Polygon
Trace
An investigation workspace for people who have too much evidence and not enough shape.
Photos, video, audio, documents, notes, URLs. Each one arrives as a fragment. Trace turns the pile into a case you can actually reason about — a timeline, a map, a link graph, an actor file, a set of competing explanations — and then argues with your conclusion.
when, where, who, what, why, how
34 checksum validators behind them
platform frameworks only
engines covered, not just compiled
The evidence is not the hard part
Collecting is easy now. A single matter arrives as four hundred photos, a folder of PDFs, three phone dumps and a transcript. The difficulty has moved: it is holding all of it in mind at once, noticing that two items share a camera, and knowing whether the story you have assembled is the only story that fits.
Most tools solve retrieval — they help you find the item you already remember. Trace is built for the opposite problem: surfacing the connection you had no reason to look for, and then testing the conclusion you have already reached against the ones you have not.
One case, asked six ways
The same evidence, re-projected. Each view answers one question well rather than all of them adequately, and moving between them is how a case comes into focus.
Chronological timeline
A vertical timeline with date separators and year boundaries. A canvas mode collapses dense stretches into clusters by time window, geographic proximity or shared actor, so a busy afternoon does not drown a quiet month.
Map with travel lines
Geo-tagged evidence on a map, with travel lines drawn between sequential items, top-location badges and geographic cluster overlays. Distances are computed properly, so "142 m apart" means it.
Actor files
People of interest as a card grid, each opening into a contact-style file: profile, media, evidence, intelligence, associates. Faces detected across the case are matched to actors, and groups merge into individuals when identity resolves.
Investigation graph
A force-directed link graph over evidence and actors, sized by degree and coloured by community. Centrality controls, clique detection, shortest-path and multi-target path finding, and predicted links you accept or reject.
Hypotheses
Competing explanations as first-class objects, managed for the analysis-of-competing-hypotheses matrix rather than kept in someone's head or the last paragraph of a report.
Analysis dashboard
Six structured methodologies over the case, with the narrative synthesis and the challenges to it in the same place. Every run is recorded.
The desk, before the theory
Before a case has a structure, an investigator spreads it out and moves it around. The light table is that surface: a freeform physics canvas where cards attract along the links between them, repel so they do not overlap, and settle when nothing meaningful is moving.
Pan, pinch, drag a card, drag from its handle to another card to draw a connection and label the relationship. Lasso a region to select many at once, then link, tag, align or delete the selection together. A mini-map in the corner keeps a large board navigable, and the camera stays where you left it when you switch tabs.
Three lenses overlay the board: causality lines to show the relationships, chronological re-flow to sort the same cards into time columns, and cluster grouping to draw the boundaries around what belongs together. Presentation mode walks the case in order, panning to each card — for the meeting where you have to show the reasoning, not just the finding.
With reduce-motion enabled, the simulation resolves in one bounded pass to the same final positions — no animated frames.
Centrality
Degree, betweenness, closeness, eigenvector and PageRank in one pass — five different answers to "which node matters", because they disagree usefully.
Communities
Modularity-maximising community detection, driving the colour overlay on the graph.
Paths and cliques
Shortest path between two nodes, enumerated alternate paths, the smallest tree connecting several targets, and maximal cliques above a size threshold.
Link prediction
Candidate connections from geographic proximity, embedding similarity and shared entities — each carrying a confidence and a stated reason, for you to accept or reject.
Divergence halos
A radar ring around each node composed from link density, temporal anomaly and source reliability — the visual cue that something sits oddly in the case.
Timeline layout
Constrain the vertical axis by timestamp and let the horizontal stay force-directed, so the graph and the chronology can be read at once.
What happens when a file lands
Ingestion is immediate and searchable. Enrichment queues behind it, one item at a time — importing a hundred photos should not start a hundred simultaneous analyses.
Photos and video
Text recognition, face detection with identity feature prints, scene classification and barcode decoding, composed into a readable description of the item.
Documents
PDF text with per-page recognition fallback for scanned pages, plus Word, Excel, PowerPoint, CSV, email bodies, the iWork formats and legacy Office.
Audio
On-device transcription and sound classification, so a recording becomes searchable text and a labelled event.
Entities
Named-entity extraction over every text source in the item, then the full pattern catalogue, then promotion of new names to actor records.
