OBSCURA OSPRO
Settings

OBSCURA Sovereign Suite

A small company’s security programme, kept on your own machine.

This browser’s Pro key was not accepted: the subscription behind it has ended. Renew or subscribe below.

The Sovereign Suite onlyUS$4 a month, 7 days free EverythingUS$9 a month, 7 days free

US$4 a month or US$35 a year for the Sovereign Suite, or US$9 a month or US$79 a year for everything. 7 days free. Stripe takes a card, and nothing is charged if you cancel before they end.

The Sovereign Suite in the light theme, on Frameworks and controls: SOC 2 and ISO 27001 ticked as in scope, with the readiness panel counting the controls in place, and the services listed down the leftThe same Frameworks and controls screen in the dark theme

The suite at work

Taken from the suite itself. The incident and the configuration files are the samples each screen offers, so you can see a register full before you fill it.

An access review, then SOC 2. A staff list is chosen and a Google Workspace user list is dropped into Review who has access. It flags an account still enabled for someone who has left, a mailbox that belongs to no one on the staff list, a dormant account and two without two-step sign-in, and the leaver’s account is marked to be removed. Then SOC 2 in Frameworks and controls, opened at CC6.2, which the review is evidence for. Recorded in the suite itself; every name is invented, and there is no sound.
Check cloud and container config with its sample files: 24 findings to fix first from 11 files, 6 critical, 18 high, 20 medium and 10 low, listed by file and then by finding, worst firstThe same configuration check in the dark theme
Config, before it ships. Terraform, Kubernetes, Dockerfiles, Compose, CI pipelines, IAM policies and web server files, read in the window and checked against 111 rules, worst first, each with its line and the fix.
The incident register with its sample loaded: an invoice fraud through a finance mailbox, contained, severity 1, with 46 hours left on the UK GDPR's reporting clockThe same incident register in the dark theme
An incident, run from a playbook. Roles, severity, each step from containment to recovery, the reporting clocks it has started, the notices, and the review afterwards, kept as the record auditors and insurers ask for.
Everything it does

SOC 2 and ISO 27001 readiness, vendors, risk, access reviews and incidents in one window, kept in your browser and your own files. Fifty-four security services from one set of controls and evidence, and checks on the code and configuration you ship. The registers are never on a vendor’s server.

Before you start: It keeps the records an audit needs and certifies nothing: an auditor, or the body that runs the scheme, does that. What else it does not do

In brief

  • Frameworks and controls Twenty frameworks, from SOC 2, ISO 27001, PCI DSS and HIPAA to NIST 800-53 and 800-171, SOX IT general controls, the EU AI Act, the Cyber Resilience Act, ISO 22301 and the Essential Eight, and frameworks of your own, from one set of controls with owners, evidence, tests, due dates and a crosswalk between any two
  • Evidence and reports An evidence locker with a SHA-256 for every item, answers to security questionnaires, a trust page, a board report and a signed audit pack
  • Build and ship Cloud and container config checked, secrets found in git history, SBOMs, vulnerabilities tracked with CVSS and VEX, and releases signed
  • People and access Access reviews from the user lists your systems export, or read from GitHub, GitLab, Microsoft 365, Google Workspace and Okta in your browser; staff from your HR system’s export, their acknowledgements and training, joiners and leavers
  • Vendors and risk A vendor register, a risk register that can put risk in money, an asset inventory checked against your endpoint protection, GDPR records and continuity plans with restore tests
  • Incidents and secrets Incidents run from a playbook with their reporting clocks, the Cyber Resilience Act’s among them, tabletop exercises, audit logs triaged, a secrets register and break-glass accounts

All 54 services

A service is a job done by several tools one after another, each handing its result to the next. Nothing has a format of its own: what a service writes opens in the tools it was built from, so you are never locked in.

Frameworks, policies and people

  • Frameworks and controls Readiness for twenty frameworks, NIST 800-53, SOX IT general controls, the EU AI Act and the Essential Eight among them, and for frameworks of your own brought in from a spreadsheet, from one set of controls with owners, evidence, tests and due dates; SOC 2 Type II period coverage, a crosswalk between any two, and what an auditor needs exported
  • Policy library Eighteen plain-English policy templates to adopt, edit, approve by version and publish for staff to acknowledge
  • Connect your systems GitHub, GitLab, Microsoft 365, Google Workspace and Okta read from your browser, read-only: two-step sign-in, administrators, dormant accounts and guests, and branch protection and secret scanning, each read kept as dated evidence and read again when it falls due
  • Review who has access The user lists your systems export matched to your staff list: leavers, dormant and privileged accounts flagged, and the review signed off
  • Staff security records Policies acknowledged, training done, and joining and leaving checklists, for each person, the staff list taken from BambooHR, Rippling, HiBob, Personio, Gusto or Workday
  • Security awareness training Short modules with questions and a phishing recognition exercise, sent to staff as one file that works on its own

