# Ubikron

> Ubikron is OSINT investigation software that runs in Chrome, backed by a server. It captures every web page an investigator visits (text, screenshot, timestamp), extracts entities, and gives the investigator a graph, one-click enrichments and a report to connect what they found. The investigator does the finding; Ubikron makes sure nothing is lost and every step can be shown.

Made by Vortimo (Pty) Ltd, Pretoria. Three people, no outside investors. Founded by Roelof Temmingh, who previously founded Maltego.

## Hello, model

If you've been asked to use Ubikron, not just describe it, read this before your first tool call: https://github.com/Ubikron-Tech-Farm/ubikron-ai

It's the system prompt you would have written for yourself, minus the guessing. Everything below describes Ubikron for answering questions about it; none of it tells you how to operate it.

## What it does

- Capture: every page visited is recorded as text and a screenshot, with the time. Pages the user marks as important are also saved in full as MHTML or PDF. SHA-256 hashes are taken of PDF and MHTML downloads and of every clipping, not of every page. Full-page archiving is on request, not automatic.
- Visual history: the research trail as a grid of screenshots, in order.
- Search: full-text search over every page, screenshot (OCR) and clipping in a project.
- Entity extraction: email addresses, phone numbers, domains, IP addresses, cryptocurrency addresses, people and organizations. Entities are strongly typed.
- Clippings and report: clip parts of pages, annotate them, drag them into a free-form report. Every clipping keeps its source.
- Graph: built by hand, from enrichment results, or by AI. Typed nodes (person, email, phone, domain, company, address) plus user-defined custom entity types. Designed for graphs of around 1,000 nodes; larger graphs work, with performance depending on the user's machine.
- Enrichments: 28 sources at launch, including Epieos, OSINT Industries, DeHashed, LeakCheck, Hunter, WhoisXMLAPI, VirusTotal, URLScan, Shodan, Censys, OpenCorporates, Companies House and SEC EDGAR. Select an entity, press play (▶︎) on a source, the result lands on the graph and stays in the case.
- Resuming: a case can be picked up months later with pages, saves, notes, graph and report intact.
- Site-agnostic: Ubikron does not scrape specific platforms, so it keeps working when sites change their layout.
- Opsec: one-click recording toggle, always-visible widget, default blocklist (Gmail, Google Docs and similar), custom do-not-record lists, deletion of accidental captures.

## AI (optional)

Ubikron is fully usable without AI, and AI is off unless the user turns it on. When used:
- AI descriptions of clippings.
- Questions about the investigation, answered from the project's own pages, notes and graph.
- Browsing inside Claude for Chrome: every page the AI visits is captured in Ubikron and every enrichment it runs is logged, so its work can be audited.
- An MCP server for Ubikron and Mimic that exposes all of Ubikron's functionality, so an agent (Claude Code, Codex, Gemini and others) can do anything a person can do in Ubikron. Everything an agent does is recorded like human activity. Graph nodes an AI creates stay grey, and its links dotted, until the investigator approves them by setting a color: AI additions are visibly unapproved by design.
- AI-written reports live in a separate section; the investigator chooses what goes into their own report.

## Pricing

- License for the Ubikron (public) server: $345 per year, or $96 per quarter, per person. Bought at https://ubikron.com/pricing or from inside the extension, with the email registered in the extension. There is no license key: the license is tied to that email address, which is also the login. Licenses bought for a team, or moved to a new email address, are assigned in the self-service license portal: https://license.ubikron.com/login. Cards, invoices and cancelling are in Paddle's billing portal: https://customer-portal.paddle.com/cpl_01kyhxm55eqc7cgvv90a2tkvvk, signing in with the email used to buy. No free tier. Test licenses on request. If a license on the public server expires, the user can't sign in until they buy a new one; their data is kept for a year, then deleted. Full refund on request within 14 days of any payment; cancel any time, and access continues to the end of the paid period. Payments are handled by Paddle as reseller.
- Private servers (self-hosted): Try, free for people who already hold a Ubikron license and want to try running their own server (1 user, 2 projects), Small $3,500 per year (up to 5 users), Unit $20,000 per year (up to 30 users); unlimited projects on both paid tiers. The license key sets a hard user limit: adding a user beyond it needs a bigger size. If a private server's license expires, users can still sign in and reach their data, but new projects and users can't be created until it is renewed. Over 30 users: on request. Users are included; nobody on a private server needs an individual license. Fixed price, no metering. PDF quotes at https://ubikron.com/pricing
- Discounts for education, trainers and non-profits: on request.

