The Aldervane platform
The investigation platform behind every Aldervane finding.
Our investigators work inside a platform we built for one purpose: to make every conclusion traceable, in a few clicks, to a preserved and verifiable source. It is how a team of 160 delivers attributions that hold up under scrutiny.
Six modules
From first signal to finished report, in one system.
Each module handles one part of the work. Together they keep collection, evidence, analysis, screening, verification and reporting connected, so nothing is lost between the analyst who found it and the client who acts on it.
Aldervane Resolve
Entity resolution and link analysis. Resolve merges identifiers that refer to the same person, organization or asset, and shows the evidence behind every link so analysts can test it rather than trust it.
- Usernames, email patterns, avatars and writing features
- Domains, certificates, hosting and shared tracking identifiers
- Companies, officers, filings and beneficial ownership chains
- Wallet clustering and flow-of-funds views on public ledgers
Aldervane Watch
Continuous collection against client-specific requirements. Detectors are tuned by analysts for each program, and every alert is verified by a person before it is escalated.
- Requirement-driven detectors, not generic keyword lists
- Native-language review in 41 working languages
- Critical threats escalated within 60 minutes, 24/7
- Noise suppression that learns from analyst decisions
Aldervane Capture
Forensic capture of web pages, posts, media and records. Each item is preserved with its context, timestamped and hashed at the moment of collection, then logged to a tamper-evident audit trail.
- Full page source, rendered screenshot and media originals
- SHA-256 hash and UTC timestamp at capture
- Collector identity, method and infrastructure recorded
- Exportable evidence bundles for counsel and courts
Aldervane Brief
Finished intelligence reporting. Every key judgment carries a confidence level and links directly to the preserved evidence that supports it, so a reader can check any claim in the report.
- Key judgments with stated confidence and probability
- Source grading for every cited item
- Alternative explanations and why they were rejected
- Annexes structured for regulators, courts and platforms
Aldervane Screen
Identity integrity and vetting at volume. Screen runs the same checks on every subject within an agreed, role-relevant scope, and routes every discrepancy to an analyst before anything is reported.
- Footprint, portfolio and employer consistency checks
- Screening matches resolved to the person, not the name
- Links between applicants: shared referees and contact details
- Adjudication-ready reports, with the subject's response recorded
Aldervane Atlas
A geospatial workspace for events and assets. Atlas plots verified events, imagery and movement data against each client's own sites and routes, so an analyst can see at once what is close enough to matter.
- Client sites, routes and travelers held as a private footprint
- Geolocated events with their verification status and evidence
- Commercial satellite imagery, vessel and aircraft tracks
- Distance and route impact calculated for every verified event
Evidence first
If it is not preserved, it is not reported.
Online evidence disappears. Accounts are deleted, pages are edited and posts are taken down, often the moment a subject suspects attention.
Capture runs underneath every collection activity on the platform. An analyst cannot cite a source in a report unless Capture holds a preserved, hashed copy of it. That single rule is why our findings survive disclosure, cross-examination and regulatory review.
- Hash verification on export and on every later access
- Chain-of-custody record from collection to delivery
- Reproducible: an independent examiner can verify every item
- 14:02:11ZCAPTURE listing page, full source and rendered view
- 14:02:11Z8fbae2c2d1d7761d4ff2156ec4ff043a2a814a63f7fa082b0b5012c300ab36b8
- 14:02:19ZCAPTURE seller profile, 3 images, original resolution
- 14:02:19Zf0d71e6dae4cbfb56aaf4d8d6b5bd1e1e54b088f49c8c80bb1f350c951318f75
- 14:03:02ZCAPTURE archived copy of deleted post
- 14:03:02Zbe33e7c04256879d973ea71328e67a1d9dd9b8f97ddb408af76e7e908863d3d2
- 14:05:40ZNOTE source edited since first capture, both versions retained
- 14:06:15ZEXPORT evidence bundle for counsel, 3 items, hashes re-verified
Monitoring with judgment
Fewer alerts. Every one of them verified.
Most monitoring tools measure success by volume. Watch measures it by how few alerts a client receives that they did not need to see.
Detectors are built from each client's intelligence requirements, then refined weekly by the analysts who review their output. Nothing reaches a client until a person has read it, checked it against context and decided it matters.
Post names the principal's scheduled venue and arrival window. Author has prior threatening posts. Client security lead notified by phone tree.
Sample of client staff credentials offered on a closed forum. Sample matches a 2023 third-party breach, not a new compromise.
Eleven new lookalike domains registered. Two host phishing kits and have been referred for takedown.
Machine assistance
Machines for volume. People for judgment.
An investigation collects far more than analysts can read line by line. Machine assistance sorts, translates and structures that volume, and every output is a pointer to something a person then reads.
- Ranks collected material against the written requirements
- Drafts working translations, replaced by a native speaker for anything cited
- Extracts names and identifiers, each confirmed against its source
- Never attributes, never grades and never writes a key judgment
- Never trained on client data, and logged wherever it is used
Coverage
1,100+ source categories, collected lawfully.
Coverage is organized by source category rather than by named service, because the sources that matter change constantly. What stays constant is the rule: publicly available or lawfully obtained information only.
Security
Built for the sensitivity of the work.
Our clients trust us with questions they cannot ask anyone else. The platform is engineered so that trust is never the only control.
Security controls are reviewed by independent testers every year, and the results are shared with retained clients under confidentiality.
- Compartmented case workspacesAccess is granted per case, on a need-to-know basis, and every action is logged.
- Hardware-key authenticationEvery staff account requires a physical security key. No exceptions.
- Encryption throughoutData is encrypted in transit and at rest, with keys separated by client.
- Managed attributionResearch runs through non-attributable infrastructure, so subjects cannot see who is looking.
- Data residency optionsRetained clients can require that case data stays within a chosen region.
- Automatic deletionCase data is deleted 90 days after closure unless a legal hold applies.
Access
How clients use the platform.
The platform is not sold as self-service software. It is how our investigators work, and clients reach it in the way that suits their program.
Through an investigation
You receive the finished report from Brief and an evidence bundle exported from Capture, with hashes your counsel or examiner can verify independently.
Through a case workspace
Retained and monitoring clients get read access to their own compartmented workspace, with live findings, verified alerts and the evidence behind them.
Through structured delivery
Verified findings can be delivered as structured data to your case management, screening or security systems over an authenticated, encrypted connection.
Start an engagement
Bring us the question nobody else could answer.
Tell us what you need to know and why. A senior investigator will scope it with you, tell you candidly what open sources can and cannot establish, and propose a plan with a fixed fee and a firm timeline.