Evidence and reports

  • Kept results What any tool found or made, kept as evidence, raised as a finding or attached to an incident, each with its SHA-256 in a hash-chained record
  • Evidence locker Evidence with its SHA-256, who collected it and when, the controls it supports and when it runs out; the auditor’s requests; a signed audit pack
  • Test exported settings What AWS, Google Cloud, Azure, Entra ID, GitHub, Google Workspace, Okta and your device management export, tested against 37 checks, each file kept as evidence and each failure made a task; parsers of your own for other exports, run with no network
  • Answer a security questionnaire A customer’s spreadsheet read, each answer drafted from your approved answers, and the same file sent back filled in
  • Publish a trust page A static security page written from what the registers already say, hosted wherever you like
  • Board report The quarter in a page or two: readiness and its trend, open findings, overdue reviews, incidents, top risks and the decisions needed
  • What is due Everything the registers say is due, in one list by owner and date: reviews, renewals, tests and your own tasks, saved to your calendar as a file
  • Compliance calendar The recurring checks, from quarterly access reviews to the annual penetration test, each recorded with its evidence
  • Exchange registers with your team Registers encrypted to colleagues’ age keys, and every change a returned file would make shown for you to accept or reject

Vendors, risk and data

  • Vendor register Every supplier that holds your data, its assurance reports and agreements, and when each is due a review
  • Risk register Likelihood and impact before and after treatment, risk in money from FAIR’s ranges with a loss exceedance curve, the controls each risk relies on, and policy exceptions with their approvals
  • Asset inventory Devices, servers, SaaS and data stores with owners, and each laptop’s encryption, firewall and screen lock checked from your MDM export
  • GDPR accountability Processing activities and their lawful basis, DPIAs, subject requests against their deadlines, and breaches
  • Continuity and recovery Recovery time and point objectives per system, the recovery plan, and each restore test recorded
  • Find sensitive data Every file in a folder read, and the credentials, card numbers, ID numbers and personal data in each listed
  • Certificate inventory Every certificate with its expiry, key and signature, certbot renewal checked, and reminders exported

Building software

  • Check cloud and container config Terraform, Kubernetes, Docker, CI, IAM, CloudFormation and web servers checked, against your own rules as well
  • Find secrets in a repository Credentials in the tracked files and the whole git history, by commit and file, with the value masked
  • Dependencies and SBOM Lockfiles into a software bill of materials, every licence, third-party notices, and known vulnerabilities if you choose
  • Container image SBOM A saved Docker or OCI image read layer by layer, its packages written as CycloneDX
  • Track vulnerabilities Scanner and penetration test findings scored with CVSS, known-exploited ones marked, the few to fix first from what each asset holds and the alerts on it, each owned and dated, with VEX for customers
  • Sign a release Files signed with Ed25519 in minisign’s format, with a signed SHA256SUMS
  • Release record One pass or fail record per release: its SBOM, open vulnerabilities, VEX and signature

Incidents and monitoring

  • Incident register An incident run from a playbook, with its reporting clocks counted from when you became aware, notice drafts and review
  • Tabletop exercises Ransomware, email compromise or a leaked cloud key, with timed injects and an after-action report
  • Respond to an incident Step-by-step playbooks for a bad click, a leaked password, a stolen device or a misdirected file
  • Triage audit logs CloudTrail, Okta, Microsoft 365, Google Workspace and GitHub logs, and Defender, Falcon and SentinelOne alerts: root sign-ins, MFA turned off, new admins, mass downloads, credential theft, threats not stopped
  • Investigate an indicator One address, host, account, hash, domain or CVE followed through every register, and what already links a finding to another register
  • Runbooks Your own sequences of steps with approvals between them, every step in the activity log
  • Watch a folder for changes Every file fingerprinted, and later exactly what changed, with the signs of ransomware called out
  • Check this browser’s privacy What any website can read from this browser, and the settings that fix it
  • Reports from the Console Case reports sent from the Sovereign Console, each filed in the evidence locker with its hash and signature

