stack. Compliance officers should be able to map every sub-processor to a DPA.
| Sub-processor | Role | Data scope |
|---|---|---|
| Supabase (AWS us-east-1) | Database, Auth, Storage | Customer accounts, investigation rows, sealed evidence, audit log |
| Vercel | Hosting, edge runtime, CDN | Static assets, SSR responses, edge function execution |
| Vercel Blob | Object storage | Generated report PDFs, evidence bundle exports |
| Stripe | Payments + subscription billing | Email, payment tokens, billing metadata |
| Inngest | Job orchestration | Background investigation pipeline state |
| Alchemy / Routescan / Etherscan-v2 | Chain RPCs + explorer APIs | Read-only chain data; no PII |
| OpenSanctions / OFAC / EU consolidated list | Sanctions data feeds | Public sanctions lists; no PII |
Honest status per question. Where we're ready today; where we're building; what we won't pretend.
On the 2026 roadmap
We have not been audited yet. We will not claim SOC 2 we have not earned. In the interim: cryptographic audit chain, RLS isolation, public methodology, sealed reports.
Roadmap (post-SOC 2)
Will follow SOC 2. Same honest stance — we will not market a certification we do not hold.
Available on Enterprise plan
Okta, Azure AD, Google Workspace, and any SAML 2.0 IdP. SCIM provisioning for member sync. Contact us to enable on your workspace.
US (us-east-1) default; EU on request
Primary database in AWS us-east-1. EU residency available for Enterprise customers via region-pinned tenant.
Row-level (RLS) on every table
Every read goes through Postgres RLS scoped to the active org. Service-role keys are segregated and never reach the browser. No silent cross-tenant fetches possible.
Live, cryptographically verifiable
fb_audit_log is hash-chained (prev_hash / entry_hash) per entry. Tamper-evident across the matter lifecycle. The audit chain is independently verifiable.
Daily snapshots; PITR enabled
Point-in-time recovery within the past 7 days; daily encrypted snapshots retained 30 days. RPO ≤ 5 minutes; RTO target ≤ 4 hours.
Available on request
Standard DPA with US/EU SCCs available. Named sub-processor list (above) reflects current vendors; we notify of changes 30 days before.
Annual cadence; report on request
Independent third-party pen test annually. Latest summary report available under NDA. Critical findings get 30-day remediation SLA.
DPA, SOC 2 progress letter, pen-test summary, sub-processor list with SCCs, SSO/SAML configuration sheet, data-residency confirmation. One email, two business days.
For DPAs, security questionnaires, vulnerability disclosures, or sub-processor inquiries, reach out and we'll respond within two business days.