Products

Company-scoped AI agents with persistent memory, encrypted credentials and real tool execution — shell, cloud CLIs, Kubernetes, git and databases — inside isolated per-agent sandboxes.

• Real operational work: cloud audits, cost reports, cluster health checks, incident response
• Persistent agents: long-term memory and a stable persona per agent, scoped to your company
• Every channel you use: WhatsApp, Slack, Telegram, Microsoft Teams, webhooks and scheduled prompts
• Safe by design: isolated sandboxes and confirmation gates before destructive actions
• Multi-model: works with multiple LLM providers

One dashboard to monitor, manage and secure everything — from AWS accounts and Kubernetes clusters to VMware hosts and bare-metal servers. Self-hosted with a single Docker Compose command, connected securely over Cloudflare Tunnel. No agents required on monitored hosts.

Connect a repository once: SAST, secret detection, dependency, container, IaC and CI/CD analysis run on every push and pull request — findings deduplicated into one identity each, rolled into a project score, and enforced as a merge gate on the PR.

• Six engines, one report: gitleaks, semgrep, trivy, checkov, hadolint + native CI/CD rules
• Pipeline attacks covered: unpinned actions, pull_request_target abuse, script injection, token over-permission
• Hostile input assumed: scanned code is never executed — read-only, sandboxed, credential-free scanners
• SaaS or self-hosted: sign in with GitHub/GitLab, or run the stack in your own network

Logs, agents, cloud audit trails and code platforms in one SIEM — operated by us, isolated per tenant, with alerts a human can actually read. The same stack guards our own fleet.

• Every layer covered: Linux, Windows and macOS agents, Docker hosts and containers, AWS CloudTrail and GuardDuty, GitHub organisation events
• Command-level auditing: SSH, CI-runner and cloud-session commands recorded; dangerous commands and sensitive-file access raise alerts
• Alerts that explain themselves: severity, host, what happened, what to do and a link back to the event — delivered to Slack with flood protection and repeat suppression
• Tenant-aware by design: each customer's agents, cloud accounts and repositories map to their own tenant; nothing leaks across
• Feeds AiMon: high-severity findings land in the same incident flow as your monitoring, with AI diagnostics attached

See what every cloud account really costs, where it is going and what can go — per company, per account, with forecasts and savings recommendations. Built from the playbook we use in our own AWS cost-cutting engagements.

• Company → accounts model: each company owns its cloud accounts; admins see everything, users only the companies they are assigned to
• Billing-export based: AWS costs come from CUR 2.0 / Data Exports — no per-request Cost Explorer charges, no surprises
• Actuals and forecast: monthly spend, trends and forecast on one dashboard; load labelled sample data to explore before connecting an account
• Savings recommendations: idle and underused resources, snapshots, storage classes, NAT and off-hours scheduling — tracked to closure
• Security first: email + password + mandatory TOTP for every account; multi-cloud model with Azure and Google Cloud registered next

Protect users from malicious domains before connections happen. DNS Wall combines an AI risk engine, real-time threat intelligence, reputation analysis and a policy-driven DNS firewall to stop malware, phishing, ransomware, botnets and newly registered malicious domains — in the cloud, self-hosted or fully air-gapped.

• Blocks before the HTTP connection: the attack chain stops at the DNS lookup
• AI domain scoring: entropy, WHOIS, infrastructure and behavioral signals — not just lists
• SOC-ready threat hunting: passive DNS, reverse pivots, infrastructure graph, SIEM integration
• Enterprise scale: multi-tenant, RBAC, SSO, audit logs; SaaS to air-gapped

A truly private mailbox on grafmails.com or your own domain — end-to-end encryption between GrafMails users and zero-access storage for everything else, on infrastructure we operate and harden ourselves.

• Private by default: no advertising, no profiling, no inbox scanning
• Encrypted mailboxes: end-to-end between GrafMails users, zero-access storage at rest
• Custom domains: professional addresses for you, your family or your team
• Hardened delivery: SPF, DKIM and DMARC configured correctly out of the box
• Works everywhere: webmail plus IMAP/SMTP for the clients you already use

Every message from your journal mailboxes — Microsoft 365 included — stored as the original .eml on your own server, hash-verified before it is removed from the mail server, and searchable by compliance, legal and IT. Mail data never leaves the company.

• Evidence first: raw .eml content-addressed by SHA-256; the Elasticsearch index can be rebuilt from it at any time
• Search that answers requests: full-text including attachment text, filters and reports; export as .eml zip, mbox, CSV or PST
• Employee self-service: staff sign in with their company Active Directory account and an SMS one-time code, and search only their own mail — or from your intranet via the service API
• Never blocked: a message that cannot be archived is retried, then quarantined with its raw copy kept

Credentials for the machines, with a console for the humans who administer them. One platform, many virtual vaults underneath — each tenant gets an isolated namespace with its own encryption key, and a token can only ever see the vaults it was granted.

