Shared evidence cases, audited per investigator.
EMP Intake Teams brings the Workstation integrity model to PostgreSQL workspaces you host, with role scoped access through an audited Workspace API. Pilot planned for 2027. EMP Intake Teams is the multi-user shared case version for customer controlled infrastructure.
Not ready to wait for the Teams pilot?
Run EMP Intake WS on each investigator’s workstation today. The same workflow applies to both the Workstation and Teams editions, so there is nothing to relearn.
You can start with WS today and discuss a move to Teams during pilot planning.
- Deploy EMP Intake Workstation on the investigators’ workstations.
- Run cases through the integrity model: hashes, preserved originals, audit log, export packages on the standalone version today.
- Apply to the Teams pilot below; when the workspace lands we will let you know.
Where EMP Teams is planned to run.
Whatever the deployment shape, one rule: your data stays on your machines. Container and orchestration choice, identity integration, and isolated-network licensing get scoped to your environment when the pilot starts.
Solo workstation
Stack: Single-workstation PostgreSQL for a solo investigator trying the Teams workflow before standing up a server.
Use: Investigators graduating from EMP Workstation into the Teams model without server overhead.
LAN
Stack: A PostgreSQL workspace on a server inside your LAN. Investigators connect through the Workspace API, which checks permissions and records supported case and evidence actions.
Use: Small forensic labs, single site corporate security teams, in-house legal investigations.
On-prem · multi-site (planned)
Stack: PostgreSQL on dedicated infrastructure, with planned OIDC / SSO for identity.
Use: Multi-region corporate security, multi-building campus security, regional DFIR practices.
Private cloud (planned)
Stack: PostgreSQL via a customer-managed cloud database: Azure Database for PostgreSQL, AWS RDS, GCP Cloud SQL, or equivalent.
Use: Healthcare teams with a HIPAA aware posture, financial firms, government contractors.
Pilot testers get a joint architecture review with the founders, security questionnaire included, in your format. Bring your constraints. We scope the deployment around them.
Apply to be a pilot tester →The same workspace your investigators already use.
Teams shares the EMP product surface, so investigators don’t learn a new tool. What changes: where the data lives (your PostgreSQL through the Workspace API, not local SQLite), who can see each case (role-scoped at the data layer), and how exports get attributed (per-investigator, per-role).
What scales up when one investigator becomes a team.
New to the integrity model? Start at EMP Intake Workstation. Nothing in that record changes on the way up. A reviewer can recompute it exactly as they would from any PC.
Who Teams is built for.
The team-scale segments we’re building toward first. Forensics and DFIR practices fit the same model. See the deployment modes above.
Corporate security
Internal investigations, theft, and policy violations across a multi-investigator caseload.
Loss prevention
Retail and supply chain investigations: high volume, with an evidence package per incident.
Campus security
University and college teams, with cross jurisdiction handoffs to law enforcement.
Healthcare security
Workplace violence, diversion, and patient safety cases with strict access scoping.
Questions about the pilot
What is EMP Intake Teams?
Multi-user evidence management you run on infrastructure you control: LAN, on-prem, private cloud, or a cloud database you manage. It builds on the EMP Intake WS integrity model (SHA-256 hashing at intake, preserved originals, a continuous audit trail) and adds concurrent multi-user attribution and role-based access through a Workspace API. The NIST SP 800-86 / 800-101 alignment carries forward from EMP WS as a design target, not a certification. The 800-101 alignment covers handling and exporting mobile-device evidence acquired elsewhere, not on-device extraction.
What infrastructure does EMP Teams run on?
PostgreSQL. The Teams build uses a packaged PostgreSQL runtime and deploys on infrastructure you manage. The app talks to that database through a Workspace API, so a client app can only do what the API allows. The API records supported case and evidence actions with the acting user and time, not every read or click. Direct database or infrastructure access on hardware you control is your own responsibility to govern. Container and orchestration choice is scoped to your environment, since requirements vary a lot from one customer to the next.
Will EMP Teams run on-premise or air-gapped?
On-premise, yes: it runs inside a network you control, on your own PostgreSQL. Fully air-gapped, not yet. The same three categories of egress as EMP WS apply: license activation or validation, update checks when enabled, and map requests for the incident map, which go to a Falcrex-controlled map delivery service using Cloudflare infrastructure and carry standard connection information and the technical map-resource request, never pin or scene data. License activation and map display still need internet today; file-based offline activation is available on request for disconnected paid workstations, and offline or self-hosted map options are scoped per pilot. Bring your networking and constraints to the pilot conversation and we scope around them.
How does role-based access work?
Teams checks case access and supported actions through the Workspace API. Identity integration and deployment requirements are scoped during pilot planning.
How do EMP Workstation and EMP Teams inter-operate?
WS can produce an export package for review and handoff. Moving cases into Teams needs to be confirmed during pilot planning; do not assume automatic case migration.
What does the pilot cost, and what do you ask in return?
Pilot pricing and deployment scope are agreed directly with each pilot organization, in exchange for structured feedback, workflow validation, and deployment learning. No public Teams price is published yet. If your procurement process cannot live with that, wait for general availability. We will tell you straight if it is not a fit.
We will be looking for a few small teams for the pilot trial
Onboarding direct from the founders. A joint architecture review on your infrastructure. Straight answers about what works and what doesn’t. Pilot terms are agreed with each organization.