OBSCURA for small IT and security teams
A small team does a security department’s work without the budget for its platforms. The Sovereign Suite puts several of those jobs on one machine: SOC 2 readiness, finding sensitive data, a certificate inventory, release signing, folder watch and incident playbooks. Nothing is uploaded, so there is no new vendor holding your data to put through review.
The applications a small team works in
The single tools in the kits below each do one job on one file. These four are applications. Each is paid for, on its own or with the rest of Pro, and each keeps its work in the browser on the computer it runs on, so none of them is a new vendor holding your data.
OBSCURA Sovereign Suite
The security services named in the kits below, in one place: SOC 2 readiness, finding sensitive data across a folder, the certificate inventory, release signing, folder watch, incident playbooks and files locked for several keyholders. It is where a small team does the work a security department would buy separate platforms for.
What it records stays in the browser where the work was done. Export what the team needs to keep.
OBSCURA Keep
Your own logins, recovery codes and two-step codes, encrypted with Argon2id and AES-256-GCM, with import from 1Password, Bitwarden, LastPass and the browsers, a health check for weak and reused passwords, and sync only through a folder of your own.
It is one person’s. There is no shared team vault, no browser extension and no admin recovery, so it does not replace a team password manager. Its threat model says what it protects against and what it does not.
OBSCURA Case
For an internal investigation: a mailbox exported as PST or OST and the documents from a share, loaded on the investigator’s machine, hashed and deduplicated, threaded, searched with Boolean and proximity terms and coded, with every load, coding change, redaction and export written to an audit trail chained by SHA-256.
The trail shows the case file was not changed after it was sealed; it is not a signature. One browser holds a case.
OBSCURA Umbra
A folder of scripts and configuration edited where it sits, JavaScript, TypeScript and Python run in a sandbox walled off from the page, and commits made to the folder’s own repository, without the code going to a hosted editor.
There is no terminal and no package install: other languages are edited and searched, not run.
The jobs, and what does each one
The Sovereign Suite is Pro as a whole; its services are marked Pro. Names in capitals are single tools: free to open and to check a file with, and Pro to save the result.
Getting ready for an audit
Most of SOC 2 readiness is knowing which criterion needs which evidence, who owns it and how far it has got.
- Get ready for SOC 2Pro: every criterion an audit tests, in plain words, with the evidence auditors usually ask for, an owner and a status for each, and a readiness report to export
- RISK: a five by five assessment that keeps every earlier version and flags a high residual with nobody’s name on it
- ROPA: the Article 30 record of processing activities
- RETENTION: a retention schedule, and what is already past its date
The SOC 2 service gets a team ready; it certifies nothing. A SOC 2 report comes only from an examination by a licensed CPA firm.
Knowing what is where
Before a share is migrated, a drive handed back or an export sent, somebody should know what is in it.
- Find sensitive dataPro: reads every file in a folder and lists the credentials, card numbers that pass Luhn, IBANs, US Social Security and Canadian Social Insurance numbers, and contact details in each, with a report that shows no value unmasked
- SENTINEL: the scanner behind it, for pasted text, config files and Office documents
- ENVSHIELD: masks keys, tokens and passwords in a .env, YAML, JSON or log before it goes in a ticket
- INTERCEPT: strips cookies, bearer tokens and keys out of a .har file or a curl command
Certificates and keys
Certificates expire on a date everybody knew and nobody watched.
- Certificate inventoryPro: every certificate in a folder, soonest to expire first, with weak keys, forgeable signatures, over-long lifetimes and private keys stored beside them flagged, and a calendar of reminders 30 days before each expiry
- CERTLENS: takes one certificate or a chain apart and checks it
- KEYPRINT: SSH key fingerprints as ssh-keygen prints them, and weak or duplicate keys in authorized_keys
- JOT: decodes a JWT and checks its signature, without sending the token anywhere
The inventory reads what is in the files. It does not ask a CA whether a certificate has been revoked, because that means contacting one.
