Provenance: an OSINT research platform built around the evidence

Provenance is a private web workspace for lawful open-source intelligence research and forensic case management. I built it to close a gap that keeps showing up in real investigations: findings are easy to capture, but hard to defend. Most OSINT tools hand you a screenshot and a URL. Provenance anchors every observation, entity, and file to a citation, a SHA-256 hash, and an RFC 3161 trusted timestamp, so a conclusion reached today can still be reconstructed, verified, and explained a year from now.

It runs entirely on Cloudflare’s edge: a Workers API, a D1 SQL database, and R2 object storage. No servers to patch, no infrastructure to babysit. A fresh deployment bootstraps its own schema and seeds the tool catalog on first request.

The Research Desk

A curated catalog of OSINT tools across username, email, DNS, archives, business records, and threat intelligence categories. Each entry carries a plain description, an OPSEC profile (passive versus active querying, what gets logged), flags for local installs, dorks, registration, and manual URLs, and a last-reviewed date. Launching a tool requires an explicit lawful-use acknowledgment first. Research sessions tie purpose, query parameters, and findings to a case, and captured material is committed deliberately, never scraped in the background.

The Casebook

Every case opens with a mandatory objective, scope note, and authorization. Entities carry confidence scoring, sources carry reliability ratings, and observations are atomic claims with explicit supports and refutes stances against cited sources. The relationship graph is a real interactive network view, zoomable and draggable, with an accessible table behind it. The timeline renders chronologically with a UTC time axis and event filters. Cases move through active, on-hold, closed, and archived states, with a 30-day trash quarantine before anything is permanently removed.

Evidence handling

Files are hashed in the browser before upload and re-verified byte for byte at the edge before they land in R2. Every piece of evidence gets an RFC 3161 trusted timestamp from DigiCert, FreeTSA, or Sectigo, and Provenance keeps both the .tsr token and the original .tsq request, because third-party verification tools need both. Downloads use scoped, single-use, 60-second tickets rather than exposed tokens.

Compliance audit log

Every user action is date-and-time-stamped with the operator’s name, dual-written to an immutable R2 prefix protected by a 365-day bucket lock, then archived to cheaper storage after a year. Exports can be certified: the HTML and Word reports ship as a ZIP with a manifest of per-file hashes, and the whole archive gets hashed and timestamped so it can be verified independently.

Governance

Multi-user RBAC with per-case access delegation. Sensitive status changes and deletions run through a Two-Man Rule approval queue. Suspending an investigator reassigns their cases while preserving the original investigator’s attribution. Sessions last 24 hours, logins are rate-limited, and the UI is keyboard-driven with a command palette and five investigator themes, including a paper-light theme built for daylight briefing rooms.

Reports

One-click exports to Markdown, styled HTML, or Word, each carrying the generating investigator’s name and a full cryptographic evidence manifest.

The build

React 18 and Tailwind on the front end, Hono on the Worker, strict TypeScript end to end. WCAG 2.1 AA accessible, zero third-party telemetry, zero automated collection by design. The whole thing runs inside Cloudflare’s edge network, which keeps the attack surface small and the chain of custody boring in the best way.

A tour of the workspace

The Research Desk grounds every session in a lawful-use boundary and links curated tools, sessions, and deliberate capture to active cases.

The catalog carries hundreds of categorized tools with OPSEC profiles and review dates.

The dashboard summarizes active, on-hold, closed, and archived work at a glance.

Cases carry scoping, classification, and status through the full lifecycle.

Sensitive transitions require Master Administrator approval, with justification and audit notes.

The WORM audit log records every action with operator attribution, protected by a 365-day R2 bucket lock.

RBAC with per-case delegation, account suspension, and case reassignment.

Five investigator themes, from a low-fatigue charcoal default to a paper-light theme for daylight briefing rooms.

Provenance is available by request to qualified organizations. It runs as a private, invite-only deployment, and I would be glad to walk you through it. If you are building or running an OSINT program that needs findings to survive scrutiny, get in touch.