OBSCURA Sovereign Suite

A small company’s security programme, kept on your own machine.

This browser’s Pro key was not accepted: the subscription behind it has ended. Renew or subscribe below.

The Sovereign Suite onlyUS$35 a year, 7 days free EverythingUS$79 a year, 7 days free Sign in

7 days free, then charged unless you cancel. Refunded in full within 14 days.

The Sovereign Suite in the light theme, on Frameworks and controls: SOC 2 and ISO 27001 ticked as in scope, with the readiness panel counting the controls in place, and the services listed down the left

The same Frameworks and controls screen in the dark theme

Twenty frameworks, and your own
Evidence and reports
Vendors, and risk in money
Access reviews
Incidents and secrets
Checks on the code you ship

The suite at work

Taken from the suite itself, on invented records and files.

An access review, then SOC 2. A staff list is chosen and a Google Workspace user list is dropped into Review who has access. It flags an account still enabled for someone who has left, a mailbox that belongs to no one on the staff list, a dormant account and two without two-step sign-in, and the leaver’s account is marked to be removed. Then SOC 2 in Frameworks and controls, opened at CC6.2, which the review is evidence for. Recorded in the suite itself; every name is invented, and there is no sound.

Check cloud and container config on invented files: 24 findings to fix first from 11 files, 6 critical, 18 high, 20 medium and 10 low, listed by file and then by finding, worst first — Config, before it ships. Terraform, Kubernetes, Dockerfiles, Compose, CI pipelines, IAM policies and web server files, read in the window and checked against 111 rules, worst first, each with its line and the fix.

The same configuration check in the dark theme — Config, before it ships. Terraform, Kubernetes, Dockerfiles, Compose, CI pipelines, IAM policies and web server files, read in the window and checked against 111 rules, worst first, each with its line and the fix.

The incident register with an invented incident: an invoice fraud through a finance mailbox, contained, severity 1, with 46 hours left on the UK GDPR's reporting clock — An incident, run from a playbook. Roles, severity, each step from containment to recovery, the reporting clocks it has started, the notices, and the review afterwards, kept as the record auditors and insurers ask for.

The same incident register in the dark theme — An incident, run from a playbook. Roles, severity, each step from containment to recovery, the reporting clocks it has started, the notices, and the review afterwards, kept as the record auditors and insurers ask for.

Everything it does

SOC 2 and ISO 27001 readiness, vendors, risk, access reviews and incidents in one window, kept in your browser and your own files. Fifty-five security services from one set of controls and evidence, and checks on the code and configuration you ship. The registers are never on a vendor’s server.

Before you start: It keeps the records an audit needs and certifies nothing: an auditor, or the body that runs the scheme, does that. What else it does not do

All 55 services

A service is a job done by several tools one after another, each handing its result to the next. Nothing has a format of its own: what a service writes opens in the tools it was built from, so you are never locked in.

Frameworks, policies and people

Frameworks and controls Readiness for twenty frameworks, NIST 800-53, SOX IT general controls, the EU AI Act and the Essential Eight among them, and for frameworks of your own brought in from a spreadsheet, from one set of controls with owners, evidence, tests and due dates; SOC 2 Type II period coverage, a crosswalk between any two, and what an auditor needs exported
Policy library Eighteen plain-English policy templates to adopt, edit, approve by version and publish for staff to acknowledge
Connect your systems GitHub, GitLab, Microsoft 365, Google Workspace and Okta read from your browser, read-only: two-step sign-in, administrators, dormant accounts and guests, and branch protection and secret scanning, each read kept as dated evidence and read again when it falls due
Review who has access The user lists your systems export matched to your staff list: leavers, dormant and privileged accounts flagged, and the review signed off
Staff security records Policies acknowledged, training done, and joining and leaving checklists, for each person, the staff list taken from BambooHR, Rippling, HiBob, Personio, Gusto or Workday
Security awareness training Short modules with questions and a phishing recognition exercise, sent to staff as one file that works on its own

