Products · Aleph Intelligence Platform
Early accessThe first sovereign AI for investigation
For the issues that matter most: threat intelligence, cyber risk, DORA and NIS2 compliance, third-party risk monitoring, criminal investigations, and the protection of organisations and states. The AI investigates across the clear, deep and dark web and cites every source, giving you full traceability and auditability of the information.
Don’t want to wait? Open Search answers right away, for free.
Conversation
What can be found on Acme Group and its providers?
"acme-group.fr" AND "vpn"
Full read · forum · Tor
xk3f…q7ad[.]onion
"Kelvion IT"
Anchored query proposed
"Kelvion IT" AND "acme"
04 · Credentials and access
Which accounts are open today?
Remote access belonging to one of the group's providers has been circulating on a forum since March. E4
0 suggestion pending
Your issues
Six fields, the same standard of proof
The AI queries the Aleph index, collected since 2012 across the clear, deep and dark web. From one field to the next, the question changes. The rigour of the answer does not.
Threat intelligence
The AI reads forums, marketplaces and claim sites in full, not an excerpt. You know what is being prepared against you, and which source it rests on.
Cyber risk
Credentials, remote access, internal documents: every exposure carries the date it was first and last seen. You deal first with what is open today.
DORA and NIS2 compliance
Every query, every piece of evidence and every decision is logged, and the report appends its method and its limitations. You document the watch these texts require, and you can show it.
Third-party risk
Suppliers, providers, subsidiaries: their link to you is checked against official registries before the AI writes about them. You see a third party's exposure before it becomes yours.
Criminal investigations
A wallet address found on a forum is read on-chain, and the funds are followed over two hops. You trace a financial lead without leaving the case.
Protecting organisations and states
Executives, sites, market signals: the AI looks for what is said where fraud and hostile action are prepared. You protect people and institutions within the frame you have set.
What it changes
An AI that investigates to help you remediate your risks
The AI does the long work: searching, opening, reading, cross-checking. Every finding is tied to a risk scenario, then to a dated measure: you know what to fix, and in which order.
Precision over volume
The AI opens every document in full and reads it in context, never from an excerpt. Every finding quotes the exact passage that establishes it and carries its confidence level: confirmed, probable or to be confirmed. Namesakes and false positives are ruled out, and the report says why.
Every finding points to its evidence
The document that establishes a fact is captured at the moment it is read, with its indexing date and a verifiable fingerprint. A finding its evidence does not support is removed at review.
Our AI agents refine the perimeter with you
Official registries give the agent its first bearings: legal name, executives, subsidiaries, brands. As soon as a link is uncertain, a namesake or a third party, it asks you, and your answer holds for the rest of the investigation. At the end of each turn it proposes leads to pursue, and you choose which.
Sovereign, and within the law at every moment
The index is collected in France, and the models come from Aleph AI Lab. When you open an analysis, you declare its purpose; under a mandate, every query is checked against the approved perimeter before it leaves, the AI's included. Passwords, card numbers and bank details are masked on receipt.
In practice
One question, and the investigation starts
The analysis opens with one sentence. The AI works in turns: it reports what it searched, read and kept, and you take back control at the end of each turn.
01You ask
The question
One sentence is enough to open an analysis. In a team, the request is approved before the first search goes out.
02The AI investigates
In depth
It searches, opens every document in full, captures it as evidence and follows what it reads there.
03You decide
What matters
A namesake to rule out, a third party to qualify, a lead to pursue: the AI resumes in the direction you choose.
04You deliver
A sourced report
In Word, PDF, HTML or Markdown, in French or English, with the evidence register as an appendix.
Monitoring and alerting
Every query in the report becomes a monitoring probe
A monitoring run replays every query in the report. As long as none of them moves, no document is reopened. As soon as a new document appears, the AI reads it with the full context of the report, qualifies the threat and alerts you.
Monitoring run · Acme Group analysis
42 queries replayed · 39 unchanged · 3 moved
- CriticalHigh confidence
New threat · Cyber and access
Remote access belonging to one of the group's providers is up for sale
The report established they had been circulating since March. They are now offered for sale on a forum.
Confirms C-04
Actions
Within 72 h
Revoke and reissue the provider's access
Within 15 days
Require the provider to audit its workstations
- SignificantMedium confidence
Change in a known exposure · Reputation and market
A new forum thread picks up the leak already documented
No new data, but circulation widens to a second forum.
Adds to C-07
Actions
Within 15 days
Prepare response material
- MinorHigh confidence
Likely false positive · Third parties and supply chain
Acme Corp LLC: a namesake, unrelated to the group
The company named is already ruled out in the report as a namesake.
What does not concern you
Actions
None: the alert is filed.
Summary email sent · sorted from critical to minor
Schematic. Names, codes and figures are fictitious.
One email, sorted by severity
A run that finds something sends you a summary email, from critical to minor, with the link to alert tracking. A run that finds nothing does not disturb you.
Every alert says what to do
A headline you understand without opening the alert, what happened, why this severity, and up to five dated actions: within 72 hours, within 15 days, or structural.
Every alert ties back to the report
It states which finding it confirms, adds to or contradicts, and which risk family it falls under. You handle it or dismiss it, and its status stays on file.