Place and time
Coordinates reverse-geocoded to city, region and country; addresses, postcodes and coordinate formats in the text resolved to locations; conditions attached for geo-tagged items.
Meaning
Text embeddings generated so semantically similar evidence can find each other without sharing a keyword.
| Automatic links | Signal |
|---|---|
| Duplicate file | Identical content hash |
| Same camera | Device serial, not make and model |
| Same barcode | Decoded payload on both items |
| Same person | Face feature-print distance |
| Shared entity | Labelled overlap in extracted detail |
| Shared actor | Both items tag the same person |
| Same author | Normalised document author |
| Geo proximity | Real coordinates within a set radius |
| Temporal proximity | Within a time window |
| Semantic similarity | Embedding distance |
Every linker checks for an existing edge first, so the strongest signal that fires for a pair is the one that labels it — and re-running the whole set over an established case adds nothing twice.
Precision, not just recall
Trace carries its own detection catalogue in the same tradition as Polygon Siphon: roughly 150 patterns across communications, finance, identity, credentials, medical, regulatory and logistics, layered with the machinery that makes them trustworthy rather than merely numerous.
Thirty-four checksum validators promote a match to near-certainty or reject it outright. Context gating asks whether supporting keywords appear near a low-specificity shape, so a bare nine-digit number does not become a finding on its own — and negative keywords suppress anything sitting beside "example" or "sample".
A normalisation pass runs before every scan: zero-width characters stripped, compatibility and fullwidth forms collapsed, exotic whitespace mapped down. Padding an identifier with invisible characters does not hide it.
A sandbox
Paste text, watch which patterns fire, and see the validator result and gate decision behind each one.
Per-pattern badges
The same explainer vocabulary on your own custom patterns as on the built-in ones.
Per-item disclosure
Catalogue matches on an evidence item, each stating its confidence and why it earned it.
Watchlists
Per-case watchwords with hits recorded against the item and a jump straight to the position in the source.
Structured methods, not a chat box
The value of a language model here is not summary. It is discipline — running the structured techniques a good analyst runs, in a form that arrives at the desk instead of being skipped under deadline.
Narrative synthesis
The case as a coherent account, streamed as it forms, with source reliability visible alongside it.
Competing hypotheses
A matrix scoring each hypothesis against each piece of evidence, with new hypotheses addable inline as they occur to you.
Devil's advocate
Direct challenges to the leading account — where it strains, what it ignores.
Premortem
Failure scenarios written as though the conclusion has already collapsed, and the question is why.
Red team
The case read adversarially: how someone would attack the reasoning or the evidence chain.
Assumptions check
The load-bearing assumptions made explicit and tested, one card each.
Where the reasoning runs
Three backends with a per-call cascade: a hosted model where you want maximum capability, and an on-device model where the material must not leave the machine. Selection is routing logic, so the fallback behaviour is predictable rather than emergent.
And what it cost
Every analysis run is recorded per case with its token usage. An investigator can see which conclusions came from which backend, when, and at what expense — the audit an AI-assisted finding needs if it is ever going to be defended.
Provenance, not vibes
Evidence is hashed on ingest with a streaming digest, and the chain-of-custody log is a hash chain that can be verified rather than merely displayed. Sources carry a reliability grade and a collection category, and that grade propagates into the analysis surfaces — a conclusion resting on low-grade sourcing says so.
Deletion is deliberate rather than cascading: removing a record does not silently take its neighbours with it, and the derived artefacts it owned are cleaned up behind it.
Thirty-six switches
Every enrichment stage is a flag, grouped into presets — because the right configuration for a sensitive matter on an air-gapped machine is not the right configuration for open-source research, and neither should require a different build of the app.
Turn off face detection. Turn off the network backends. Run text extraction and nothing else. The pipeline honours it.
In development
Trace is in active development and not yet generally available. The six views, the light table, the enrichment pipeline, the graph engine and the analysis surfaces run today; the on-device multimodal and speech paths are staged behind flags pending platform availability. If you run investigations and the tooling has not fitted the work, we would rather hear about the work.
PLATFORM macOS and iPadOS
LANGUAGE Swift 6, strict concurrency
INTERFACE SwiftUI
DEPENDENCIES None — platform frameworks only
PROCESSING On device
STATUS In development