What Nexus Prism does
A self-hosted intelligence fusion platform. Every source lands in one database with a knowledge graph on top, and comes out as analyst-ready, explainable product.
Financial intelligence
Tracing across twelve-plus blockchains on nodes we operate. Address clustering, co-spend analysis, peel-chain detection. Mixer, atomic-swap and HTLC detection. Privacy-coin boundary attribution for Monero and Zcash. Cross-chain bridge resolution. Off-ramp attribution.
Sanctions screening against OFAC, UN, EU and UK lists. Explainable AML risk scores. FATF and FinCEN typology alerts across 49 enabled detectors. SAR narratives that cite their rows.
Designated addresses traced through our own corpus
Screening tells you an address is on a list. It does not tell you where the money went. We take the designated addresses themselves and walk them against the chain data on our own nodes: 497 sanctioned Bitcoin addresses resolving to 121,879 distinct transactions, spanning blocks 219,866 to 967,961.
Every transaction records which designated address it came from and how many hops away it sits, so a finding can be walked back to its seed rather than asserted. The sweep is bounded by hop depth, transaction count and block count, and a run that hits a bound is recorded as partial — because a trace that stopped is a different thing from a trace that finished.
Historical ingest is still filling in behind this: deep-history transactions resolve into the transaction-level side-car as the backfill proceeds, and the proportion that has landed is reported rather than rounded up.
Our own error rate, including when we cannot state it
We mine some coins ourselves. Those coins have no history before our own coinbase, so anything our detectors say about them is a false positive by construction — a control group nobody who merely licenses data can manufacture.
The current cohort is five distinct addresses, with zero flagged. Five is too small to support a published rate: the 95% upper bound at that sample size is 60%, so the benchmark records the measurement and refuses to publish a figure, rather than advertising a clean-sounding zero the sample cannot carry. The number will appear here when the sample can support it.
We would rather show you the refusal than a rate that does not survive cross-examination.
You can see a slice of this working before you talk to us — three of our public datasets are drawn straight from it.
Dark web and anonymity networks
Tor hidden-service collection through an isolated hardened gateway. I2P eepsite collection and LeaseSet forensics. Freenet — a third network almost nobody covers. Operator fingerprinting across domain migrations. Cross-network correlation. Marketplace intelligence with on-chain attribution. Ransomware leak-site monitoring with payment flows attached.
Analysis and delivery
Around a hundred dashboards. Six ordered evidence chains where each step names the artifact you carry forward, validated by our test suite so a broken path fails the build. Knowledge-graph traversal from scraped content to wallet to sanctioned entity. Plain-English query. PDF briefs with row-level citations.
STIX 2.1 and TAXII 2.1 into the stack you already run. REST API, webhooks and a Python SDK.
Eight export formats, enumerated by the API itself rather than by a document that can go stale: STIX 2.1, MISP event JSON, CSV, JSON, Parquet for your analytics pipeline, DOCX when the deliverable has to be edited by someone who will never open a dashboard, and KML / KMZ when it has to be opened in Google Earth or a GIS. Every export is policy-gated, classification stamped and recorded in a hash-chained audit trail, whatever the format.
Cases export as an evidence package — a single archive carrying the
rendered brief, the underlying rows, a MANIFEST.sha256 and a chain-of-custody
record built from that audit trail, so the recipient can verify what they were
given without taking our word for it.
Your data, fused
Bring-Your-Own-Feed. Versioned data contracts that validate before load and fail closed on schema drift. Onboarding your internal data is a file drop and a validate command, not a six-month professional-services engagement.
Deployment
| Mode | What it means |
|---|---|
| Hosted seats | We run it, you log in |
| Data feed | Scheduled delivery into your stack, no seats required |
| On-premises | Signed container images inside your network, licence-key entitlements |
| Air-gapped appliance | For environments with no egress at all |
If your data cannot leave your building, it does not have to.