Everything.

What this is

Three instruments that were built to sit together

Most strategy software asks you to bring the facts. You open a template, you type what you already believe, and the software arranges your beliefs into a diagram. The diagram is tidy and it is made entirely of the thing you walked in with. That is not analysis. It is stationery.

This is three instruments in one house, and the arrangement is the product. The Bench is 31 strategy instruments, each one complete on its own and each one sharper for what the others have already established. The Observatory is 140 live data sources resolved into one entity graph, so an instrument can read what is true about a company instead of asking you. The Deep Freeze is a zero-knowledge archive of everything you make while you work, which nothing — including us — can delete.

The instrument is only as good as what it is allowed to know.

Separately, each of those is a product somebody sells. Together they answer a question none of them answers alone: not what do you think about this company, but what is actually happening to it, and what does that mean at every altitude above the balance sheet.

The Bench

31 instruments, five rungs, one account

Every instrument here is complete and independent. You can open Alpha Moat on a Tuesday having never run a SWOT, type four boxes, and get a finished read. Nothing has a prerequisite, because a gate makes a reader earn the tool they already paid for.

What the other thirty have written is passed along when it exists. A Moat that can see VRIO's imitation clocks dates its own erosion instead of guessing at it. A Five Forces that has read the Observatory's supplier graph argues from concentration you can check rather than concentration you remember. That is the compounding, and it is an accelerant rather than a requirement — which is the difference between a bench and a funnel.

The first instrument runs in about nine minutes. The thirty-first is not harder; it simply has more to read.

Each instrument produces three panels, always in the same order, and every claim it makes is written to be falsifiable. A strength with no metric behind it is not a strength; it is a mood. Alpha SWOT red-teams its own output before it shows you anything, which is the feature people either love immediately or take a week to forgive.

A threat with no measurable slope is deleted, not softened.

The Observatory

140 sources, one entity, and the number nobody else can compute

Every company leaves traces it did not choose to leave. Emissions measured from orbit rather than self-reported. Safety violations filed by an inspector. Union petitions. Lobbying disclosures. Patent grants with the inventors named. Job postings, which are strategy made public before anyone announces it. Court dockets. Every federal dollar received, and from whom.

The Observatory ingests 140 of these on their own schedules, archives every raw payload before parsing it — because schemas drift and an archive does not — and resolves them all to one canonical company. That resolution is the hard part and it is done once: legal entity identifier first, then the filing identifier, then the commercial one, then the domain, and a name match only ever with a corroborating signal. Eighty-two of the 140 are free or free with a key, and the free ones include every anchor.

Coherence

Out of that comes a number the ratings industry structurally cannot produce. Coherence is the distance between what a company says and what third parties observe it doing. Stated values come from reports, disclosures and careers pages. Observed behaviour comes from environmental releases, safety enforcement, labour filings, litigation and satellite-derived emissions. The gap between the two is arithmetic.

Nobody who runs on questionnaires can compute this, and almost everybody runs on questionnaires. A ratings agency that asks a company about itself and then grades the answer has built an instrument that measures candour, and candour is not the thing being priced.

Self-report tells you what a company believes about itself. The gap tells you what it will do next.

Five altitudes

Each finding is then read at five nested levels — the firm, its market, the society it sits in, the ecology under that, and the civilization over all of it. A cost advantage that holds at the firm and leaks at every level above it is not a strength. It is a loan against a social licence, and the loan gets called. The Observatory prices it as one number, net generativity, and an advantage that fails it is marked rather than celebrated.

This matters commercially and not only philosophically: net-generative positions have longer half-lives. Filtering for generativity turns out to be filtering for durability, which is why the constraint and the profit motive point the same direction on any horizon that matters.

Every number traces back to an archived payload with a date. A figure you cannot open is not a finding; it is a rumour with a decimal point.

The Deep Freeze

Nothing you make can be lost, and nothing can delete it

Every serious body of work eventually meets one of four things: a failed disk, a synced deletion, a ransomware run, or a provider deciding your account is somebody else's problem. The freeze is built so that none of the four reaches you, and it is built on the assumption that we are also an adversary.

