Document intelligence for investigations
Entagraph reads the case file. All of it.
Statements, ledgers, emails, invoices, phone extractions. It pulls out every person, company, account, address, phone number and date inside them, works out how they connect, and takes you to the page each one came from.
Built for investigators, police, counsel, judges, regulators and compliance teams. Anyone who has to know what is in the material, not just the part they had time to read.
Runs on your own machines. Works fully offline. Nothing is uploaded.
The problem
The finding is never in one document.
You have read the file. Most of it, anyway. But what matters is rarely on any single page. It sits between them: the same address on two unrelated statements, a company incorporated the week before a transfer, a name that comes up three times in six hundred documents and turns out to connect everybody.
Keeping all of that in your head is the job, and it is the part that does not scale. You end up with a spreadsheet of names, a whiteboard covered in arrows, and a memory of what you read on Tuesday. That holds until the file gets big enough that it stops holding, and nothing warns you when you pass the point.
Entagraph does the remembering. The judgement stays yours.
What it finds
Everything in the file that has a name.
Entagraph reads each document and pulls out the things an investigation is made of. It then works out where the same person or account has been written four different ways, so one identity ends up as one entry.
The entities
People, organisations and places. Dates and times. Phone numbers, email addresses, URLs and IP addresses. Bank details, checked against their own check digits. Bitcoin, Ethereum and Litecoin addresses, checked against their checksums.
And your own. Give it keywords when you set the case up, such as an operation name, a vessel or a product code. Each one becomes an entity in its own right wherever it turns up, treated exactly like the rest.
The documents
Twenty-eight formats, plus the archives they arrive zipped inside, plus images through OCR. Cellebrite and UFED extraction reports are spotted by their content, not their file extension, so they get read as extractions and not as loose XML.
Every format Entagraph claims to read is tested again each time it starts. If one has stopped working you are told, so a broken reader cannot pass itself off as a case that simply had no spreadsheets in it.
What it tells you
Then it reads the network for you.
A picture of a network is not an answer. Entagraph works through the structure the documents describe and answers five questions you would not have thought to ask, then shows you the passages each answer rests on.
CONNECT TWO ENTITIES
How are these two connected?
The strongest chain of links between any two entities, even where they never appear together. Each step comes with the document and the passage it rests on.
- Names the intermediaries, in order
- Every hop opens to its source passage
- Answers in seconds what a manual trace takes days to attempt
- Says plainly when no connection exists, rather than implying one
WHO IS IN THE MIDDLE
Who sits between everyone else?
The entities lying on the most paths between others. Structurally this is the shape a broker or go-between makes, and it is not something that would stand out in any single document.
- Ranks by how much of the network runs through them
- Surfaces people no keyword search would raise
- A structural finding and not an accusation. The tool says so too
- Skipped, and says so, on cases too large to compute honestly
WHAT THE GROUPS ARE
Which clusters does this case contain?
Entities that connect to each other far more than they connect outward. Often these are the separate strands of a matter, or the parts of an organisation that do not talk to one another.
- Finds the divisions in the material rather than imposing them
- Shows what each group has in common
- Makes an unexpected member of a tight group obvious
- Useful for deciding how to split work across a team
WHAT HOLDS THIS TOGETHER
Which single link is load-bearing?
Links whose removal would break the network into separate pieces. In a case, frequently the account, the introducer or the intermediary the whole arrangement depends on.
- Identifies the connection everything else routes through
- Often the most consequential entity in the matter
- Directs scrutiny where removing it would change the picture
- Each one traceable to the documents that create it
WHAT IS MISSING
Who should be connected, and is not?
Pairs who share a lot of mutual connections but never once appear together. Sometimes that is coincidence. Sometimes it is separation on purpose, which is a question worth asking.
- Finds absence, which no search can look for
- Two people with the same circle who never co-occur
- A lead to test, never a conclusion
- The question a reviewer would not have known to ask
THE CASE FILE
Everything else you need on the way through.
The graph is one view. Alongside it sits the ordinary work: the ledger of every entity, the decisions about who is who, the sequence, the geography.
- Entity ledger: every name, account and identifier, ranked by weight
- Merge review: the same person spelled four ways, your call, reversible
- Timeline and map: when it happened, and where
- Contradictions: statements in the record that cannot both be true
Artificial intelligence
AI that works the case, not a chatbot.
