Read-only in.
Written conclusions out.
Nothing is installed on a laptop and nothing is deployed into your network. Excavate reads the systems your people already work in, keeps the record, and hands back verdicts.
Connect
You authorise read-only access to the systems you already run. One consent per source, done once, in minutes. No agent, no appliance, and nobody changes how they work.
The sources coverage reads →Preserve
From that moment every relevant event streams into a record that cannot be edited or deleted, yours alone and separated cryptographically from every other client. Where a source keeps history we backfill it, so the record starts before you did.
Examine
Every trigger is examined, not queued. Our rules and yours run against the whole record rather than a single event, and each one closes with a written cause. Most close silently and you never hear about them.
Escalate
The few that cannot close by themselves go to a certified examiner, who works the record and decides whether it is nothing, a review, or a case. A person makes that call, not a confidence score.
Conclude
What reaches you is a conclusion: what happened, what the evidence is, who signed it, and what we suggest you do. If nothing happened, that is delivered in writing too.
What we read,
and what we never do.
Coverage reads activity, not people. The boundary is written down because your works council will ask where it sits.
- Who signed in, from where, and on what
- Files moved, downloaded, shared outside the company
- Repositories cloned and access that changed
- Mail rules created and messages forwarded out
- What left on a device, and when
- Message and document contents, when a review or a case needs them
- No keystroke logging
- No screen recording or webcam
- No scoring or ranking of people
- No content read for its own sake: it is opened for a stated purpose, and that access is logged
Access follows a stated purpose and is logged against it, including your own team’s. A person cleared by a review is indistinguishable in the record from one never reviewed.
Retention runs to your policy. Legal holds are honoured until released, and privileged matters are retained through your counsel rather than by us.
Certified forensic examiners, named on every conclusion they sign. Not a shared queue and not an offshore triage desk.
Bring the systems you run.
Tell us what you have connected today and we will tell you what coverage would have caught.
See the portal it produces →