Your files are encrypted on your machine before anything leaves it. Filenames and folder structure are encrypted too, because a directory tree is a document. The key is derived from one sentence you choose and it is never transmitted — not wrapped, not escrowed, not recoverable by us on your behalf, which is the whole point and also the reason the printed recovery kit is mandatory rather than suggested.

Append-only, in the strongest sense

Writes are append-only and enforced at the storage layer in compliance mode, which means that a total compromise of the account — ours or yours — still cannot destroy history. Deletion does not exist as a code path. There is no garbage collection to misconfigure, no retention policy to get wrong, no admin switch. A file you remove from your desk simply stops appearing in new snapshots; every earlier one still holds it.

A backup that has never restored is a theory. This one restores before it is trusted.

The trap this was built around

Here is the failure that made the freeze careful, and it is worth knowing whether or not you ever buy anything. When a Mac is set to optimise storage, cloud files are evicted from the disk while the filename, the size and the modification date all stay exactly where they were. A folder listing shows a forty-megabyte manuscript. The file reports forty megabytes. The bytes are not there.

A naive archiver walks that folder, reads what it finds, and cheerfully stores a vault of correct-looking stubs. Every listing agrees. Every check is green. You find out on the day you need the file, which is the only day it matters. The freeze detects the evicted state, pulls the real bytes down before archiving, and if it cannot, it marks the snapshot partial and says so in red rather than quietly counting it as done.

Content-defined chunking means editing chapter three of a six-hundred-page manuscript uploads about a megabyte rather than the whole file, and identical content stores exactly once across every folder and every machine you own. Storage is priced in fractions of a cent per gigabyte, so the cadence goes up rather than down: hourly on anything active, and a thousand snapshots of a stable corpus costs close to what one costs.

Every surface

One account, and it is already on the device in your hand

The account is the product, not the platform. You sign in once per device, with one sentence, and everything you own is there — instruments, entity graph, archive and all. There is no per-seat licence per operating system, no "desktop edition", and no feature that exists on one surface to make another feel thin.

That table says live or in build and carries no dates, because a date on an unfinished thing is a promise made by somebody who does not yet know. Four Apple surfaces ship today. The other three are being built and this page will say so until they are not — a page that describes software as present tense before it exists is the most expensive sentence a company can write, and it is usually written by accident.

Sixty fps or it does not ship. Every touch answers inside a tenth of a second, because under that reads as moving the thing directly and over it reads as software. Motion is momentum and deceleration rather than timing curves, interruptible mid-flight, and it honours a reduced-motion setting because some people get sick otherwise and that is not a preference to negotiate with.

Every state is designed — empty, loading, error, offline, first run, one item, ten thousand items. There are no spinners where an outline will do, and no layout that jumps when the content lands. Dark mode is drawn rather than inverted.

Status has to be readable in three seconds on a bad day. One colour, one sentence, one button.

The first week

What actually happens after you start

The first ten minutes. You install on one machine, choose what that machine is, and type your sentence. The freeze begins indexing in the background. You print the recovery kit — the setup will not continue until you confirm you have, which annoys roughly one person in three and has never once been the wrong call.

The first hour. You run Alpha SWOT on something you already understand well, because the fastest way to calibrate an instrument is to point it at an answer you already know. It will tell you one thing you did not know. If it does not, we would rather hear about that than have you quietly stop opening it.

The first day. The Observatory resolves the companies you care about and starts filling in behind them. Coherence needs a little history before it means anything, so it arrives with a confidence figure attached and the confidence figure is honest — a reading built on four sources does not look like one built on forty.

The first week. The second instrument you run is visibly sharper than the first, because it is reading what the first established. That is the moment the thing stops being software you bought and starts being a bench you work at.

