Built to the standard
of the evidence it holds.
We hold forensic evidence about people who never asked to be covered. This is how it is protected, in plain terms.
How the evidence
is protected.
Four things hold everything else up. Where one is still in progress, it says so.
Hosted on AWS in the US, in a private, hardened environment. Images are scanned on build, workloads run with the least access they need, and nothing is reachable from the public internet that does not have to be. EU hosting is available on request.
Encrypted at rest and in transit, and isolated per client so you only ever see your own record. Backups run with point-in-time recovery.
Multi-factor authentication for everyone, role-based and least-privilege. Credentials are short-lived and every access to a record is logged against a purpose, including our own examiners’. A review your team requests is logged with its stated purpose too.
Every trigger opens a review. Our AI agent works it and recommends, a person decides, and each one closes with its cause in your record. The agent is tested against malicious data and activity, and text planted in an employee’s files cannot close a review, because a person decides every one. It runs on the OpenAI and Anthropic APIs and never trains on your data. Only an examiner can escalate or conclude anything against a person.
Who else touches
your data.
The companies that process customer data on our behalf, and what for. Questions about personal data go to privacy@excavate.ai.
Runs the record, the portal and the pipeline, in the US.
Models behind our AI agent, called through the API. Data sent through the API is not used for training.
Models behind our AI agent, called through the API. Data sent through the API is not used for training.
Chain of custody,
end to end.
A conclusion that cannot be shown to counsel, a works council or a court is not a conclusion. Every step exists so that it can be.
Events arrive through read-only connectors, and laptop collections by upload on a case, each hashed and attributed to its source on the way in.
Stored append-only and tamper-evident, so any change would show. Every later access is recorded against the record it touched.
Our AI agent and our examiners work each trigger together and write its cause. Only an experienced forensic examiner can escalate or conclude anything against a person.
A written conclusion carrying its findings, the evidence behind each one, and the name of the examiner who signed it.
Nothing expires: it stays until you choose to delete it. Legal holds are honored until released.
Send us your questionnaire.
Security documentation, questionnaires and disclosure go to security@excavate.ai and reach a person, not a queue.
How it works, end to end →