Polygon Cyber
Products · 02

Polygon
Trace

An investigation workspace for people who have too much evidence and not enough shape.

Photos, video, audio, documents, notes, URLs. Each one arrives as a fragment. Trace turns the pile into a case you can actually reason about — a timeline, a map, a link graph, an actor file, a set of competing explanations — and then argues with your conclusion.

5W+H
Six views of one case
when, where, who, what, why, how
~150
Detection patterns
34 checksum validators behind them
0
Third-party dependencies
platform frameworks only
~470
Tests
engines covered, not just compiled
The problem

The evidence is not the hard part

Collecting is easy now. A single matter arrives as four hundred photos, a folder of PDFs, three phone dumps and a transcript. The difficulty has moved: it is holding all of it in mind at once, noticing that two items share a camera, and knowing whether the story you have assembled is the only story that fits.

Most tools solve retrieval — they help you find the item you already remember. Trace is built for the opposite problem: surfacing the connection you had no reason to look for, and then testing the conclusion you have already reached against the ones you have not.

An investigation fails in two ways: you miss a link, or you fall in love with your first hypothesis. Trace is built against both.
Six views

One case, asked six ways

The same evidence, re-projected. Each view answers one question well rather than all of them adequately, and moving between them is how a case comes into focus.

When

Chronological timeline

A vertical timeline with date separators and year boundaries. A canvas mode collapses dense stretches into clusters by time window, geographic proximity or shared actor, so a busy afternoon does not drown a quiet month.

Where

Map with travel lines

Geo-tagged evidence on a map, with travel lines drawn between sequential items, top-location badges and geographic cluster overlays. Distances are computed properly, so "142 m apart" means it.

Who

Actor files

People of interest as a card grid, each opening into a contact-style file: profile, media, evidence, intelligence, associates. Faces detected across the case are matched to actors, and groups merge into individuals when identity resolves.

What

Investigation graph

A force-directed link graph over evidence and actors, sized by degree and coloured by community. Centrality controls, clique detection, shortest-path and multi-target path finding, and predicted links you accept or reject.

Why

Hypotheses

Competing explanations as first-class objects, managed for the analysis-of-competing-hypotheses matrix rather than kept in someone's head or the last paragraph of a report.

How

Analysis dashboard

Six structured methodologies over the case, with the narrative synthesis and the challenges to it in the same place. Every run is recorded.

Light table

The desk, before the theory

Before a case has a structure, an investigator spreads it out and moves it around. The light table is that surface: a freeform physics canvas where cards attract along the links between them, repel so they do not overlap, and settle when nothing meaningful is moving.

Pan, pinch, drag a card, drag from its handle to another card to draw a connection and label the relationship. Lasso a region to select many at once, then link, tag, align or delete the selection together. A mini-map in the corner keeps a large board navigable, and the camera stays where you left it when you switch tabs.

Three lenses overlay the board: causality lines to show the relationships, chronological re-flow to sort the same cards into time columns, and cluster grouping to draw the boundaries around what belongs together. Presentation mode walks the case in order, panning to each card — for the meeting where you have to show the reasoning, not just the finding.

With reduce-motion enabled, the simulation resolves in one bounded pass to the same final positions — no animated frames.

Graph engine

Centrality

Degree, betweenness, closeness, eigenvector and PageRank in one pass — five different answers to "which node matters", because they disagree usefully.

Communities

Modularity-maximising community detection, driving the colour overlay on the graph.

Paths and cliques

Shortest path between two nodes, enumerated alternate paths, the smallest tree connecting several targets, and maximal cliques above a size threshold.

Link prediction

Candidate connections from geographic proximity, embedding similarity and shared entities — each carrying a confidence and a stated reason, for you to accept or reject.

Divergence halos

A radar ring around each node composed from link density, temporal anomaly and source reliability — the visual cue that something sits oddly in the case.

Timeline layout

Constrain the vertical axis by timestamp and let the horizontal stay force-directed, so the graph and the chronology can be read at once.

Enrichment

What happens when a file lands

Ingestion is immediate and searchable. Enrichment queues behind it, one item at a time — importing a hundred photos should not start a hundred simultaneous analyses.

Photos and video

Text recognition, face detection with identity feature prints, scene classification and barcode decoding, composed into a readable description of the item.

Documents

PDF text with per-page recognition fallback for scanned pages, plus Word, Excel, PowerPoint, CSV, email bodies, the iWork formats and legacy Office.

Audio

On-device transcription and sound classification, so a recording becomes searchable text and a labelled event.