Evidence and reports

Kept results What any tool found or made, kept as evidence, raised as a finding or attached to an incident, each with its SHA-256 in a hash-chained record
Evidence locker Evidence with its SHA-256, who collected it and when, the controls it supports and when it runs out; the auditor’s requests; a signed audit pack
Test exported settings What AWS, Google Cloud, Azure, Entra ID, GitHub, Google Workspace, Okta and your device management export, tested against 37 checks, each file kept as evidence and each failure made a task; parsers of your own for other exports, run with no network
Answer a security questionnaire A customer’s spreadsheet read, each answer drafted from your approved answers, and the same file sent back filled in
Publish a trust page A static security page written from what the registers already say, hosted wherever you like
Board report The quarter in a page or two: readiness and its trend, open findings, overdue reviews, incidents, top risks and the decisions needed
What is due Everything the registers say is due, in one list by owner and date: reviews, renewals, tests and your own tasks, saved to your calendar as a file
Compliance calendar The recurring checks, from quarterly access reviews to the annual penetration test, each recorded with its evidence
Exchange registers with your team Registers encrypted to colleagues’ age keys, and every change a returned file would make shown for you to accept or reject

Vendors, risk and data

Vendor register Every supplier that holds your data, its assurance reports and agreements, and when each is due a review
Risk register Likelihood and impact before and after treatment, risk in money from FAIR’s ranges with a loss exceedance curve, the controls each risk relies on, and policy exceptions with their approvals
Asset inventory Devices, servers, SaaS and data stores with owners, and each laptop’s encryption, firewall and screen lock checked from your MDM export
GDPR accountability Processing activities and their lawful basis, DPIAs, subject requests against their deadlines, and breaches
Continuity and recovery Recovery time and point objectives per system, the recovery plan, and each restore test recorded
Find sensitive data Every file in a folder read, and the credentials, card numbers, ID numbers and personal data in each listed
Certificate inventory Every certificate with its expiry, key and signature, certbot renewal checked, and reminders exported

Building software

Check cloud and container config Terraform, Kubernetes, Docker, CI, IAM, CloudFormation and web servers checked, against your own rules as well
Find secrets in a repository Credentials in the tracked files and the whole git history, by commit and file, with the value masked
Dependencies and SBOM Lockfiles into a software bill of materials, every licence, third-party notices, and known vulnerabilities if you choose
Container image SBOM A saved Docker or OCI image read layer by layer, its packages written as CycloneDX
Track vulnerabilities Scanner and penetration test findings scored with CVSS, known-exploited ones marked, the few to fix first from what each asset holds and the alerts on it, each owned and dated, with VEX for customers
Sign a release Files signed with Ed25519 in minisign’s format, with a signed SHA256SUMS
Release record One pass or fail record per release: its SBOM, open vulnerabilities, VEX and signature

Incidents and monitoring

Incident register An incident run from a playbook, with its reporting clocks counted from when you became aware, notice drafts and review
Tabletop exercises Ransomware, email compromise or a leaked cloud key, with timed injects and an after-action report
Respond to an incident Step-by-step playbooks for a bad click, a leaked password, a stolen device or a misdirected file
Triage audit logs CloudTrail, Okta, Microsoft 365, Google Workspace and GitHub logs, and Defender, Falcon and SentinelOne alerts: root sign-ins, MFA turned off, new admins, mass downloads, credential theft, threats not stopped
Investigate an indicator One address, host, account, hash, domain or CVE followed through every register, and what already links a finding to another register
Runbooks Your own sequences of steps with approvals between them, every step in the activity log
Watch a folder for changes Every file fingerprinted, and later exactly what changed, with the signs of ransomware called out
Check this browser’s privacy What any website can read from this browser, and the settings that fix it
Reports from the Console Case reports sent from the Sovereign Console, each filed in the evidence locker with its hash and signature

Secrets and backups

Secrets register Every API key and service account by owner, where it is used, who knows it and when it was rotated, never the value
Break-glass accounts Emergency credentials split so it takes two of three named custodians, with each quarterly test recorded
Password health Weak, reused, old and breached passwords in the KEYS vault, and accounts with no second factor
Share passwords with a team Chosen entries encrypted to each person’s age key, and what to rotate when someone leaves
Environment files Each project’s .env files, sealed here and sent encrypted to each person’s age key
Switch password manager A 1Password, Bitwarden, LastPass or Keeper export brought into KEYS and the plain export deleted
Back up passwords and codes One encrypted backup of KEYS and TOKEN, put back on any browser
Protect and recover a secret A secret split into pieces, each hidden in its own picture, and rebuilt from enough of them (two services)
Paper backup A secret split onto printed cards, each with a QR code
Make a recovery kit How to get every account back, and who holds which piece, printed or sealed

Files in and out

Send a file securely Sealed with a passphrase you send another way, or to a person’s public key
Lock a file for several people It opens only when enough keyholders bring their pieces; Unlock a shared file does that
Clean files before sharing Location, names, comments and history taken out of photos, documents and PDFs in one go
Check a file before opening it Its real type, anything in it that runs, and secrets it leaks
Open a Cryptomator vault A vault opened with its password, its files taken out and new ones put in where it is, or a new vault made that Cryptomator opens

