Learn the platform.

Creating your account

COLLECTiT! doesn't require a sales call to get started. From the homepage, click Get Started and sign up with your work email.

1. Enter your work email and create a password, then submit the signup form.
2. Check your inbox for a verification link and click it — your account stays limited until email is verified.
3. Set up two-factor authentication. This is required on every account before you can use anything beyond Account Settings — see Two-Factor Authentication below.
4. Once 2FA is active, you're in. The first admin on a new organization automatically becomes its billing owner (see Billing & Subscription).

If you'd rather see the platform walked through first, "Book a Demo" on the homepage sends a request straight to our team.

Creating & managing cases

A case is the container for everything related to one investigation: the evidence collected, notes, the audit trail, and anyone it's shared with.

Creating a case

1. From the Cases tab, click New Case.
2. Give it a name, choose a case type (e.g. HR exfiltration investigation), and — if it relates to a specific device — select the endpoint.
3. Optionally attach a ticket number and the subject user's name for reference.

Case status

Every case is in one of three states, shown as a colored status bar on its card in the Cases list:

• Active — open and in progress.
• Review — collection is done and the case is being reviewed before closing.
• Closed — finished. Evidence retention timers begin counting down from here (you'll get 30- and 7-day warnings by email before anything is affected).

The Cases list shows each case as a card with its evidence count, how many collections have run, and how many completed vs. failed — so you can see a case's health at a glance without opening it.

The Case Dashboard

Opening a case brings up its dashboard: a header with case details, a toolbar of actions, and the evidence browser below. The toolbar is where most of your work happens:

• Collect — starts a new evidence collection (see Evidence Collection).
• Generate Report — opens the report dropdown to export the case as PDF, CSV, or DOCX (see Reports & Exports).
• Share — grants another team member, or someone outside your org, access to this case (see Sharing Cases).
• Notes — the case's running notes, separate from evidence-item notes.
• Timeline — a merged, chronological view of collections and audit events for the case.
• Close Case — marks the case Closed and starts its retention countdown.

Every action taken on a case — collections, exports, tag changes, sharing, status changes — is written to that case's audit log automatically. See Audit Logs & Chain of Custody.

Case scope

Case scope controls what gets collected from a device when you trigger a collection. Today, scope is set per collection as a single category — see Supported Collection Methods for the options available now.

Triggering a collection

Collections are run by the COLLECTiT! agent installed on the target Windows device. Triggering one is a short wizard:

1. Device — pick which enrolled device to collect from.
2. Scope — choose what to collect (see Supported Collection Methods).
3. Review — confirm the device and scope, then start the collection.

The agent runs the collection, hashes every file it captures (both at collection time and again on verification), and uploads the results. Collected items appear in the case's evidence list as they arrive — you don't need to wait for the whole collection to finish before reviewing what's already in. Each item's hash is checked on read, and a mismatch is flagged directly on that item so a broken chain of custody is never silent.

Supported collection methods

The agent currently runs on Windows. When triggering a collection, you choose one of these scopes:

• Documents & Downloads — the right default for most cases: user-created and downloaded files.
• Email Artifacts — local mail store files and cached message data.
• Recent Documents — a fast, low-footprint pull of only recently accessed files.
• Full User Profile — everything in the user's profile. Broad and slow — use it deliberately, not as a default.

Working with collected evidence

The evidence browser on a case's dashboard lists every item collected, with a few ways to narrow it down:

• Categories — a left-hand panel groups evidence by type (Documents, Email, Images, Disk Images, Folders, Other) with a live count per category. Click a category to filter the list; click it again, or "All Evidence," to clear the filter.
• Search — searches filenames and notes as you type.
• Tags — filter by tag (Relevant, Confidential, Reviewed, Flagged, Privileged, or any custom tag your org has added).

Select one or more items with the checkboxes to apply a tag to all of them at once, or to export just that selection instead of the whole case. Click any item to open its detail panel — filename, size, collection date, hash/integrity status, tags, and item-level notes.