• Two things to integrate: a URL and a bearer token; secrets are fetched over a plain REST call from any agent, pipeline or service
• Isolation by key, not by convention: every virtual vault is encrypted with its own key; cross-vault access is impossible, not just forbidden
• Built for agents: the secret backend behind AI Central and AiMon — credentials never live in prompts, repos or environment files
• Operator console: human identities, grants and audit for the people who run it; browser extension for day-to-day lookups

A public monitoring service for the big cloud platforms, AI services, developer tools and infrastructure providers. Incidents are collected from each vendor's own source of truth, normalised into one vocabulary and shown on one timeline — with a JSON API and an iOS app with push notifications.

• Official sources only: webhook → RSS/Atom → status API → HTML, in that order; it never invents a status — unknown stays unknown, with the reason recorded
• One timeline per incident: repeated vendor updates are deduplicated into a single current state and history
• Security advisories too: exploitation status and relevance scoring from public feeds and official advisories
• Graf Status app: the same data on iOS, with push notifications for the vendors you follow

Download, upload, ping and jitter — measured against a server we run ourselves in Frankfurt, with no ads, no trackers and no data sold on. Shareable result links make it handy for debugging "the internet is slow" tickets with your ISP or your team.

Multi-tenant SaaS that runs a German driving school end to end — scheduling, students, vehicles and billing in one place. One deployment serves many schools; each school sees only its own world. German-language UI, built for how Fahrschulen actually work.

• Scheduling that fits: practical lessons and theory classes around instructor hours, breaks, holidays, vehicles, branches and rooms
• Student self-service: a portal for booking and progress, with the official Ausbildungsnachweis as PDF
• Billing built in: price lists, invoices and payments, with PDF output for every document
• Plays well with your tools: iCal calendar feeds and per-school SMTP for transactional email
• Strict tenant isolation: every query is scoped to the school — verified by an automated test suite

The order-to-receipt system we built and run in production for Paula Restaurant & Meathouse in Kocaeli: waiters take table-based orders, the kitchen works its own screen, and the bill prints on the thermal printer at the end — with the numbers management needs on the side.

• Table-based ordering: dine-in tables and takeaway, portion sizes, and order transfer between tables
• Kitchen screen: order states from waiting to ready, with preparation-time estimates
• Thermal receipts: 80 mm printer-friendly bills, ready at the table
• Money in view: revenue and daily breakdowns, product and table sales, expenses and income–expense balance
• AI reports: occupancy, table dwell time and hourly/daily trends from your own data

Every screen in every branch, managed from one dashboard. A small agent inside the branch connects outward to the cloud, so there is nothing to configure on the customer's router — and match days stop meaning phone calls to the shop.

• Zero network setup: the agent opens an outbound connection; no port forwarding, no VPN, no router changes
• Auto-discovery: scans the branch network and recognises Enigma2 receivers and Android TV boxes
• Virtual remote: full per-device remote control from the browser, including channel zap
• Match-day ready: a daily fixture list with tournament and country filters, mapped to the channels that show them
• Per-branch security: each branch authenticates with its own token — no shared secrets

The platform we run our own homes on: two sites, 90+ devices, one panel. Energy, pool, climate, cameras and the network itself — monitored, logged and controlled in one place, without handing your home to someone else's cloud.

• Whole-home view: energy, pool, climate and network health across multiple sites in one panel
• Network discovery: finds and inventories every device on the network
• Camera archive without cloud: pulls SD-card recordings from cameras on schedule, into your own storage
• Vendor ecosystems respected: works on top of Home Assistant, Omada and the vendors' own apps rather than replacing them
• Long-term telemetry: every device logged every 5 minutes and kept for over a year — trends, not snapshots

A marketplace where advertisers run campaigns on physical screens in real shops. Every playback is measured and auditable, and revenue is split between Seenvio and the shop owner through a double-entry ledger — no estimates, no trust-me reporting.

• Three sides, one platform: advertiser campaigns, shop-owner screens and the operator portal, with a public landing and demo
• Proof of play: a screen player reports each playback; an auditor app verifies it on site
• Money that adds up: double-entry ledger for campaign spend, shop payouts and platform share
• Cloud-native: NestJS API with PostgreSQL, Redis and S3; static Next.js frontends on Cloudflare

Built for one person running many things at once — products, client engagements, infrastructure work, side projects. PRMon answers one question well: where is everything right now, and what needs my attention? Deliberately not Jira.

• One screen: every project with its state, next step and blockers, without boards, sprints or ceremony
• Attention first: what is stale, what is waiting on someone and what is due surfaces on top
• Light to run: PHP + MariaDB behind Google sign-in; one small container, no SaaS lock-in

Smaller products with the same engineering standards: native where it matters, no tracking, published under our own developer accounts on the App Store and beyond.