One estate. Every identity.
Six modules that share one map of your people, agents, keys and systems, so a finding in one place changes what happens everywhere else.
Nine alerts become one decision
Findings from guardrails, DNS, drift, the secret scanner and every connected source are normalised, correlated into incidents and ranked by how much they could reach.
- Correlated, not stacked. Findings that share an identity, key or host merge into one incident.
- Fixed when it only removes access. Revocations and rotations run automatically; anything that grants access waits for a person.
- One queue for what needs you. Approvals, charter changes and access requests in a single list.
Access that shrinks at every hop
People sign in with passkeys. Agents act for a named owner, with a scope smaller than the owner's and a lifetime in minutes. Sub-agents get less again.
- Brokered credentials. Agents call through CrowID; the key never enters their context.
- Enroll any agent. Claude Code, Codex, Cursor, Devin or any MCP client, each with a coverage report.
- Stop in one click. Revoking an owner or agent ends every session beneath it.
owner · passkey · 2 devicesagent · Orchestree · 15 minsub-agent · 4 minWho can reach what, and through what
A live topology of people, agents, keys, tools and systems. Select anything to trace its reach; drift that widens access is caught and reversed.
- Org-wide charter. Rules no one, including admins, can quietly override.
- Drift reversed. Desired state is compared with what's actually deployed.
- Identity-based segments. Network rules written as "billing agent may read the CRM", not CIDRs.
Your domains, graded every day
The part of CrowID you can use right now. Every domain is checked for DNS hygiene, email authentication, TLS, web security headers and look-alike registrations, then re-checked daily.
- 25+ checks with evidence. Each one shows the record or header it read and the exact fix.
- Up to 40 look-alikes per domain. Homoglyphs, typos and TLD swaps resolved for DNS and mail.
- Alerts on regressions. A check that gets worse, a new look-alike or a grade drop raises an alert.
v=spf1 include:_spf.google.com -allpassv=DMARC1; p=none; rua=mailto:dmarc@…warnmax-age=63072000; includeSubDomainspassacmep1umbing.com · MX mx.zoho.eufailR11 · 61 days leftpassFind the key before someone else does
The secret scanner recognises cloud, payment, AI and source-control credentials plus high-entropy assignments. It runs entirely in your browser, so what you paste never leaves your machine.
- Paste text or point at a public repo. Results show the rule, line and a masked preview.
- Fingerprints, not values. A short hash identifies a key without storing it.
- Vault and rotation. In early access, found keys move into the vault and are replaced by handles.
# .env.production DATABASE_URL=postgres://app@db.internal/app STRIPE_SECRET_KEY=sk_live_51Hx•••• OPENAI_API_KEY=sk-proj-•••• LOG_LEVEL=info $ crowid sift .env.production ▲ line 3 Stripe live key fp 9c41e2a07b3d55f1 ▲ line 4 OpenAI API key fp 2e7a90c4d1b86f03 ✓ 2 findings · 0 values stored
Evidence that proves itself
Every action, approval and veto is written to a SHA-256 hash chain. Anyone can recompute the chain and see that nothing was edited or removed. Controls map to it and are tested continuously.
- Cause chains. Walk from an outcome back to the human approval that started it.
- Verify in a browser. The console recomputes the chain locally; tampering shows instantly.
- Share a trust page. Publish the controls you pass, with live status.
ev_7f1c · human · 13:49:02ev_7f1e · prev 3b9e…a10cev_7f21 · imprint · blockedev_7f22 · prev c04d…9e71Every module, live, with a sample workspace
The interactive console runs the real CrowID reference engine in your browser. Click anything.