Proving what you ship and what you hold
A download that cannot be checked, and a folder nobody fingerprinted, are both a matter of trust.
- Sign a releasePro: signs files with an Ed25519 key in minisign’s format, checked before they are offered, with a signed SHA256SUMS
- Watch a folder for changesPro: fingerprints every file in a folder, then shows exactly which were changed, added, removed or moved since
- SIGIL: checks a minisign signature in any browser, with nothing installed
- VOUCH: who signed a Windows .exe or .dll, and whether it has changed since
Read first: how to show a file has not been tampered with.
When something has gone wrong
The first hour goes better with a list and a clock than with a search engine.
- Respond to an incidentPro: playbooks for a bad click, a leaked password, a lost device, a misdirected file and being tracked, each step timed and saved as a record
- Check a file before opening itPro: the real type, anything that runs, and secrets it leaks
- SOVEREIGN CONSOLE: one workbench for a file: identify, hash, entropy, hex, strings and indicators, decode, carve, YARA and a sealed evidence manifest
- INCIDENT: an incident worked through its phases, with the record kept as you go
- BREACH: the reporting clock and the notification when personal data is involved
The playbooks are general guidance for individuals and small teams, and say so; at work, your own incident process comes first.
Mail, logs and the edge
The files a small team is handed most often, read without uploading them to a paste site.
- DMARC: correct SPF, DKIM and DMARC records and a security.txt
- MAILBOX: a saved email taken apart: the delivery path, authentication results and where the links go
- RAMPART: the security headers a server sent, and which are missing or wrong, on staging and intranet pages too
- SENTRY: an SSH or web access log grouped by source, with brute force and enumeration flagged
- WIRE: a pcap read in the tab: conversations, DNS and TLS names, and credentials sent in the clear
- SWEEP: an Nmap scan read, and two scans compared
Read first: reading a pcap without Wireshark and checking who an email is really from.
Secrets that must not be lost
Root keys, recovery codes and the file that needs two people to open it.
- Lock a file for several peoplePro: encrypts a file so it opens only when enough keyholders bring their pieces
- Make a recovery kitPro: where every account and backup is, and who holds which piece
- Send a file securelyPro: files sealed to a passphrase sent another way, or to a public key
- KEYRING: age key pairs, in the real age format
Why it matters that the file stays on the machine
A data discovery tool that uploads the share it scans makes a new copy of exactly the data it was meant to find. Here the files are read in the browser window, and the Sovereign services say on screen what they keep: for folder watch, names, sizes and fingerprints in that browser, never the files.
It also changes what there is to review. OBSCURA is a web page over HTTPS with nothing to install, no agent and no account. You can confirm the no-upload claim with the network tab and the offline test on the verification page, which also hashes the files you were served. The page for teams answers the rest of a vendor review, including what we do not have: no SOC 2 report of our own, no SSO and no audit logs.
What is kept stays in the browser where the work was done. A SOC 2 tracker, a folder baseline or a certificate inventory lives with the person who made it, not in a shared console, so export what the team needs to keep.
A worked example: a first week of readiness
A two-person IT team is asked to be ready for a SOC 2 audit and to tidy up before it. With the Sovereign Suite open:
- Get ready for SOC 2 lists every criterion. Owners are assigned, and the evidence each one needs is noted against it.
- Find sensitive data runs over the shared drive and flags a spreadsheet of card numbers and a config file with a database password. Both are dealt with, and the report, which shows no value unmasked, is filed as evidence.
- Certificate inventory reads the folder of certificates from the servers and shows one expiring in eleven days and one still signed with SHA-1. The renewal reminders go into the team’s calendar.
- Watch a folder for changes takes a baseline of the production configuration folder, to be checked again each week.
- The next release is published with Sign a release, and its public key goes on the website.