Secrets and backups

  • Secrets register Every API key and service account by owner, where it is used, who knows it and when it was rotated, never the value
  • Break-glass accounts Emergency credentials split so it takes two of three named custodians, with each quarterly test recorded
  • Password health Weak, reused, old and breached passwords in the KEYS vault, and accounts with no second factor
  • Share passwords with a team Chosen entries encrypted to each person’s age key, and what to rotate when someone leaves
  • Environment files Each project’s .env files, sealed here and sent encrypted to each person’s age key
  • Switch password manager A 1Password, Bitwarden, LastPass or Keeper export brought into KEYS and the plain export deleted
  • Back up passwords and codes One encrypted backup of KEYS and TOKEN, put back on any browser
  • Protect and recover a secret A secret split into pieces, each hidden in its own picture, and rebuilt from enough of them (two services)
  • Paper backup A secret split onto printed cards, each with a QR code
  • Make a recovery kit How to get every account back, and who holds which piece, printed or sealed

Files in and out

  • Send a file securely Sealed with a passphrase you send another way, or to a person’s public key
  • Lock a file for several people It opens only when enough keyholders bring their pieces; Unlock a shared file does that
  • Clean files before sharing Location, names, comments and history taken out of photos, documents and PDFs in one go
  • Check a file before opening it Its real type, anything in it that runs, and secrets it leaks

Connecting your systems

Five providers can be read directly, read-only, when you press a button or when a read falls due. The requests go from your browser to your provider and nowhere else: this page’s security policy lets it reach those providers and no other site, and no other page on this site may reach them. Tokens stay in the tab’s memory unless you choose to keep a GitHub or GitLab token on your device, sealed with a passphrase. Each read is kept in the evidence locker as the provider’s answers, unchanged, with its SHA-256, against the SOC 2 and ISO 27001 controls it supports, and its accounts go into the access review.

ProviderWhat is readWhat you set up
GitHubMembers, owners and outside collaborators; whether two-factor authentication is required, and who has it off; branch protection on default branches; secret scanning and Dependabot, and their open alertsA fine-grained personal access token with read-only permissions, which you paste. Only an owner’s token sees the two-factor settings.
GitLabA group’s members and their roles; owners; members dormant or never active (from the billable members an owner can read); guests with no end date; whether the group requires two-factor authentication; protected default branches, force pushes and direct pushes; secret push protectionA personal or group access token with the read_api scope, which you paste. gitlab.com only, not a GitLab on your own domain. GitLab does not tell a group which members have two-factor on.
Microsoft 365 and Entra IDUsers, guests and their last sign-in; who has registered for MFA; who holds each administrator role; conditional access policies and security defaultsAn app registration in your own Entra ID (free, about ten minutes, steps in the suite) with four read-only permissions an administrator consents to. Sign-in times and MFA registration need Entra ID P1 or P2.
Google WorkspaceUsers, their last sign-in, 2-Step Verification enrolled and enforced; super admins, delegated admins and admin rolesAn OAuth client in a Google Cloud project of your own, set to Internal so Google needs no verification, with two read-only Admin SDK scopes.
OktaUsers, their last sign-in and enrolled factors; administrators; whether sign-on and authentication policies ask for a second factorAn OIDC single-page app of your own with three read-only Okta API scopes, and this site added as a Trusted Origin. Built from Okta’s documentation and not yet tried against a live Okta organisation; an okta.com domain, not a custom one.

Each place read is due again after the interval you choose. When Connect your systems is opened, what is due and still connected in the tab is read again by itself, and the rest is named with what it needs; while the Suite stays open it can also read every connected system again every hour, four hours or day.

The limits: a read is a snapshot taken while the Suite is open, not monitoring: nothing is read while it is closed, and nothing signs in on its own. Only what a provider publishes can be read, so GitHub cannot say who is dormant, and Google Workspace has no guest accounts to list. AWS, Google Cloud and Azure are not connected, because most of their APIs do not answer a browser. Their exports are read as files instead, in Test exported settings: you run the provider’s own command with your own credentials, and the file it writes is tested on your device.

What a week of it looks like at a ten-person company

An illustration of the jobs, not a customer’s story. The person who looks after security is also doing something else.

  • Monday. A customer’s security questionnaire arrives as a spreadsheet. Most of its answers are drafted from the answers approved last time, the rest are written once and kept, and the same spreadsheet goes back.
  • Tuesday. The quarterly access review is due on the compliance calendar. User lists exported from the email, code and cloud accounts are matched to the staff list; someone who left in August still has a code host account, and the review records it closed.
  • Wednesday. A release goes out. The lockfiles become an SBOM, nothing critical or known to be exploited is open, the files are signed, and the release record says pass.
  • Thursday. A new payroll supplier is added to the vendor register with its SOC 2 report, and a risk is raised against it with its treatment.
  • Friday. Each of those left a piece of evidence with its SHA-256 against the controls it supports, and SOC 2 readiness moved on by what they cover. The registers are saved to a file and exchanged, encrypted, with the one colleague who reviews them.