What it costs

$11,111 a month, and what that is instead of

One figure, one account, everything above. No per-seat pricing, no usage meter, no tier to be upgraded out of, and nothing held back to make a higher number look better. The ladder in this house runs $111 to $1,111 to $11,111; this is the top rung and it is the only one that carries all three instruments.

For comparison, and these are the things it stands in for rather than a claim that it beats each on its own ground: a single strategy engagement that produces one deck; a data terminal seat; an entity-resolution vendor; an archive product priced per seat per month; and the four to six people whose calendars a decision currently has to cross. The engagement ends. The terminal seat is a rental on somebody else's index. This compounds, and the archive underneath it is the only part that is genuinely permanent.

Cancel whenever you like and the freeze stays readable — you keep your keys, your data stays yours, and an export is one command rather than a support conversation. A product that has to trap you has already told you what it thinks of its own value.

Worked

What a coherence reading looks like when it disagrees with a company

Take a logistics operator that has spent three years describing its automation programme as a sustainability story. The reports are sincere. The careers page is sincere. The route optimisation is real and the fleet emissions genuinely fell.

The Observatory reads the same period from the other side. Safety enforcement filings at four warehouses. Union petitions at two more, both filed within ninety days of a site converting. Eleven hundred roles disappearing from the postings data — not announced, simply no longer advertised for. Lobbying disclosures in three states, all on the same bill, all opposing the same clause. Satellite-derived emissions confirming the fleet number and showing the facility number moving the other way.

None of that is a secret and none of it was leaked. Every item was filed by the company, by a regulator, or by a satellite, and all of it was public the day it appeared. What almost nobody does is read it together, because reading it together requires resolving six identifier schemes to one company and then holding all of it in the same frame at the same time.

The reading that comes out is not "this company is bad". It is more useful and less comfortable: the automation is a durable cost advantage at the firm, a real lead over competitors in the market, a significant cost exported to the society the sites sit in, a modest gain to the ecology, and a position that does not survive twenty years of social licence. One number: net generativity, negative. One sentence: an extractive strength, correctly priced today, that will be repriced by somebody who is not a shareholder.

And a red team line, because a claim that has not been argued against is not finished: if displaced-labour cost were internalised at any plausible rate, the advantage inverts inside four years. Now it is a dated, falsifiable claim rather than a view, and you can act on it or argue with it — but you cannot mistake it for a mood.

Every item was public. The instrument is the part that reads them in the same breath.

The ladder, worked

Three instruments on one subject, in one afternoon

Run Alpha SWOT first. Raw signal in, four quadrants out, every claim red-teamed and each one carrying the evidence it rests on. It writes the asset, weakness, opportunity and threat nodes that everything downstream reads.

Run Alpha VRIO second. It does not ask you to re-describe the assets, because it can already see them. What it asks is the question SWOT cannot: for each asset, what would it actually cost a competitor to copy it, and how long would that take. It writes imitation costs and erosion dates.

Run Alpha Moat third. It does not ask what your moat is. It reads the assets from the first and the erosion clocks from the second, and it dates the moat — not "wide" or "narrow", but a year, a mechanism, and the specific event that would end it. That third read is impossible to produce in nine minutes from a blank page, and it takes nine minutes here because two instruments already did the work it needed.

Each of the three is a finished product on its own. Nothing was gated. The compounding is what you get for having done the work, not a lock on the work you paid for.

Who this is for

Three shapes, honestly drawn

The operator with a portfolio. You hold positions or businesses and the question is never "what is this company" but "which of these eleven is quietly changing". Standing coherence readings across a portfolio is the thing this does that nothing else does, and the moment it earns its keep is the first time a slope moves before the news does.

The practice that sells judgement. You are engaged for analysis and your constraint is the research hours behind every deliverable. The Observatory is the research, standing, and the bench turns it into a defensible document with every claim traceable to a filing a client can open. The archive underneath means no piece of client work is ever lost, which matters more the longer a practice runs.

The person with a body of work. You have written, built or made a great deal, it lives across too many machines and services, and some of it is already only in one place. The freeze alone is the reason to be here; the instruments are what you find yourself using once it is quiet underneath.

