Built for police cyber cells & digital-forensics teams
Raw disclosures in.
Court-ready evidence out.
TraceLens parses operator CDR and IPDR exactly as disclosed — every identifier preserved as text — and turns them into 46 deterministic reports, each exportable with a Bharatiya Sakshya Adhiniyam Section 63(4) certificate and a reproducible result hash.
- 46
- reports in the catalog
- 6
- court export formats
- 1 hash
- across every format
- 63(4)
- certificate on every export
Resolved against an allocation window, not a guess — the port and the instant must both fall inside the subscriber's NAT lease.
Built to survive cross-examination
Evidence software is judged on what it refuses to do. These four constraints are enforced in the code and asserted in CI.
Nothing is guessed
Operator formats are data, not code. An unrecognised layout is reported as unrecognised — never silently mis-mapped into the wrong columns.
Identifiers stay text
IMEI, IMSI and MSISDN survive as strings end to end. Float coercion is structurally impossible, and property tests hold it to the IEEE-754 ceiling.
Every row is accounted for
Rows scanned = structural + loaded + rejected, enforced per file and shown in the UI. A case that does not reconcile cannot look healthy.
AI never touches evidence
Assistive analytics are labelled INVESTIGATIVE LEAD with a method note on every line, and are excluded from evidentiary exports by construction.
46 reports on one grid contract
Every report paginates, sorts, searches and exports the same way. What you see on screen is what the export contains.
16 reports
Associates, tower footprint, movement with impossible-jump gating, anchors, co-location, IMEI–IMSI binding, odd-hours, bursts.
21 reports
CGNAT resolution, reverse destination, ASN/org attribution, protocols and anomalous ports, VPN/Tor, VoIP platforms, crypto and banking exposure, bulk IP lookup.
9 reports
Unified voice+data timeline, device-centric identity correlation, call-then-connect, location cross-validation, 360° dossier, risk scoring.
Six formats. One hash.
The result hash is computed over the report's rows, not the rendered file. File the PDF, disclose the CSV, and both provably represent exactly the same figures.
Every format carries the Bharatiya Sakshya Adhiniyam 2023 Section 63(4) certificate, pre-filled with the source SHA-256 hashes, the parameters used, the row count and the result hash.
See the full report catalog →Result SHA-256
5e7f42d74987b43f746ee9481b527af0103947c03f4329144a81ca0266e9f1daIdentical across all six exports of the same report.
How it works
Disclosure to exhibit, in four steps
Ingest the disclosure
Upload the operator's workbook, or stream records over the feed API. The template registry recognises the layout by its header signature; an unknown format is reported, never guessed.
SHA-256 + MD5 on arrival · original stored immutably
Reconcile and normalise
Every row is accounted for: scanned = structural + loaded + rejected, with a reason on each rejection. Identifiers are normalised as text, so an IMEI can never become a float.
QC report surfaced per file and asserted in CI
Investigate
46 reports on one grid — associates, towers, movement, CGNAT resolution, fusion timelines — plus an offline map, an entity graph and clearly-labelled AI leads.
Server-driven paging, sorting and search
Produce the exhibit
Export in any of six formats. Each carries a Section 63(4) certificate with the source hashes, the parameters and a result hash that is identical across every format.
XLSX · PDF · DOCX · CSV · JSON · HTML
Flagship
Resolve a CGNAT address to one subscriber
Carrier-grade NAT puts hundreds of subscribers behind a single public IP. Given the public IP, the port and the instant, TraceLens returns the subscriber whose allocation window actually contained that moment — not a list of maybes.
- Matched against the NAT lease window, not a nearest-time guess
- Port and timestamp must both fall inside the allocation
- Answer is exportable with its own Section 63(4) certificate
- Works on the operator's disclosure exactly as issued
Real-time
Watch rules that fire the moment a record lands
Stream records over the feed API as your upstream system receives them. Declarative rules on MSISDN, IMEI, cell or destination raise an alert in the same request that ingested the record.