Large cases load evidence a page at a time rather than all at once, with a "Load more" control at the bottom of the list — this keeps big collections (thousands of files) from freezing the browser.

Reports & exports

Click Generate Report on a case dashboard to open the report menu:

1. Pick a format — PDF, CSV, or DOCX.
2. Choose what to include: AI Summary (DOCX only — see AI Summary), Notes, and Audit Log. Notes and Audit Log are included by default; uncheck either to leave it out.
3. Click Generate Report. It's greyed out until you've picked a format.

Reports are built in the background — for a large case this can take a little while, and the report opens automatically in a new tab once it's ready rather than making you wait on the page. You can also select specific evidence items first and use Export Selected from the bulk-action bar to report on just that subset instead of the whole case.

AI-generated executive summary

When enabled for your organization, checking AI Summary in the report menu adds an AI-generated executive summary to the top of a DOCX report — a plain-language overview of the case built from its notes, evidence, and audit trail. It has no effect on PDF or CSV exports.

If the checkbox is disabled, this feature hasn't been configured for your environment yet — nothing about your case data changes either way; it's just an optional summary layer on top of the same report.

Audit logs & chain of custody

Every case keeps a full, tamper-evident audit trail: collections started and completed, evidence viewed, tags added or removed, notes added or edited, exports requested, sharing changes, status changes. Open Timeline on a case to see it merged with collection history in one chronological view.

Each audit entry is cryptographically chained to the one before it — every entry's hash incorporates the previous entry's hash, so entries can't be edited or removed after the fact without breaking the chain. This is what "chain of custody verified," shown at the top of every case, refers to. The audit log can be included in any PDF/CSV/DOCX report via the Audit Log checkbox in the report menu.

Sharing a case

Click Share on a case dashboard to grant access to someone else:

• Share with a team member — pick anyone already in your organization; they'll see the case under their own Cases tab.
• Share by email — invite someone outside your organization by email address for view access to this specific case, without giving them a full account on your org.

Every share (and revoke) is written to the case's audit log, so it's always clear who had access and when.

Account & team management

Roles

• Admin — full access, manages team members and org settings.
• Investigator — runs collections, manages cases and evidence.
• Legal Reviewer — case and evidence access for review, without collection controls.
• Viewer — read-only access to shared cases.

Team Members (under your account menu, admins only) is where roles are assigned and new members are invited.

SSO

Single sign-on (OIDC) is available on Enterprise-tier organizations, configured by an org admin from account settings.

Two-factor authentication

Two-factor authentication is mandatory on every COLLECTiT! account — there's no way to opt out, given the sensitivity of forensic evidence. You'll be prompted to set it up right after email verification, using any standard authenticator app (Google Authenticator, Authy, 1Password, etc.):

1. Scan the QR code shown during setup with your authenticator app.
2. Enter the 6-digit code it generates to confirm setup.
3. From then on, you'll enter a fresh code each time you log in.

Certain sensitive actions (cancelling a subscription, changing SSO configuration, resetting another member's 2FA) require a fresh 2FA code at the time of the action, even within an already-logged-in session — this is called step-up verification and exists to make account takeover meaningfully harder for high-impact changes. If you lose access to your authenticator, an org admin can initiate a reset on your behalf, which you then confirm by email.

Trusted devices Coming Soon

Billing & subscription

Billing and payment details are visible only to your organization's designated billing owner — not every admin — to keep payment info tightly scoped. The founding admin of a new organization becomes its billing owner automatically; an existing billing owner can hand the role to another admin from account settings.

From the subscription view, the billing owner can put the subscription on hold, reactivate it, or cancel it — cancellation keeps access through the end of the current billing period rather than cutting off immediately, and a retention discount may be offered before it's finalized.

Getting support

The Support link in your account menu takes you to the full Support Portal, where you can open a new ticket, reply to an existing one, and see your ticket history. For general questions not tied to your account, see the FAQ or reach out from the Support page.