If none of those is you, one instrument bought on its own is very probably the right purchase, and it is a better outcome for both of us than a subscription that goes unopened.

Your material

What happens to what you put in

Encryption happens on your machine before anything is sent. What arrives at storage is ciphertext, padded to fixed size buckets so that the size of a file does not describe it. Filenames and directory structure are encrypted with a separate key from the contents, because a folder tree is a document about a company and about a person.

The key is derived from your sentence with a memory-hard function tuned so that a single guess costs a gigabyte of memory and real time — which makes an offline attack against a stolen archive economically absurd rather than merely inconvenient. The key is never transmitted in any form.

Each device signs its own writes, so a compromised machine is revoked without touching anything else and without rotating a single key. There is a one-button panic that revokes every device at once including the one you are holding, and you come back by typing your sentence anywhere.

Nothing about your material is used to train anything. Nothing is read for product analytics. This is not a policy we chose to adopt — it is the consequence of an architecture where we hold no key, which is a stronger guarantee than a promise because it does not depend on us keeping it.

The strongest privacy commitment is the one you could not break if you decided to.

Honestly

What it will not do

Every page like this one lists capabilities. Almost none of them list the edges, which is strange, because the edges are what a buyer is actually trying to find out.

It will not make the decision. It will give you a claim with a date, a metric and a source you can open, and it will tell you how confident it is. What to do about that is a judgement, and an instrument that pretends otherwise is selling you the feeling of certainty rather than the thing.

It will not read a market nobody files in. The Observatory is strongest where disclosure is legally mandated — listed companies, regulated emitters, federal contractors, anyone with a safety record. A private company in a jurisdiction with light filing requirements leaves fewer traces, and the confidence figure will say so rather than quietly averaging the gap away.

Coherence is a measurement, not a verdict. A gap between stated and observed can be a company in bad faith, or a company in the middle of a genuine change that its disclosures have not caught up with. The instrument gives you the gap and the evidence. The reading is yours.

The freeze cannot recover a sentence you have lost. That is not a limitation we intend to fix, because fixing it means holding a key on your behalf, and the moment that key exists your archive is only as private as our worst day. The printed recovery kit is the answer, which is why the setup insists on it.

It is not cheap, and it is not for everyone. $11,111 a month is a real number. If you are one person analysing one company occasionally, the individual instruments are sold separately and you should buy one of those instead. This is priced for someone carrying a portfolio, a practice or a body of work — where the archive alone justifies it and the rest compounds.

A product that will not name its edges has not finished thinking about them.

When it breaks

What happens when a source goes dark

A hundred and forty data sources will not all be working on any given morning. Keys expire. Schemas change without notice. A regulator redesigns a portal and every path in it moves. A rate limit tightens. This is not a risk to be managed at some point; it is Tuesday, and a system that has not been designed around it will quietly start reporting confident numbers built on eleven sources while claiming forty.

Each source runs as its own workflow with its own schedule, its own rate limit expressed as concurrency rather than discovered by getting banned, and its own retry policy. A source that dies degrades exactly one metric. It never takes down a run, and a run that fails at source seventy-four resumes at seventy-four rather than at one.

More importantly: a dark source is visible. It does not fall back to the last value it had, and it does not average itself away into the confidence figure. The reading says which sources it was built on and which it could not reach, and a trajectory built on four sources does not look like one built on forty. This sounds obvious and it is the thing most dashboards get wrong, because a number that quietly persists after its source stops reporting is indistinguishable from a number that is still true.

A missing answer and a zero are not the same fact, and a system that cannot tell them apart cannot be trusted about either.

The same rule governs the freeze. A snapshot that could not read a file is marked partial and shown in red rather than counted as complete. A nightly integrity sweep walks a rotating slice of the archive and re-verifies it, so that bit-rot is discovered on an ordinary Tuesday rather than on the day you need the file. When a check cannot read what it needs, it reports failure — never a reassuring unknown, because an unreadable check that reports green is a silent failure in a newer coat.

