How it works

How SleuthX works

SleuthX is one connected workflow, not a pile of tools. Here's how a matter travels from a first, anxious question to a documented answer you can act on.

1. Confidential intake

Every matter starts as a project. You describe what happened in plain language, whether a hacked account, a phone that feels watched or a payment that vanished, and SleuthX scopes the question so the rest of the workflow is pointed at the right thing.

2. Evidence ingest

You bring in the relevant evidence: an account export, a phone extraction, a document, an on-chain address. Each item is hashed as it lands and stored in the case vault, starting a documented chain of custody before any analysis begins.

3. AI forensic triage

The SleuthX agent runs the structured checks a forensic analyst would, across accounts, devices, and on-chain data, and assembles a plain-language first read, with its reasoning shown rather than hidden behind a verdict.

4. Organize on the board

Open questions become cards on the investigation board: what's checked, what's in progress, what still needs a human. A multi-step matter stays organized, and anyone picking it up can see exactly where it stands.

5. Connect and pivot

Link analysis turns the identifiers in the case into a connection graph. You pivot from a number to the accounts that used it, an address to the wallets it touched, a handle to the personas behind it. The money, where it's a financial matter, is traced across hops.

6. Analyst review

A human forensic analyst reviews the findings before they're treated as conclusions, so speed never replaces judgment. Where a matter needs regulated investigative work, SleuthX coordinates it with individually-licensed Florida private investigators in our network, who work under their own licenses.

7. Report and exhibits

The work becomes a clear narrative report and numbered exhibits, each tied back to a preserved, hash-verified vault item. It is output an attorney can file, an insurer can act on, or you can simply keep as a defensible record.

8. Ongoing Protections

Closing a case doesn't close the exposure behind it. Protections keeps watching for new breach and credential leaks tied to your identifiers, and a flagged signal flows straight back into a new triage, so the workflow comes full circle.

Transparent pricing

What do you need?
How many devices need examining?

Cloud accounts linked to your devices, like iCloud or Google, are included in every package and don't count as extra devices.

  • Single-device package, 6.25 examiner hours, cloud accounts included
  • Opens your case forms, including a chain of custody form. Nothing is charged unless you sign.
  • Have cyber insurance? Your policy may cover a forensic exam. You own the report, so you can send it to your carrier.

Live consultation Call (239) 241-8095

Enterprise

$200/seat/mo plus $5/device/mo

Team tier, with frontier reasoning, analyst escalation, and team billing.

See enterprise →

Trusted by partners across the practice

DAS Health
Exhibit A Cyber
Ally Security
KIRO Group
Black Mirage
Kalles Group
Gridware
CQR
Archstone Security
Cyvergence
Sentinel Cyber
Cloud Underground
Seron Security
Hexen
Koru Risk Management
DAS Health
Exhibit A Cyber
Ally Security
KIRO Group
Black Mirage
Kalles Group
Gridware
CQR
Archstone Security
Cyvergence
Sentinel Cyber
Cloud Underground
Seron Security
Hexen
Koru Risk Management