Chain of custody for digital evidence: a practical guide
NewExplainable UEBA risk scoring

Built for teams trusted with sensitive investigations.

Safrix brings cases, evidence, timelines and risk signals into one auditable system, so investigation teams move with precision, and every action stands up to scrutiny.

SOC 2Type II aligned
99.98%Platform uptime
AUData residency
Case #SFX-2041 Live
72
Composite risk · Elevated
Classified
Vendor_contract_v4.pdfSealed
Access logs · Q2New
Evidence verifiedSHA-256 · chain intact

Illustrative interface

Designed for investigation teams across

Corporate integrityGovernmentFinancial crimeInsuranceLegalLaw enforcement
The platform

Everything an investigation needs, in one record of truth.

From the first intake to the final report, Safrix keeps cases organised, evidence defensible and decisions accountable.

Investigate

Case management

Structured cases with status, owners, priority and deadlines, the backbone of every investigation.

Evidence management

Collect, organise and seal evidence with metadata, hashing and legal holds applied automatically.

Investigation timeline

A chronological record of every event, action and decision across the life of a case.

Chain of custody

Cryptographically verifiable custody from intake to closure, defensible end to end.

Detect & assess

Insider risk detection

Surface concerning behaviour early with signals tuned to your organisation's policy.

UEBA risk scoring

Behavioural analytics weighed into a single, explainable risk score per user and case.

Govern

Audit trails

Immutable logs of every view, edit, export and permission change, ready for disclosure.

Retention policies

Automated, configurable retention and disposal that keeps data lawful by default.

Compliance reporting

Disclosure-ready reports and exports in a few clicks, fully traceable from source to summary.

Role-based access

Granular, least-privilege permissions scoped to case, role and need-to-know.

Collaborate & deploy

Secure collaboration

Notes, assignments and reviews in one place, without sensitive data leaving the platform.

Cloud & on-premise

Deploy in our sovereign cloud or your own environment, with identical security posture.

Inside Safrix

A workspace designed for clarity under pressure.

Purpose-built views for the moments that matter, not a repurposed admin panel.

Case overview

See the whole case at a glance.

Status, owners, risk and outstanding actions in a single view. No hunting across tools, no losing the thread of an investigation.

  • Live status across every active matter
  • Risk and priority surfaced automatically
  • Assignments and SLAs at a glance
Active cases14 open
SFX-2041
Elevated
SFX-2038
On track
SFX-2033
Critical
SFX-2027
Review
Illustrative
Evidence viewer

Evidence that holds up.

Preview documents, exports and media in context, with every view, download and annotation written to an immutable chain of custody.

  • Tamper-evident hashing on every item
  • Inline preview without altering originals
  • Legal holds applied in one action
Vendor_contract_v4.pdfSealed · SHA-256
Page 3 / 12− 100% +⤓ Export
7. Exclusivity & Term
…the Supplier shall not engage any competing party for the duration of the Term.1
PL
P. Lin · 09:41, flagged clause 7.2 for review, possible conflict with SFX-2038.
Illustrative
Risk scoring · UEBA

Signals before incidents.

Behavioural analytics weigh access, anomalies and context into a single risk score, so teams focus attention where it matters, with the reasoning always on record.

  • Explainable, weighted scoring
  • Insider-risk patterns surfaced early
  • Thresholds tuned to your policy
Risk factorsScore 72 / 100
After-hours
Bulk export
Escalation
Peer deviation
Illustrative
The workflow

From intake to closure, one defensible path.

Every investigation follows a consistent, auditable lifecycle, repeatable across teams and matters.

Create case

Step 1

Assign team

Step 2

Collect evidence

Step 3

Collaborate

Step 4

Review findings

Step 5

Generate report

Step 6

Close case

Step 7

Security

Engineered for the most sensitive work.

Security isn't a feature in Safrix, it's the foundation. Least privilege by default, encryption everywhere, and a complete record of who did what.

Encryption in transit and at rest

AES-256 at rest and TLS 1.3 in transit, with envelope-encrypted keys managed in a hardware security module.

Tamper-proof evidence

Cryptographic hashing and an append-only ledger make every evidence item verifiable and impossible to alter unnoticed.

Role-based access & least privilege

Granular permissions scoped to case, role and need-to-know. Access is the exception, not the default.

Complete audit logging

Every view, edit, export and permission change is recorded immutably and ready for review or disclosure.

SSO & enterprise authentication

SAML and OIDC single sign-on, enforced MFA, and provisioning that fits your existing identity stack.

Cloud or on-premise

Deploy in our sovereign cloud or within your own environment, with the same security posture either way.

Compliance

Built to meet Australian standards, and prove it.

Retention policies, data residency and reporting are built in, so compliance is a property of the platform rather than a manual afterthought.

Australian data residencyPrivacy Act 1988 alignedSOC 2 Type II alignedISO 27001 controlsSmart retention policiesDisclosure-ready reportingChain of custodyConfigurable legal holds
Why Safrix

Built to be relied on.

Defensible by design

Every view, edit and transfer is recorded, and every evidence item is verifiable, so your work withstands scrutiny and disclosure.

One source of truth

Cases, evidence, timelines and decisions live in a single auditable record, instead of scattered across drives and inboxes.

Built for sensitive work

Least-privilege access, encryption and Australian data residency are defaults, not add-ons, fit for your most confidential matters.

FAQ

Questions, answered.

Yes. Safrix is built around Australian data residency, least-privilege access and full auditability. It can be deployed in our sovereign cloud or within your own environment to meet the strictest requirements.

Book a demo

See Safrix on your terms.

Tell us about your team and we will arrange a private walkthrough tailored to how your investigations actually run.

Talk to our teamdemo@safrix.com
Response timeWe reply within one business day
Headquartered in AustraliaSovereign data, local support