Entities

Named-entity extraction over every text source in the item, then the full pattern catalogue, then promotion of new names to actor records.

Place and time

Coordinates reverse-geocoded to city, region and country; addresses, postcodes and coordinate formats in the text resolved to locations; conditions attached for geo-tagged items.

Meaning

Text embeddings generated so semantically similar evidence can find each other without sharing a keyword.

Order is not incidental. Names have to be extracted before they can be pinned to people; vectors have to exist before similarity can link anything.
Automatic linksSignal
Duplicate fileIdentical content hash
Same cameraDevice serial, not make and model
Same barcodeDecoded payload on both items
Same personFace feature-print distance
Shared entityLabelled overlap in extracted detail
Shared actorBoth items tag the same person
Same authorNormalised document author
Geo proximityReal coordinates within a set radius
Temporal proximityWithin a time window
Semantic similarityEmbedding distance

Every linker checks for an existing edge first, so the strongest signal that fires for a pair is the one that labels it — and re-running the whole set over an established case adds nothing twice.

Detection catalogue

Precision, not just recall

Trace carries its own detection catalogue in the same tradition as Polygon Siphon: roughly 150 patterns across communications, finance, identity, credentials, medical, regulatory and logistics, layered with the machinery that makes them trustworthy rather than merely numerous.

Thirty-four checksum validators promote a match to near-certainty or reject it outright. Context gating asks whether supporting keywords appear near a low-specificity shape, so a bare nine-digit number does not become a finding on its own — and negative keywords suppress anything sitting beside "example" or "sample".

A normalisation pass runs before every scan: zero-width characters stripped, compatibility and fullwidth forms collapsed, exotic whitespace mapped down. Padding an identifier with invisible characters does not hide it.

Legible by design

A sandbox

Paste text, watch which patterns fire, and see the validator result and gate decision behind each one.

Per-pattern badges

The same explainer vocabulary on your own custom patterns as on the built-in ones.

Per-item disclosure

Catalogue matches on an evidence item, each stating its confidence and why it earned it.

Watchlists

Per-case watchwords with hits recorded against the item and a jump straight to the position in the source.

Analysis

Structured methods, not a chat box

The value of a language model here is not summary. It is discipline — running the structured techniques a good analyst runs, in a form that arrives at the desk instead of being skipped under deadline.

01

Narrative synthesis

The case as a coherent account, streamed as it forms, with source reliability visible alongside it.

02

Competing hypotheses

A matrix scoring each hypothesis against each piece of evidence, with new hypotheses addable inline as they occur to you.

03

Devil's advocate

Direct challenges to the leading account — where it strains, what it ignores.

04

Premortem

Failure scenarios written as though the conclusion has already collapsed, and the question is why.

05

Red team

The case read adversarially: how someone would attack the reasoning or the evidence chain.

06

Assumptions check

The load-bearing assumptions made explicit and tested, one card each.

Where the reasoning runs

Three backends with a per-call cascade: a hosted model where you want maximum capability, and an on-device model where the material must not leave the machine. Selection is routing logic, so the fallback behaviour is predictable rather than emergent.

And what it cost

Every analysis run is recorded per case with its token usage. An investigator can see which conclusions came from which backend, when, and at what expense — the audit an AI-assisted finding needs if it is ever going to be defended.

Custody

Provenance, not vibes

Evidence is hashed on ingest with a streaming digest, and the chain-of-custody log is a hash chain that can be verified rather than merely displayed. Sources carry a reliability grade and a collection category, and that grade propagates into the analysis surfaces — a conclusion resting on low-grade sourcing says so.

Deletion is deliberate rather than cascading: removing a record does not silently take its neighbours with it, and the derived artefacts it owned are cleaned up behind it.

Control

Thirty-six switches

Every enrichment stage is a flag, grouped into presets — because the right configuration for a sensitive matter on an air-gapped machine is not the right configuration for open-source research, and neither should require a different build of the app.

Turn off face detection. Turn off the network backends. Run text extraction and nothing else. The pipeline honours it.

Status

In development

Trace is in active development and not yet generally available. The six views, the light table, the enrichment pipeline, the graph engine and the analysis surfaces run today; the on-device multimodal and speech paths are staged behind flags pending platform availability. If you run investigations and the tooling has not fitted the work, we would rather hear about the work.

PLATFORM  macOS and iPadOS
LANGUAGE  Swift 6, strict concurrency
INTERFACE  SwiftUI
DEPENDENCIES  None — platform frameworks only
PROCESSING  On device
STATUS  In development