What it is not

It does not watch your accounts. There are no agents and nothing runs while the suite is closed. The connectors read GitHub, GitLab, Microsoft 365, Google Workspace and Okta only when you press the button or a read falls due while it is open, from your browser to your provider (what each reads, and what you set up); everything else works from files your systems export, such as audit logs, lockfiles, Terraform and device management exports. Nothing about your company is held on our side.
It certifies nothing. It keeps the records a review needs; an auditor, or the body that runs each scheme, is who certifies.
The registers are yours to keep. They live in this browser until you clear it, and in the files you save. A team shares them by exchanging encrypted files, not through a shared database.
One thing asks a server, and only when you choose. Checking dependency versions against known vulnerabilities sends package names and versions, not your code, through this site to OSV.dev.
Deadlines are a reading of the law. The reporting clocks an incident starts are our reading of each law; whether one applies, and when it began, is for your counsel to confirm.
No single sign-on. There is no SSO or SCIM. A team or business that already has a Team or Business plan gives each person a key of their own on the seats page.

The Sovereign Console, one window for looking hard at a single file, is free, and so is checking a file with any of the single tools below. Buying for a team? OBSCURA for teams answers what a security reviewer will ask.

The single tools, free to check a file with

Each of these opens on its own page, with no account, and shows you what it finds. Saving the result is part of Pro.

Pro Get ProGet Pro OBSCURA OS home

On-deviceNo accountNothing uploaded

Sovereign Suite

The tools for files you would rather not hand to a website. Open a file and Sovereign lists the tools that can work on it; every one runs in this window, and nothing is uploaded.

Open a file

Drop it anywhere in this window, or choose it. It is read here, fingerprinted, and matched to every tool that can open it.

Recent

Pinned

All 122 Sovereign tools

Sixteen groups, by what you are working on.

Free · works offline · nothing uploaded Sovereign Console One program for looking hard at a file: identify, hash, entropy, hex, strings and indicators, decode and break, carve, YARA, encrypt, and a sealed evidence manifest. Every reading in one place, none of it leaving the tab. Open the Console →

Photos and images10 tools

CLOAKStrip metadata from a photo EXIFSee the GPS and camera data inside a photo VEILBlur faces and plates out of a photo BASTIONArmor an ID scan before you send it SCREENSHIELDBlack out the private parts of a screenshot TAMPERLook for signs a photo was edited SHRINKResize, convert and compress images IMAGEDIFFSee what changed between two images CONTRASTCheck colour contrast and find the nearest passing colour DOTSFind, read and remove a printer's hidden tracking dots

PDFs9 tools

SEALRedact a PDF so it stays redacted PACTSign a PDF and keep a record that holds up FORMAUDITSee what a PDF runs and collects STAPLEMerge, split, reorder and number PDFs FLATTENBurn a filled-in form into the page so it cannot be changed WATERMARKStamp a visible watermark across every page PADLOCKPut a password on a PDF, or take one off, on this device PRESSMake a PDF smaller without sending it anywhere STRATADig out every earlier version saved inside a PDF and see what changed

Documents and spreadsheets16 tools

REDLINESee what changed in a contract CANARYFind out who leaked it SCRUBClean a document before you send it DISARMStrip macros, scripts and beacons from a document BLINDDe-identify resumes for a fair review CLEANSHEETScrub hidden data from a spreadsheet MEDISCRUBRedact personal details from a record DATASCANFind personal data hiding in a spreadsheet DOCSCRUBClean metadata and comments from a Word file CALSCRUBClean a calendar invite before you share it NETTERMSChase an invoice that has not been paid DELTASee exactly what changed between two texts MACROLENSRead the macros in an Office file without running them TELLSSee the habits that identify your writing, and flatten them LANTERNFind text hidden for a machine to read and a person to miss LINEAGERead the editing history a Word file keeps about itself

Email7 tools

UNBEACONRemove tracking pixels from an email HEADERPROOFCheck if an email is really from who it says UNSUBFind the real unsubscribe link in an email PHISHLENSCheck a suspicious email or link safely MAILBOXTake an email apart and see where it came from SATCHELOpen an Outlook .msg or a winmail.dat without Outlook DMARCBuild and check SPF, DKIM, DMARC and security.txt

