How it works
How SleuthX works
SleuthX is one connected workflow, not a pile of tools. Here's how a matter travels from a first, anxious question to a documented answer you can act on.
1. Confidential intake
Every matter starts as a project. You describe what happened in plain language — a hacked account, a phone that feels watched, a payment that vanished — and SleuthX scopes the question so the rest of the workflow is pointed at the right thing.
2. Evidence ingest
You bring in the relevant evidence — an account export, a phone extraction, a document, an on-chain address. Each item is hashed as it lands and stored in the case vault, starting a documented chain of custody before any analysis begins.
3. AI forensic triage
The SleuthX agent runs the structured checks a forensic analyst would — across accounts, devices, and on-chain data — and assembles a plain-language first read in minutes, with its reasoning shown rather than hidden behind a verdict.
4. Organize on the board
Open questions become cards on the investigation board: what's checked, what's in progress, what still needs a human. A multi-step matter stays organized, and anyone picking it up can see exactly where it stands.
5. Connect and pivot
Link analysis turns the identifiers in the case into a connection graph. You pivot from a number to the accounts that used it, an address to the wallets it touched, a handle to the personas behind it — and the money, where it's a financial matter, is traced across hops.
6. Analyst review
A human forensic analyst reviews the findings before they're treated as conclusions, so speed never replaces judgment. Where a matter needs regulated investigative work, SleuthX coordinates it with individually-licensed Florida private investigators in our network, who work under their own licenses.
7. Report and exhibits
The work becomes a clear narrative report and numbered exhibits, each tied back to a preserved, hash-verified vault item — output an attorney can file, an insurer can act on, or you can simply keep as a defensible record.
8. Ongoing Protections
Closing a case doesn't close the exposure behind it. Protections keeps watching for new breach and credential leaks tied to your identifiers, and a flagged signal flows straight back into a new triage — so the workflow comes full circle.
More capabilities
AI forensic triage
An evidence-grade first read in minutes — then analyst-reviewed.
Link analysis
Connect the identifiers in a case and pivot between them.
Evidence vault
Hash on ingest. A documented chain of custody, end to end.
Reports & exhibits
A clear narrative report and numbered, court-ready exhibits.
Protections
Keep watch after the case is closed — exposure and threats, monitored.