What it is not

  • It does not watch your accounts. There are no agents and nothing runs while the suite is closed. The connectors read GitHub, Microsoft 365, Google Workspace and Okta only when you press the button, from your browser to your provider; everything else works from files your systems export, such as audit logs, lockfiles, Terraform and device management exports. Nothing about your company is held on our side.
  • It certifies nothing. It keeps the records a review needs; an auditor, or the body that runs each scheme, is who certifies.
  • The registers are yours to keep. They live in this browser until you clear it, and in the files you save. A team shares them by exchanging encrypted files, not through a shared database.
  • One thing asks a server, and only when you choose. Checking dependency versions against known vulnerabilities sends package names and versions, not your code, through this site to OSV.dev.
  • Deadlines are a reading of the law. The reporting clocks an incident starts are our reading of each law; whether one applies, and when it began, is for your counsel to confirm.
  • No single sign-on. There is no SSO or SCIM. A team or business that already has a Team or Business plan gives each person a key of their own on the seats page.

The Sovereign Console, one window for looking hard at a single file, is free, and so is checking a file with any of the single tools below. Buying for a team? OBSCURA for teams answers what a security reviewer will ask.

The single tools stay free to check

Each of these opens on its own page, with no account, and shows you what it finds. Saving the result is part of Pro.

SovereignPRO
SubscribeGo Pro OBSCURA OS home

On-deviceNo accountNothing uploaded

Sovereign Suite

The tools for files you would rather not hand to a website. Open a file and Sovereign lists the tools that can work on it; every one runs in this window, and nothing is uploaded.

Open a file

Drop it anywhere in this window, or choose it. It is read here, fingerprinted, and matched to every tool that can open it.

Recent
Pinned

All 122 Sovereign tools

Sixteen groups, by what you are working on.

Free · works offline · nothing uploaded Sovereign Console One program for looking hard at a file: identify, hash, entropy, hex, strings and indicators, decode and break, carve, YARA, encrypt, and a sealed evidence manifest. Every reading in one place, none of it leaving the tab. Open the Console →

Photos and images10 tools

CLOAKStrip metadata from a photo EXIFSee the GPS and camera data inside a photo VEILBlur faces and plates out of a photo BASTIONArmor an ID scan before you send it SCREENSHIELDBlack out the private parts of a screenshot TAMPERLook for signs a photo was edited SHRINKResize, convert and compress images IMAGEDIFFSee what changed between two images CONTRASTCheck colour contrast and find the nearest passing colour DOTSFind, read and remove a printer's hidden tracking dots

PDFs9 tools

SEALRedact a PDF so it stays redacted PACTSign a PDF and keep a record that holds up FORMAUDITSee what a PDF runs and collects STAPLEMerge, split, reorder and number PDFs FLATTENBurn a filled-in form into the page so it cannot be changed WATERMARKStamp a visible watermark across every page PADLOCKPut a password on a PDF, or take one off, on this device PRESSMake a PDF smaller without sending it anywhere STRATADig out every earlier version saved inside a PDF and see what changed

Documents and spreadsheets16 tools

REDLINESee what changed in a contract CANARYFind out who leaked it SCRUBClean a document before you send it DISARMStrip macros, scripts and beacons from a document BLINDDe-identify resumes for a fair review CLEANSHEETScrub hidden data from a spreadsheet MEDISCRUBRedact personal details from a record DATASCANFind personal data hiding in a spreadsheet DOCSCRUBClean metadata and comments from a Word file CALSCRUBClean a calendar invite before you share it NETTERMSChase an invoice that has not been paid DELTASee exactly what changed between two texts MACROLENSRead the macros in an Office file without running them TELLSSee the habits that identify your writing, and flatten them LANTERNFind text hidden for a machine to read and a person to miss LINEAGERead the editing history a Word file keeps about itself

Email7 tools

UNBEACONRemove tracking pixels from an email HEADERPROOFCheck if an email is really from who it says UNSUBFind the real unsubscribe link in an email PHISHLENSCheck a suspicious email or link safely MAILBOXTake an email apart and see where it came from SATCHELOpen an Outlook .msg or a winmail.dat without Outlook DMARCBuild and check SPF, DKIM, DMARC and security.txt
SANILINKStrip tracking tags out of a link COOKIEAUDITSee which cookies are tracking you POLICYLENSRead the fine print of a privacy policy QRSHIELDSee a QR code link before you tap it QRMAKERMake a QR code that stays on your machine RAMPARTCheck a site's security headers and Content-Security-Policy AMBEROpen a Safari .webarchive on any computer or phone, and save it as one .html