Links, QR codes and the web7 tools

SANILINKStrip tracking tags out of a link COOKIEAUDITSee which cookies are tracking you POLICYLENSRead the fine print of a privacy policy QRSHIELDSee a QR code link before you tap it QRMAKERMake a QR code that stays on your machine RAMPARTCheck a site's security headers and Content-Security-Policy AMBEROpen a Safari .webarchive on any computer or phone, and save it as one .html

Audio and video8 tools

SCRIBETranscribe a recording to text on your device VOICEGUARDDisguise a voice by shifting its pitch SPLICELook for cuts and joins in a recording RECASTBlack out part of a video SNIPCut a piece out of a recording REELRecord your screen, camera or microphone to a file AVSCRUBStrip the metadata from a video or an audio file HUSHBleep, silence or garble the words in a recording

Passwords, keys and codes9 tools

SHARDSplit a secret into pieces MIGRATORMove and audit a password vault privately SHADOWKEYCheck password strength and make strong ones, offline PWNCHECKCheck if a password has been breached PHRASEPassphrases, passwords and recovery phrases TOKENTwo-step login codes without an app or an account PAPERKEYPrint a key you can actually type back in KEYSA password vault that lives in this browser KEYPRINTCheck an SSH key's fingerprint, type and size, and audit authorized_keys

Encrypting and sending7 tools

LOCKBOXHand over work once you are paid VAULTSend a file browser to browser AIRGAPMove data across a camera CAPSULEAn encrypted file anyone can open in a browser CIPHEREncrypt a message to paste anywhere KEYRINGMake an age key pair and encrypt files to one STRONGBOXMake, or open, a password-protected zip on this device

Hiding things inside other things6 tools

PHANTOMStore a key or secret inside an image file GLYPHHide a note inside ordinary text, or reveal one PALIMPSESTHide a message in an image, or reveal one CADENCECheck the writing habits that identify you UNSEENFind the characters in a text that you cannot see STEGOSCANLook for data hidden inside an image

Secrets in code and configs4 tools

ALIASMask the names before you paste into an AI INTERCEPTClean secrets out of a network log or curl ENVSHIELDHide secrets before you share a config file SVGCLEANMake an SVG safe: no script, no handlers, no remote calls

Looking inside any file9 tools

X-RAYRead what a file is hiding SENTINELFind keys, passwords and card numbers before you share CLEANROOMOne pass to strip everything before you send a file OPTICRead the text in a photo or a scan MANIFESTSee what an app or a browser extension asks for before you install it SIEVESort files into known and unknown MAGICIdentify a file's real type from its bytes, and catch a wrong extension CARVERecover files hidden inside a memory dump or disk-image fragment Sovereign ConsoleAnalyse a file end to end in one air-gapped workbench

Files and formats6 tools

PACKZip and unzip files in the browser DECODEWork out what something is encoded as and unwrap it HEXRead any file as bytes EPOCHWork out what time a number is BEARINGConvert coordinates and work out a bearing CRIBBreak single-byte and repeating-key XOR, Caesar and ROT for CTF and RE

Certificates, tokens and proofs9 tools

CHECKSUMVerify a download was not tampered with PROVENANCEProve a file has not changed since you got it JOTRead and check a JWT without sending it anywhere CERTLENSTake a certificate or a chain apart and check it SIGILCheck the signature on a download without installing anything ASSERTRead a SAML response and check it without sending it anywhere SIGNETCheck a signed email or .p7m file, see who signed it, and take the signed file out STAMPCheck an RFC 3161 timestamp (.tsr) against the file it is for, in the browser VOUCHCheck who signed a Windows .exe or .dll, and whether it has changed since

Keeping this device to yourself10 tools

MIRAGEA decoy workspace if a device is taken EXPUNGEGet yourself off the people-search sites DEADBOLTClear your traces on a shared computer FINGERPRINTSee what your browser tells every site you visit JOURNALA private journal, encrypted at rest TRAILCut your home out of a run or ride before you share the track TAKEOUTOpen the data Google, Meta or Apple gave you and see what they were keeping VITALSRead an Apple Health export.zip: every record type, day by day, as CSV POSTBAGOpen an .mbox file or a Gmail Takeout zip and read every email in it CABINETOpen an Outlook .pst or .ost and save its email as .eml or .mbox

Covert work3 tools

OPSECFind where a real life leaks into a cover identity LEGENDKeep a cover story straight, and log who was told what RENDEZVOUSPlan a covert meeting: places, signals, abort and check-in

Test and demo data2 tools

DEALBOOKModel a round without leaking the cap table FAUXRealistic fake data for demos and tests

Help FAQ Privacy Terms Pro Hello@ObscuraOS.com Report a problem