Sinacluster: The Investigation Data Platform

Sinabis's centralised data analysis platform for investigations that cannot compromise on data sovereignty.

Data sovereignty is no longer a niche compliance question. For European organisations; especially those in regulated industries, government, or handling sensitive client data; it has become a foundational requirement. GDPR, NIS2, the CLOUD Act, and the ongoing tension between US and EU legal frameworks have made one thing clear: where your data physically lives determines who can access it, and under whose laws.

Investigations amplify this problem. The data being analysed in a legal, regulatory, or forensic investigation is often the most sensitive material an organisation holds: client communications, financial records, security logs, evidence relevant to court proceedings. Losing sovereignty over that data is not just a compliance risk; it can compromise the investigation itself.

Sinacluster is Sinabis's answer. It is a centralised data analysis platform designed so that the powerful analytical capabilities of modern eDiscovery and forensic tools can be applied without ever giving up control over where the data lives or who accesses it. This piece walks through what Sinacluster is, what it does, three specialised use cases where sovereignty matters most, how it fits with the rest of the Sinabis product family, and where it can be deployed.

I. What Sinacluster Is

Sinacluster is the environment where investigations actually happen. Its defining feature is that investigators upload and process their own data directly within Sinacluster, accessing tools like Sinabis Inspector, Sinabis Assistant, and the Sinabis Dashboard through a secure VPN connection into the environment. Without Sinacluster, data preparation and processing take place at Sinabis's own location, investigators then receive laptops with the required software preinstalled, along with their data.

What distinguishes it from general-purpose data platforms is its design around three principles:

1) Sovereignty by architecture: Sinacluster can be deployed entirely within your infrastructure: on-premise, in a private cloud you control, or in a hybrid model. The platform is built for these deployment models rather than ported to them as an afterthought.

2) AI-assisted, not third-party-dependent: The AI capabilities that power categorisation, semantic search, and pattern detection run inside your environment. No queries leave your infrastructure to be processed by external cloud AI providers.

3) Evidentiary integrity by design: Audit trails, chain of custody, and controlled access are integrated from day one, satisfying both the sovereignty requirements of European regulators and the evidentiary standards of legal proceedings.

In short, Sinacluster is what an investigation platform looks like when data sovereignty is treated as a design principle rather than a compliance checkbox.

Every investigation is a data problem. And in Europe, every data problem is a sovereignty problem.

II. What Sinacluster Actually Does

The platform's core capabilities:

1. Data aggregation from mixed sources: Emails, documents, database dumps, log files, chat archives, image files, all ingested into a single searchable environment. What used to take weeks of manual collation happens in hours.
2. AI-driven categorisation: The platform categorises documents by type, subject matter, and relevance to the investigation. A month of paralegal work becomes minutes.
3. Keyword and semantic search: The platform understands context and can surface documents relevant to a concept even when the specific search terms don't appear in the text.
4. Pattern and anomaly detection: Identifies unusual transactions, communication patterns, or data-access behaviours that human reviewers would miss in datasets of this size.
5. Timeline reconstruction: Assembles a chronological view of what happened across the aggregated data, which is critical for understanding the sequence of events in fraud cases, compliance breaches, or cyber incidents.
6. Audit trails and chain of custody: Every action inside the platform is logged. Who accessed what data, when, and what analysis was performed, meeting evidentiary standards for legal proceedings.

III. Three Use Cases Where Sovereignty Matters Most

Sinacluster is deployed across a range of investigation scenarios. Three use cases illustrate how the platform delivers both investigative capability and data sovereignty at the same time.

Use Case 1: Electoral Interference Investigation

A regional election commission suspects that vote-tallying systems in one district have been tampered with in the weeks before an election. Investigators must trace what happened across an email archive, an accounting-system export, and a CRM snapshot, data that includes personal information on election officials, campaign correspondence, and public-sector financial records. The evidence must be preserved to a standard that will hold up under judicial review, and the investigation itself cannot leak into the news cycle before the commission is ready to speak publicly.

With Sinacluster deployed inside the commission's own infrastructure, forensic analysis of the extracted evidence happens on hardware the commission controls. Investigators correlate the timeline of events across the mail archive, the accounting exports, and the CRM data without any of the data ever leaving the building. Every action is logged and audit-trailed for eventual judicial review.

Sovereignty outcome: State-sensitive election-integrity evidence never leaves the commission's infrastructure.

Use Case 2: Cross-Border Art Trafficking Investigation

An organised art theft ring has been operating across multiple European jurisdictions for years, moving stolen works through a network of galleries, private buyers, and shell companies. Investigators must trace ownership across dozens of transactions, review gallery correspondence and financial records spanning several countries, and correlate image records with insurance claims and stolen-art registries. The evidence combines personal data on collectors, sensitive commercial records from participating galleries, and information from national police databases, all subject to varying national data-protection regimes.

