NewExplainable UEBA risk scoring

Built for teams trusted with sensitive investigations.

Safrix brings cases, evidence, timelines and risk signals into one auditable system, so investigation teams move with precision, and every action stands up to scrutiny.

SOC 2Type II aligned
99.98%Platform uptime
AUData residency
Evidence verifiedSHA-256 · chain intact
Case #SFX-2041 · Procurement review
Live
Evidence ledger
Vendor_contract_v4.pdfSealed
Email export · 1,204 itemsHold
Access logs · Q2New
Investigation timeline
09:14 AEST
Evidence sealed by chain of custody
11:02 AEST
Risk threshold crossed, flagged
14:37 AEST
Findings shared with reviewer
Composite risk score
0Elevated
⬤ Classified · Restricted
Assigned investigators
DKPLMT+3
Case completion

Designed for investigation teams across

Corporate integrityGovernmentFinancial crimeInsuranceLegalLaw enforcement
The platform

Everything an investigation needs, in one record of truth.

From the first intake to the final report, Safrix keeps cases organised, evidence defensible and decisions accountable.

Investigate
Case management
Evidence management
Investigation timeline
Chain of custody
Detect & assess
Insider risk detection
UEBA risk scoring
Govern
Audit trails
Retention policies
Compliance reporting
Role-based access
Collaborate & deploy
Secure collaboration
Cloud & on-premise
Safrix Investigations•••
Cases / Case management
Search cases…Open · 14
CaseInvestigatorPriorityStatusUpdated
SFX-2041DKD. KowalskiHighElevated2h ago
SFX-2038PLP. LinMedOn track5h ago
SFX-2033MTM. TanHighCritical1d ago
SFX-2027RHR. HartleyLowIn review2d ago
SFX-2019SOS. OkaforMedClosed4d ago
Operational#SFX-2041

Structured cases with status, owners, priority and deadlines, the backbone of every investigation.

Inside Safrix

A workspace designed for clarity under pressure.

Purpose-built views for the moments that matter, not a repurposed admin panel.

Case overview

See the whole case at a glance.

Status, owners, risk and outstanding actions in a single view. No hunting across tools, no losing the thread of an investigation.

  • Live status across every active matter
  • Risk and priority surfaced automatically
  • Assignments and SLAs at a glance
Active cases14 open
SFX-2041
Elevated
SFX-2038
On track
SFX-2033
Critical
SFX-2027
Review
Evidence viewer

Evidence that holds up.

Preview documents, exports and media in context, with every view, download and annotation written to an immutable chain of custody.

  • Tamper-evident hashing on every item
  • Inline preview without altering originals
  • Legal holds applied in one action
Vendor_contract_v4.pdfSealed · SHA-256
Page 3 / 12− 100% +⤓ Export
7. Exclusivity & Term
…the Supplier shall not engage any competing party for the duration of the Term.1
PL
P. Lin · 09:41, flagged clause 7.2 for review, possible conflict with SFX-2038.
Risk scoring · UEBA

Signals before incidents.

Behavioural analytics weigh access, anomalies and context into a single risk score, so teams focus attention where it matters, with the reasoning always on record.

  • Explainable, weighted scoring
  • Insider-risk patterns surfaced early
  • Thresholds tuned to your policy
Risk factorsScore 72 / 100
After-hours
Bulk export
Escalation
Peer deviation
The workflow

From intake to closure, one defensible path.

Every investigation follows a consistent, auditable lifecycle, repeatable across teams and matters.

Create case

Step 1

Assign team

Step 2

Collect evidence

Step 3

Collaborate

Step 4

Review findings

Step 5

Generate report

Step 6

Close case

Step 7

Security

Engineered for the most sensitive work.

Security isn't a feature in Safrix, it's the foundation. Least privilege by default, encryption everywhere, and a complete record of who did what.

Encryption in transit and at rest

AES-256 at rest and TLS 1.3 in transit, with envelope-encrypted keys managed in a hardware security module.

Tamper-proof evidence

Cryptographic hashing and an append-only ledger make every evidence item verifiable and impossible to alter unnoticed.

Role-based access & least privilege

Granular permissions scoped to case, role and need-to-know. Access is the exception, not the default.

Complete audit logging

Every view, edit, export and permission change is recorded immutably and ready for review or disclosure.

SSO & enterprise authentication

SAML and OIDC single sign-on, enforced MFA, and provisioning that fits your existing identity stack.

Cloud or on-premise

Deploy in our sovereign cloud or within your own environment, with the same security posture either way.

Compliance

Built to meet Australian standards, and prove it.

Retention policies, data residency and reporting are built in, so compliance is a property of the platform rather than a manual afterthought.

Australian data residencyPrivacy Act 1988 alignedSOC 2 Type II alignedISO 27001 controlsSmart retention policiesDisclosure-ready reportingChain of custodyConfigurable legal holds
Why Safrix

Built to be relied on.

Defensible by design

Every view, edit and transfer is recorded, and every evidence item is verifiable, so your work withstands scrutiny and disclosure.

One source of truth

Cases, evidence, timelines and decisions live in a single auditable record, instead of scattered across drives and inboxes.

Built for sensitive work

Least-privilege access, encryption and Australian data residency are defaults, not add-ons, fit for your most confidential matters.

FAQ

Questions, answered.

Yes. Safrix is built around Australian data residency, least-privilege access and full auditability. It can be deployed in our sovereign cloud or within your own environment to meet the strictest requirements.

Book a demo

See Safrix on your terms.

Tell us about your team and we will arrange a private walkthrough tailored to how your investigations actually run.

Talk to our teamdemo@safrix.com
Response timeWe reply within one business day
Headquartered in AustraliaSovereign data, local support