Read-only in.
Written conclusions out.
Coverage installs nothing on a laptop and deploys nothing into your network. Excavate reads the systems your people already work in, keeps the record, and hands back written conclusions.
Connect
You authorize read-only access to the systems you already run. One consent per source, done once, in minutes. No agent, no appliance, and nobody changes how they work.
The sources coverage reads →Preserve
From that moment every relevant event streams into a tamper-evident, append-only record, yours alone and isolated from every other client. We backfill whatever history each source still keeps, and from then on nothing expires until you choose to delete it. For most sources the record holds the content as well as the activity.
Examine
Every trigger opens a review, examined rather than queued. Our rules and yours run against the whole record rather than a single event. Our AI agent works each review and recommends, a person decides, and each closes with a written cause on your record, where you can audit it.
Escalate
Our agent prepares each review and recommends. Only an experienced forensic examiner can escalate a review into a case or conclude anything against a person. On a case, your IT collects the laptop with our tool.
Conclude
What reaches you is a conclusion: what happened, what the evidence is, who signed it, and what we suggest you do. If nothing happened, that is delivered in writing too.
What we read,
and what we never do.
Coverage reads activity, not people. The boundary is written down because your works council will ask where it sits.
- Who signed in, from where, and on what
- Files moved, downloaded, shared outside the company
- Repositories cloned and access that changed
- Mail rules created and messages forwarded out
- What left a laptop, when it is collected on a case
- Message and document content, opened when a review or a case needs it
- No keystroke logging
- No screen recording or webcam
- No scoring or ranking of people
- No content read for its own sake: it is opened for a stated purpose, and that access is logged
Access follows a stated purpose and is logged against it, including your own team’s. Every review and case, cleared ones included, is logged and visible to your authorized users.
Nothing expires: the record stays until you choose to delete it. Legal holds are honored until released, and privileged matters are retained through your counsel rather than by us.
Experienced forensic examiners, named on every conclusion they sign. Not a shared queue.
Bring the systems you run.
Tell us what you have connected today and we will tell you what coverage would have shown.
See the portal it produces →