There is no prompt to write and no conversation to have. Turn it on and Entagraph reads an entity's mentions across the whole file and writes up what it makes of them. You decide what that is worth.
What it gives you
For any entity, a written account of what the file says about them: who they appear to be, what they appear to have done, the accounts and identifiers involved, the dates that matter, and the follow-up work it would suggest.
It will summarise a document the same way. Either goes straight into the report if you want it there.
Fact and inference do not blur. Every claim carries its provenance in the sentence. [STATED] means it came straight from a document. [INFERRED] means the model concluded it, and it tells you what from. You are not left working out which is which.
And where it runs is your decision.
AI is a licensed module and off by default. Everything else works without it: extraction, the graph, the five questions, the timeline, the map, the typologies and the reporting are all deterministic. The AI adds a reading of the case. It is not what the case rests on.
- OFF
- The default, and a complete product. Nothing is sent anywhere, because nothing is asked of a model.
- LOCAL
- A model running on the same machine as the case. Nothing leaves it. Pull the network cable out and everything still works, which for some of the material this gets used on is the only acceptable answer.
- ONLINE
- A provider under your own account and your own agreement, used only where you permit it. Limited, deliberate, and yours to revoke.
Signal library
It knows the language these patterns use.
Entagraph ships libraries of scored indicators: the phrasing, the euphemisms, the giveaways. It reads the case text against them, so a pattern you were not looking for still comes up, scored, and opens straight to the passage that set it off. You can import your own libraries for your own domain.
- 01Money laundering
- 02Threat, coercion & deception
- 03Scam detection
- 04Due diligence
- 05Environmental crime
Place, time, and what comes next
Where it happened, and where it goes next.
Cities, countries and IP addresses are lifted out of the material and put on a map, geolocated from a database held on the machine. Dates go the same way onto a timeline, in order, with every event opening to the document behind it.
It hands off to what you already use
The link-analysis graph exports as GraphML or GEXF and opens directly in i2 Analyst's Notebook, Gephi, yEd and Maltego. Entities export as CSV, JSON or plain text. Ask for a deduplicated list of every Bitcoin address in the case and you get something you can paste straight into a blockchain analysis tool.
Entagraph is where the case is understood. It does not ask to be the only place you work.
Rigour
It tells you what it does not know.
Every analytical view sets out what you can reasonably take from it and what you cannot. A broker is a shape in the network, not a proven intermediary. A cluster is not a conspiracy, and a missing link is a question rather than a finding.
That is built into the product instead of being left to the reader, because work like this gets read by people whose job is to pull it apart.
- 01Inference is labelled as inference, and kept apart from the facts
- 02No identity is merged for you. Every consolidation is your decision, and reversible
- 03Where an analysis cannot be run properly, it says so instead of returning something weaker
Control
Your material never has to leave the building.
Much of what this gets used on is privileged, sensitive or under an order. That assumption is built into how it works, not bolted on afterwards as a policy.
It runs where you put it
A desktop application for macOS and Windows, installed on your own hardware. There is no Entagraph server, no tenant, and no account for your case to live in.
It works with the network off
Reading, extraction, the graph, the timeline and reporting need no connection at all. Geolocation uses a database held on the machine. Online lookups are optional, and separately licensed.
Every claim keeps its source
Findings assemble into a disclosure bundle that carries the cited documents with it. Each one is re-hashed and checked, so if a source has changed since the case was built you are told, instead of it being copied across without comment.
Who it's for
Anyone who has to know what is in the file.
Investigators and police
Teams working complex matters against a clock, who need command of the record before the first interview, not after it.
Counsel, and the bench
Practitioners and judges who need to know what is in the bundle, all of it, and to show exactly where each point came from.
Compliance and regulators
Teams that have to understand their exposure quickly, defend that understanding, and show how they arrived at it.
Forensic accountants
Tracing value, ownership and relationships through dense financial and documentary material.
Request access
Arrange a private demonstration.
Entagraph is supplied to qualifying organisations through an individually arranged engagement. Tell us a little about the work and we will be in touch to arrange a confidential demonstration.
Already a client
Sign in for support and training