What it costs a small team
The Sovereign Suite, with every service on this page, is part of Pro. The single tools are free to open and to check a file with, and Pro to save the result.
- Free, for everyone
- The Workspace: Docs, Sheets, Slides, Notes, Calendar, Tasks, Contacts, Plan, Drive and the PDF editor, at work as well as at home. And every single tool on this page, to open a file and see what it finds, with no account.
- One application, for one person
- US$4 a month or US$35 a year, with 7 days free: the Sovereign Suite, Keep, Case or Umbra on its own, whichever the team works in.
- Pro, for one person
- US$9 a month or US$79 a year, with 7 days free. Every application, and saving the result in every tool outside the Workspace.
- More than one person
- For now each person needs a plan of their own: a key is for one person, on every browser they use. Plans for a team or a business are not offered at the moment. A team that already has one keeps it, and whoever holds its key goes on adding people and taking them off at /seats.
- Not included
- No admin console, single sign-on, audit log or shared team storage: each person’s work stays on their own machine. The page for teams lists the rest, with the answers a security reviewer will ask for.
Checkout is Stripe’s: the card is asked for at the start and not charged until the seven days are over, and if you cancel before then nothing is paid.
Questions
Does the SOC 2 service make us compliant?
No. It tracks readiness criterion by criterion and exports a report for the team or the auditor. Only an examination by a licensed CPA firm produces a SOC 2 report, and the service says so on its own screen.
What does Find sensitive data look for?
Credentials, keys, tokens, passwords and connection strings; card numbers that pass the Luhn check and IBANs that pass mod-97; US Social Security and Canadian Social Insurance numbers; email and public IP addresses. It reads text, code, config, Office documents and PDFs with a text layer, up to 25 MB a file. Other national identifiers, and personal data without a fixed shape, are not in that list.
Is there a central console for the team?
Only for a team that already has a Team or Business plan; those plans are not offered at the moment, and each new person needs a plan of their own. On those plans the seats page gives each person a key of their own, takes it back, and keeps a record of every seat change for an auditor. There is no SSO or SCIM, and each person’s records stay in their own browser: nothing about what anybody does with the tools reaches a server. The page for teams lists what the plans do not include.
Does it work offline?
The Pro code is kept on the device after the first visit, so the Sovereign Suite keeps working with the network off. The single tools keep working once their page has loaded.
Can we check what we are running?
Yes. The verification page hashes the files your browser was served, so your copy can be compared with anybody else’s.
Guides for this work
Questions this work runs into, each answered in full and ending at the tool that does the job.
- How to spot malware beaconing in a connection log: Searching for a fixed interval finds nothing, because every implant since about 2013 adds jitter for exactly that reason.
- How to find generated domains in a DNS log: Scoring each name for randomness gives you ninety alerts a day, almost all wrong, until somebody switches it off, and it never sees the families built from dictionary words.
- How to read a pcap file without Wireshark: What a pcap and a pcapng actually contain, the five questions worth asking of a capture first, and how to answer them in a browser tab (conversations, DNS, the server name in a TLS handshake, credentials in the clear…
- How to see what a device on your network connects to: Every answer tells you how to list the devices on your network; none tells you what they talk to.
- How to tell if a USB drive was plugged into a PC: Windows writes every device install into a plain text file, with the vendor, product and serial number.
- How to check a PDF for malware without uploading it: Every answer to this says upload it to VirusTotal, which shares what you upload.
- What a browser extension can do, before you install it: Every answer tells you to read the box Chrome shows when you click Add. The extension is a zip you can download and read first, and it names the SDKs and the addresses the dialogue never mentions.
- How to check an SSH key fingerprint, and what to compare it with: One command prints it. The part that matters is comparing it with a fingerprint that reached you by another route, what the two SSH warnings are really telling you, and how to audit an authorized_keys file.
The same tools, for other work
This page describes what the tools do. Nothing on it is a certification, an attestation or a statement that using them meets any control framework.