The investigation graph
Who is linked to whom, and on what evidence
Every company, person, actor and wallet met during the investigation takes its place in the graph, with its link to the target and the evidence that establishes it. What remains uncertain shows at a glance: dashes for a link to confirm, rings for severity.
- Solid: established by documents
- Light: discovered during the investigation
- Dashed: link to confirm
- Double ring: high severity
- Dashed ring: to investigate
Fictitious data. Hover or tap an entity to see its links and its record; the filters highlight a kind or a severity.
Perimeter control
Every query is examined before it leaves, the AI's included
Under a mandate, the Scope Controller checks every search against the approved perimeter: the purpose, the target entities, the period. It does not judge whether a query is good. It checks that it serves the case.
Approved perimeter · version 2
Due diligence · Acme Group, its subsidiaries and its domains · until 30 November
AI
"acme-group.fr" AND "vpn"
In scopeThe target company, on its own domain. The search goes out.
AI
"Kelvion IT"
Edge caseA provider tied to the case by evidence E6. The query is anchored on the target before it goes out:
"Kelvion IT" AND "acme"
Analyst
"Julien Marchal"
Out of scopeA person with no link to the case. Refused, whatever the mode: only an approved extension would open it.
A refusal is not a dead end. You request an extension, a manager approves it, and the perimeter moves to its next version. The AI, for its part, never rephrases a refused query to slip it through.
Schematic. Names are fictitious.
The deliverable
A report that answers the questions you will be asked
Sixteen parts in three movements, each opened by the question it answers. Every finding is tied to a risk scenario, every scenario to a measure, every measure to a horizon: within 72 hours, within 15 days, or structural.
00 · At a glance
What needs deciding this week?
Movement 1 / 3
Explore
what others cannot reach
- 01Scope and framework
- 02Scope mapping
- 03Sources and timeline
Movement 2 / 3
Surface
the signal that matters
- 04Credentials and access
- 05Executives
- 06Financial data
- 07Employees, infrastructure
- 08Market signals and reputation
- 09What does not concern you
- 10What is not exposed
Movement 3 / 3
Make readable
what was unreadable
- 11Risk scenarios
- 12Action plan
- 13What will not work
- 14Points to investigate
- 15Continuous monitoring
Appendices
- ASource register
- BMethod, queries and limitations
- CRating scale
- DGlossary
Export
- Word
- HTML
- Markdown
- FR · EN
What the report rules out, documented like the rest: namesakes, false positives, searches that came back empty.
The exposure report outline of the Corporate Due Diligence agent. A custom agent carries its own outline.
Crypto investigation
An address on a forum becomes a financial lead
The AI recognises wallet addresses across more than thirty chains and formats, and tells an address apart from a private key or a transaction hash. It then reads the on-chain activity: Bitcoin, Litecoin, Ethereum and compatible chains, Tron.
- Flow: thickness and dots by amount
- Solid square: found in Aleph
- Circle: found on-chain, searched in Aleph
- Dashed circle: not yet searched
- Service: exchange, contract, public label
- Double ring: flagged address, high severity
Fictitious data. Change the scope or the view, replay the transfers over time: as in the product's Entities tab.
Funds followed over two hops
Downstream and upstream, up to the exchanges and identified services where tracing stops. You see where the money comes from and where it comes out.
Amounts at the rate of the transfer date
Every transfer is valued in dollars at the rate of the day it took place, not today's. A wallet's profile reads month by month.
Exposure to sanctions lists
Every wallet read is matched against OFAC sanctions lists and known scam lists, up to two hops from a flagged address.
Hypotheses, never accusations
Collection, rapid transit, peel chain, lookalike address: every typology detected states what would contradict it. The word “laundering” is never written without a document that establishes it.
Agents
Your investigation method becomes an agent
An agent brings together a method, the tools it uses and the report outline it produces. Two agents are provided, and you can write your own.
Corporate Due Diligence
The default agent. It follows the method of an exposure report, from mapping the group to the action plan, and produces the sixteen-part outline shown above.
Crypto wallets
The second agent provided, drawn from a real investigation. It looks for services and their forum profiles rather than address formats, then reads on-chain what it has found.
Your own agent
Your instructions, the tools you open to it, your report outline. It stays private, or is shared with your team or the whole organisation.
An analysis keeps its agent
Editing an agent does not change an investigation in progress. What was produced stays tied to the method that produced it.
Sovereignty
Sovereign, from the index to the model
The index is collected by Aleph, in France, with no third-party data supplier. The models that investigate are trained and customised by Aleph AI Lab to read the deep and dark web as it is written: forums, leaks, marketplaces, in their own languages.
Every analysis is partitioned. One team cannot see another's cases, not even their name in a list. And a dark web document carrying booby-trapped instructions remains, for the AI, data to analyse, never an order to follow.
The platform adapts to your governance. In an organisation, a request is approved before the investigation opens and every action stays in the log. A small outfit opens an analysis in one sentence. A dedicated instance remains possible for the organisation that requires it.
See an investigation run on your subject
The product is in early access. We show it on a question that concerns you, not on a demo dataset.