With Sinacluster deployed in a controlled environment inside the lead investigator's jurisdiction, evidence from each source is aggregated and analysed without moving data across borders in ways that would expose it to third-country jurisdiction. Investigators reconstruct the trafficking timeline from gallery records, financial exports, and image databases. The evidentiary chain stays under a single, verifiable legal framework.

Sovereignty outcome: Investigation-critical data stays under one legal framework. No cross-border transfer risk.

Use Case 3: HinSchG Whistleblower Investigation

A German mid-market firm receives a whistleblower complaint under the Hinweisgeberschutzgesetz (HinSchG) alleging serious misconduct within one of its business units. Compliance officers must investigate discreetly, reviewing internal communications, expense records, and system access logs while protecting the whistleblower's identity as the law requires. Routing this material through a cloud-hosted investigation platform would expose both the whistleblower's identity and everyone named in the complaint to a third-party environment the firm does not fully control.With Sinacluster deployed on-premise, the investigation runs entirely inside the firm's own infrastructure. The whistleblower's identity, everyone named in the complaint, and the sensitivity of the misconduct claims all stay within the firm's control. Findings are produced with a full evidentiary chain, ready for any subsequent legal or regulatory step.

Sovereignty outcome: Whistleblower identity stays protected. Investigation stays inside German jurisdiction.

The strongest investigation platform is the one that doesn't force you to trade sovereignty for capability.

IV. How Sinacluster Fits With the Rest of Sinabis

Sinacluster does not sit alongside the rest of the Sinabis product family. It contains most of it, is fed by some of it, and is complemented by the rest.

▸ Inside Sinacluster: The Sinabis software toolset. Three tools, each with a distinct role:

1. Sinabis Dashboard: for uploading evidence, which is then processed entirely within the Sinacluster environment.
2. Sinabis Inspector: for evidence inspection, now with its own built-in AI so investigators can chat directly with the evidence.
3. Sinabis Assistant: a dedicated offline AI chat, for organisations that want a private AI conversation running inside the same sovereign environment.

Investigators reach them through a single secure VPN connection to their own dedicated network area.

▸ Feeding Sinacluster: The forensic hardware from Sinabis Analytics. Write-blockers and secure extraction devices capture evidence at the source, preserving the chain of custody as it moves into the analytical environment. Sinabis Analytics' SATA write-blocker is independently NIST-tested.

▸ Complementing Sinacluster: Sinabox. Where Sinacluster is the central sovereign environment hosted in Sinabis's own data centre in Germany and accessed via secure VPN, Sinabox is the fully offline alternative, for cases where data must never leave the client's own network.

The result is one integrated workflow rather than a bundle of separate products: hardware for extraction, an environment for analysis, software tools inside that environment, and human expertise driving the cases. Every hand-off happens inside the sovereignty perimeter.

V. Deployment and Compliance

Sinacluster runs in Sinabis's own data centre in Germany, operated to full DSGVO compliance, and independently penetration-tested by SySS.

Clients access it through a secure VPN connection that opens into their own dedicated network area inside the Sinacluster environment. Every session is:

▸ Certificate-verified - both sender and receiver authenticated

▸ Encrypted end-to-end, in transit and at rest

▸ Firewall-protected against any unauthorised network path

▸ Fully logged, revision-secure, and auditable

For clients whose data cannot leave their own network at all, offers a fully offline alternative, the same class of AI, the same evidentiary standards, but running entirely inside the client's own infrastructure.

Whichever route a client takes, the compliance foundation is the same:

▸ All data stored and processed inside the European Economic Area

▸ GDPR (DSGVO) aligned from ingestion to export

▸ Need-to-know access controls, every access logged

▸ Metadata preserved and every processing step documented: evidence remains court-defensible under German and EU legal standards

How Sinabis Approaches This

Sinacluster exists because European organisations are increasingly caught between two forces: the need for modern, AI-powered investigation capabilities, and the requirement to maintain sovereignty over their data. Most vendors ask you to choose. Sinabis's position is that this is a false choice.

The design goal for Sinacluster is that data sovereignty is treated as an architectural principle, not a deployment option. Every capability: aggregation, AI analysis, semantic search, evidentiary chain, is built so it can run inside your environment, on your terms, under your jurisdiction.

For organisations whose investigative workload cannot be sent to a public cloud, and whose data cannot leave their control, Sinacluster is the investigation platform designed for the reality of that constraint.

Data sovereignty isn’t the compromise. It’s the point.

→ Try the Sinacluster demo: sinacluster.com

Sinabis Analytics GmbH · X64 Forensic GmbH · X64 Systems GmbH