Datasheet
See every device. Break nothing. Prove who approved it.
An on-prem appliance for community banks, credit unions, their MSPs and small and mid-size businesses. It reads your switches and firewalls, read-only, flags every device nobody approved, has a person decide about each one, and turns that record into evidence an examiner verifies offline. It works alongside your NAC, RMM, SIEM and GRC tools.
Early access: now taking pilot customers. Built by two engineers, each with more than 20 years in the field, for the gap they kept finding.
Why it is different
- No downtime. It never writes to a switch and never blocks a port. The AS/400, the phones and the printers stay up.
- No rip-and-replace. It reads the switches and firewalls you already own over SNMPv3. No agents, no redesign.
- Sees what scanners miss. The switch knows every device plugged into it, including the ones that ignore probes.
- A name on every decision, signed with an authenticator code. Bulk sign-off handles up to 1,000 at once, and each device keeps its own record.
- Exam prep becomes an export. One signed pack for any date range, which the examiner verifies on their own computer.
- No agents to maintain, nothing phoning home. One program, no database server, no cloud dependency, no telemetry. Never sends your data to an AI service.
Specifications
- Collection
- SNMPv3 GET, GETNEXT and GETBULK on UDP 161, read-only. authPriv, SHA-256 and AES-128 by default. No write path.
- Reads
- BRIDGE-MIB and Q-BRIDGE-MIB MAC tables (Cisco per-VLAN included), IP-MIB ARP and IPv6 neighbors, IF-MIB ports, LLDP and CDP neighbors.
- Poll interval
- 150 seconds per source, by default.
- Program
- One static program, about 22 to 25 MB. Database built in. Nothing else to install.
- Storage
- One local data folder. Secrets sealed with AES-256-GCM.
- Evidence
- Append-only Merkle log with Ed25519-signed checkpoints. Signed ZIP packs (in-toto, DSSE). Offline verifier, seven checks. Published by-hand procedure.
- Sign-in
- Password (15 or more characters, Argon2id) plus an authenticator code. Five roles, including a time-limited Examiner.
- Web interface
- HTTPS, TLS 1.3. Strict Content-Security-Policy. No CDN.
- Outbound
- Only destinations an Admin adds, each with its own filters. Never GigID Labs.
- Frameworks
- Evidence for CIS Controls v8.1 safeguards 1.1, 1.2 and 1.5 (1.3 is not claimed). 1.1 also needs an owner for each approved device; owner editing is in development, so 1.1 shows the gap until then. Crosswalk label for NIST CSF 2.0 and 12 CFR 30 App. B, 364 App. B, 748 App. A. Supports your program; does not replace it.
- Builds
- Reproducible release builds with a CycloneDX SBOM per binary and SHA256SUMS; early-access builds ship with checksums. Go FIPS 140-3 module mode (not a validation).
Runs on what you already have
Runs on what you already have: a Windows or Linux server, a virtual machine on VMware, Hyper-V or Proxmox, a mini PC or laptop, or something as small as a Raspberry Pi. One program, nothing else to install.
Builds: Windows x86-64 and ARM64; Linux x86-64, ARM64 and ARMv7; macOS Apple silicon and Intel.
Integrations built today
Delivery is built; the setup screens are in development, so destinations are added through the appliance’s API today.
- SIEM
- Syslog over TLS (RFC 5424, CEF, LEEF), Splunk HEC, Microsoft Sentinel. Alerts and the full audit stream.
- Chat and ticketing
- Microsoft Teams, Slack. ServiceNow, ConnectWise, Autotask, HaloPSA.
- Paging and NMS
- PagerDuty (trigger and resolve). SNMPv3 informs or traps to your NMS, with the appliance’s MIB.
- Email and webhooks
- Your own relay (STARTTLS). HMAC-signed HTTPS webhooks.
- Filters
- Per destination: vendor, subnet, site, switch, port, VLAN or evidence tier. Destinations and filters are set through the API today; the setup screen is in development.
- Lists to reconcile
- Active Directory, Entra ID, Intune, CrowdStrike, Defender, DHCP, spreadsheets.
- Monitoring
- CSV and NDJSON exports; exit codes any RMM or monitoring tool can check.
What comes next
- Launching soon
- Hosted console for MSPs and multi-site organizations. Marketplace listings.
- In development
- The new web interface, with setup screens for integrations, alert filters, tripwires and the other features that run through the API today.
- Planned
- SSH and vendor-API collection. Single sign-on. Signed offline updates. VM images and installers. TPM-sealed keys. Backup and restore.
Early access: now taking pilot customers.
See it on your network.
Tell us your switch and firewall models through the contact form, and we will set up a demo, then a pilot.