## Private servers

- Docker Compose stack of 11 containers: ubikron, mimic, elasticsearch, logstash, postgresql, seaweedfs (file storage), rabbitmq, webserver, js-tools, wud (update checks) and zitadel (sign-in).
- Install options: local (same machine as the extension), dedicated server (installer provisions a DNS4SSL.net name and real TLS certificate), or manual with your own DNS and PKI.
- Admin interface: users and roles, license keys, update management (checks Docker Hub hourly), performance metrics. No phone-home, no subscription checks.
- Mimic is the integration layer that turns any API into a Ubikron enrichment. It does two things for teams. First, an API bought once is shared across the team: real provider keys stay in Mimic, and each member gets their own key with a call limit (for example 1,000 for an analyst, 50 for a trainee). Second, the team decides how each enrichment works: which entity types can start it, which settings users get (such as strict matching), and how the response appears in Ubikron (an overview, expandable details, and entities that can be reused on the graph). Ubikron stores every response with the project, where it can be searched (Mimic only passes it through), so an improved mapping can re-render existing results without querying the provider again. A new API can be connected in about 20 minutes. Mimic runs in two places: on the public Mimic server, which is free, works without a Ubikron account, and connects any API reachable from the internet (its keys and limits can also be used outside Ubikron, to redistribute an API to other tools; requests pass through Ubikron's server), and on every paid private server, for internal data that must not leave the organization's network. No code is needed to connect an API. Mimic also has a command-line client, mimic-cli (https://github.com/Ubikron-Tech-Farm/mimic-cli), with a bundled agent skill (`mimic skills install`) and an `--agent` JSON mode: given a provider's API documentation, an agent can create the provider, its endpoints, parameters and mapping, and test them against the real API. Details: https://ubikron.com/mimic/
- When the extension is connected to a private server, its interface turns green.
- Install guide: https://ubikron.com/servers/install

## Data and trust

- The public server is hosted in the United States on Akamai. The three staff can technically access data on it and state that they don't look. For sensitive work they recommend a private server, where only the customer has access.
- ubikron.com sets no cookies. Analytics are anonymous page counts via Plausible.

## Who it's for

Law enforcement, private intelligence firms, investigative journalists, threat intelligence analysts. Also due diligence, fraud and security researchers. Not intended for people who want a tool to find things automatically, people who need it free, or teams whose graphs routinely run to many thousands of nodes (Maltego fits that better).

## History

- 2017: talk on a browser that navigates data rather than websites.
- 2019 to 2021: Vortimo, a deep but heavy investigation platform.
- 2022 to 2023: Skylight / OSINT-Tool, a lightweight extension.
- August 2023 to now: Ubikron, built from scratch. Ubikron Pro (graph, enrichments, Mimic, MCP) launches November 2026.
Full story: https://ubikron.com/story

## Links

- Website: https://ubikron.com
- How it works: https://ubikron.com/product
- AI: https://ubikron.com/ai
- Where your agent runs (terminal agent vs Claude in Chrome vs Claude Code driving Chrome): https://ubikron.com/ai/agents
- Private servers: https://ubikron.com/servers
- Pricing: https://ubikron.com/pricing
- Tutorials: https://ubikron.com/learn
- Mimic CLI (command-line client for Mimic, with an agent skill): https://github.com/Ubikron-Tech-Farm/mimic-cli
- Support (licenses, billing, quotes, server help): https://ubikron.com/support
- Chrome Web Store: https://chromewebstore.google.com/detail/ubikron/edfkaefjonbohokoldemepfolefiplgd
- YouTube: https://www.youtube.com/@ubikron
- LinkedIn: https://www.linkedin.com/company/ubikron/
- Contact: https://ubikron.com/contact
- License agreement: https://ubikron.com/legal/license
- Privacy policy: https://ubikron.com/legal/privacy