Audio and video8 tools

SCRIBETranscribe a recording to text on your device VOICEGUARDDisguise a voice by shifting its pitch SPLICELook for cuts and joins in a recording RECASTBlack out part of a video SNIPCut a piece out of a recording REELRecord your screen, camera or microphone to a file AVSCRUBStrip the metadata from a video or an audio file HUSHBleep, silence or garble the words in a recording

Passwords, keys and codes9 tools

SHARDSplit a secret into pieces MIGRATORMove and audit a password vault privately SHADOWKEYCheck password strength and make strong ones, offline PWNCHECKCheck if a password has been breached PHRASEPassphrases, passwords and recovery phrases TOKENTwo-step login codes without an app or an account PAPERKEYPrint a key you can actually type back in KEYSA password vault that lives in this browser KEYPRINTCheck an SSH key's fingerprint, type and size, and audit authorized_keys

Encrypting and sending7 tools

LOCKBOXHand over work once you are paid VAULTSend a file browser to browser AIRGAPMove data across a camera CAPSULEAn encrypted file anyone can open in a browser CIPHEREncrypt a message to paste anywhere KEYRINGMake an age key pair and encrypt files to one STRONGBOXMake, or open, a password-protected zip on this device

Hiding things inside other things6 tools

PHANTOMStore a key or secret inside an image file GLYPHHide a note inside ordinary text, or reveal one PALIMPSESTHide a message in an image, or reveal one CADENCECheck the writing habits that identify you UNSEENFind the characters in a text that you cannot see STEGOSCANLook for data hidden inside an image

Secrets in code and configs4 tools

ALIASMask the names before you paste into an AI INTERCEPTClean secrets out of a network log or curl ENVSHIELDHide secrets before you share a config file SVGCLEANMake an SVG safe: no script, no handlers, no remote calls

Looking inside any file9 tools

X-RAYRead what a file is hiding SENTINELFind keys, passwords and card numbers before you share CLEANROOMOne pass to strip everything before you send a file OPTICRead the text in a photo or a scan MANIFESTSee what an app or a browser extension asks for before you install it SIEVESort files into known and unknown MAGICIdentify a file's real type from its bytes, and catch a wrong extension CARVERecover files hidden inside a memory dump or disk-image fragment Sovereign ConsoleAnalyse a file end to end in one air-gapped workbench

Files and formats6 tools

PACKZip and unzip files in the browser DECODEWork out what something is encoded as and unwrap it HEXRead any file as bytes EPOCHWork out what time a number is BEARINGConvert coordinates and work out a bearing CRIBBreak single-byte and repeating-key XOR, Caesar and ROT for CTF and RE

Certificates, tokens and proofs9 tools

CHECKSUMVerify a download was not tampered with PROVENANCEProve a file has not changed since you got it JOTRead and check a JWT without sending it anywhere CERTLENSTake a certificate or a chain apart and check it SIGILCheck the signature on a download without installing anything ASSERTRead a SAML response and check it without sending it anywhere SIGNETCheck a signed email or .p7m file, see who signed it, and take the signed file out STAMPCheck an RFC 3161 timestamp (.tsr) against the file it is for, in the browser VOUCHCheck who signed a Windows .exe or .dll, and whether it has changed since

Keeping this device to yourself10 tools

MIRAGEA decoy workspace if a device is taken EXPUNGEGet yourself off the people-search sites DEADBOLTClear your traces on a shared computer FINGERPRINTSee what your browser tells every site you visit JOURNALA private journal, encrypted at rest TRAILCut your home out of a run or ride before you share the track TAKEOUTOpen the data Google, Meta or Apple gave you and see what they were keeping VITALSRead an Apple Health export.zip: every record type, day by day, as CSV POSTBAGOpen an .mbox file or a Gmail Takeout zip and read every email in it CABINETOpen an Outlook .pst or .ost and save its email as .eml or .mbox

Covert work3 tools

OPSECFind where a real life leaks into a cover identity LEGENDKeep a cover story straight, and log who was told what RENDEZVOUSPlan a covert meeting: places, signals, abort and check-in

Test and demo data2 tools

DEALBOOKModel a round without leaking the cap table FAUXRealistic fake data for demos and tests
Help FAQ Privacy Terms Pro [email protected] Report a problem