- Each batch stored and hashed as its own evidence file
- Streamed rows normalise identically to parsed ones — asserted in CI
- Feed credentials stored hashed and shown exactly once
- No interception: TraceLens analyses what it is lawfully sent
Measured, not claimed
- 0
- reports in the catalog
- 0
- court export formats
- 0+
- automated tests in CI
- 0%
- of rows reconciled per file
Who it's for
Built for the people who have to justify the number
Police cyber cells
Resolve a public IP and port to a subscriber, place a handset against tower geography, and produce a certified exhibit for the case file.
Digital-forensics firms
Handle disclosures from multiple operators in one workspace, with per-file QC that proves nothing was dropped in the conversion.
State agencies on-premise
Run the identical stack air-gapped behind your own perimeter, licensed offline, with a destruction certificate when a case is purged.
Deployment
Cloud, on-premise, or fully air-gapped
The on-premise build is the same stack with a single tenant, installed from a Compose bundle validated by an offline signed licence key. Nothing phones home — not even the map.
- Schema-per-tenant isolation, not a shared WHERE clause
- Offline geo plotting with no basemap tile requests
- Local model or deterministic template for case briefs
- Hash-stamped destruction certificate on tenant purge
Pricing
Every plan includes every evidence feature
You pay for scale, not for access. Court-format exports and the full report catalog are in the free trial too.
Trial
Free
2 seats · 5 open cases
Standard (Forensic Firm)
₹60,000
10 seats · 100 open cases
Enterprise (LEA / Tender)
₹2,50,000
50 seats · 1000 open cases
Questions
The things procurement actually asks
Does TraceLens intercept calls or data?
No, and it never will. TraceLens analyses records lawfully obtained from operators. Interception happens inside carrier lawful-interception infrastructure under a warrant; no analysis application substitutes for that. The real-time feed ingests records an authorised upstream system sends to it — that is the whole of what 'live' means here.
Which operator formats are supported?
Operator layouts are data, not code: a template registry maps header signatures onto canonical fields. A format we haven't seen is reported as 'unrecognised' rather than guessed at, and adding one is a registry entry, not a release.
How do you keep identifiers accurate?
Every identifier survives as text from parse to export. Float coercion of an IMEI, IMSI or MSISDN is structurally impossible, and property tests hold that to the IEEE-754 exact-integer ceiling. Per-file QC also asserts rows scanned = structural + loaded + rejected, so nothing is silently dropped.
Will the reports hold up in court?
Evidentiary output is deterministic — the same inputs always produce the same figures. Every export carries a Bharatiya Sakshya Adhiniyam 2023 Section 63(4) certificate with the source SHA-256 hashes, the parameters used, the row count and a result hash. Assistive analytics are labelled as leads and are excluded from those exports.
Can we run it inside our own network?
Yes. The on-premise build is the same stack with a single tenant, installed from a Compose bundle with an offline signed licence key. It runs air-gapped: no case data, and no map tile request, leaves the host.
What happens when the trial ends?
Nothing is charged and nothing converts automatically — there is no card on file. Your workspace becomes read-only until you choose a plan, and you can export everything you produced during the trial.
How is our data isolated from other customers?
Each tenant lives in its own PostgreSQL schema, not behind a shared WHERE clause. A query in one unit's workspace cannot reach another's rows even if the application layer were wrong.
Do you offer training and integration?
Yes — enterprise and tender plans include onboarding, and the platform exposes an integrator API plus a feed ingest endpoint for connecting an existing case-management system.
Get in touch
Book a demo on your own data
Tell us which operators' disclosures you receive and roughly what volume, and we will show you the exact reports your unit would get — not a canned deck.
Response time
One working day for demo and tender requests
Deployment
Cloud, on-premise, or air-gapped
Trial
7 days, no card, no automatic conversion
Start with your own disclosure
Upload a real CDR or IPDR file and see the QC reconciliation, the reports and a certified export within minutes. 7 days, no card.