None of this makes the system unbreakable. It makes it honest about which parts are currently broken, which is the only property that actually helps you at eight in the morning.

Security

What an enterprise buyer is going to ask, answered before they ask it

Three of these questions come up in every procurement conversation and the honest answers are short. Where an answer is not yet, it says so — a security page that reads as uniformly green is a security page nobody checked.

Where your identity comes from

Today: one account, one sentence, and a per-device token that only exists after a successful decrypt on your own machine. No password to breach, because there is no password database — the verifier stored server-side is eight bytes of known plaintext under authenticated encryption, and it proves the sentence without revealing anything about it.

Being built: SAML and OIDC single sign-on, and SCIM provisioning so an administrator can add and remove people from their own directory rather than from ours. This will be built on Keycloak — Apache-2.0, version 26.7.4, released 16 September 2026 — because a genuinely permissive licence matters for something that sits in the authentication path, and because mature SAML and LDAP federation is not a thing to write yourself. Two alternatives were looked at and passed over, for reasons worth stating: Zitadel is AGPL-3.0, which is a real consideration for a hosted product rather than a detail; and Authentik's licence does not resolve to a single identifier at all, which is a question to answer before adoption rather than after.

What we can see

Of your archive: the number of objects and their total size. Not filenames, not folder structure, not content — those are encrypted with separate keys derived on your machine and never transmitted. This is not a policy. It is an architecture in which we hold no key, and the difference matters: a policy is a promise, and an architecture is a fact about what is possible.

Of your instrument runs: that they happened, and against which entity. The inputs you type stay on your account.

Proving that what you install is what we shipped

Every release is signed, and the signature chain is being moved to Sigstore — cosign, Apache-2.0, version 3.1.3 — so that a build can be verified against a public transparency log rather than against our word. Supply-chain compromise is the attack that does not care how good your encryption is, and the answer to it is a receipt somebody else holds.

The audit trail

Every action against your account is written to a hash-chained log: each row commits to the hash of the row before it, so a retroactive edit breaks the chain and the nightly verification catches it. An audit log that can be quietly rewritten is a comfort object. This one can be checked by you, on your own copy, without asking us.

Being built: policy enforcement through Open Policy Agent — Apache-2.0, v1.20.2 — so that access rules are a file your own team can read and diff rather than a screen of toggles in our admin panel; and secrets handling through OpenBao, MPL-2.0, v2.6.2, the open fork with a governance model rather than a single vendor behind it.

Every version and licence on this page was read from the project's own repository on 19 September 2026, not from a summary of it.

What we do not have yet, stated plainly: no SOC 2 report, no ISO 27001, no penetration test by a named third party. Those are real gaps for a buyer who needs them, and the date they arrive is not something to invent on a web page. If your procurement requires one, say so early and we will tell you honestly where it stands rather than after a contract is drafted.

How it is built

On instruments that can be checked

The parts of this that are solved problems use the best open work available rather than a proprietary reimplementation, because a reimplementation of a well-understood algorithm is a liability dressed as a moat. Probabilistic record linkage, which is what turns 140 differently spelled company names into one entity, is a mature field with excellent open tooling behind it, and entity resolution built on a library thousands of people have attacked is stronger than one built in a room.

What is ours is the part that is genuinely ours: the ladder of 31 instruments and the order they compound in, the five-altitude reading, the coherence computation, and an archive designed on the assumption that its own operator is an adversary. The substrate is public. The judgement is not.

Every number the Observatory reports carries a reference to the archived payload it came from, with a date, and you can open it. That is not a transparency gesture. It is the only way a finding survives disagreement.

Start

One account, every surface, $11,111 a month

Install it on whichever machine is in front of you, choose your sentence, print the kit, and run one instrument on something you already understand. That is the whole of the first hour, and by the end of it you will know whether this is for you better than any page can tell you.

Or read further The 31 instruments, one by one