VaultBook for Investigators: Case Notes, Evidence Logs, and Chain of Custody

The moment an investigator opens a case file in a cloud note-taking application, they have made a consequential decision they may not have consciously evaluated: they have placed the investigation’s working documentation on a server operated by a technology company, under that company’s terms of service, accessible to that company’s systems and to any legal process directed at it.

For investigators, the implications of that decision extend beyond privacy preferences. Evidence documentation stored in systems that can be accessed, modified, or produced without the investigator’s knowledge creates chain of custody questions that opposing counsel will raise. Case notes stored in applications whose AI features process the content may create discovery exposure the investigator did not anticipate. Source identities and witness contact details stored in cloud systems can be subpoenaed through mechanisms that bypass the investigator entirely. And the metadata generated by cloud sync - timestamps, access patterns, device logs - creates a secondary evidentiary record that may or may not be favorable to the investigation.

Investigative documentation requires an environment with specific properties: verifiable integrity (no unauthorized access or modification), operational security (no exposure of the investigation’s direction or sources), legal defensibility (clear chain of custody for evidentiary records), and the organizational depth to manage complex multi-thread investigations over extended time horizons.

VaultBook’s local-first, zero-network-request architecture provides the foundational security that investigative documentation requires. Its feature depth - per-entry encryption, deep attachment indexing, sections architecture, version history, scheduling, and behavioral intelligence - provides the organizational and retrieval capability that complex investigative work demands. This article works through how those capabilities map onto the specific documentation workflows of professional investigation.

The Investigator’s Documentation Challenge

Investigators across different practice contexts share a common documentation challenge with several distinct dimensions.

The evidentiary integrity dimension. Documentation that will support legal proceedings - criminal prosecutions, civil litigation, regulatory enforcement, disciplinary processes - must be created, maintained, and produced in ways that establish its authenticity and protect its integrity. Notes that were created at a specific time, that have not been modified since creation, and that were stored in a system with documented access controls are more defensible as evidentiary records than notes created in systems where the access, modification, and production history is ambiguous or controlled by a third party.

The operational security dimension. Active investigations depend on maintaining the confidentiality of the investigation’s direction, sources, methods, and findings until the appropriate disclosure point. An investigation whose notes are stored in a cloud application that a subject could potentially access - through legal process, through account compromise, or through the vendor’s data practices - is an investigation whose operational security is compromised in ways that may not be discoverable until significant harm has occurred.

The source protection dimension. Informants, witnesses, and cooperating parties who provide information to investigators are typically protected under legal frameworks that govern their identities and the information they provide. Those protections are only as strong as the systems used to document the information. Source identities stored in cloud applications are accessible through server-directed legal process in ways that source identities stored locally are not.

The complexity management dimension. Serious investigations involve multiple investigative threads, complex timelines, multiple subjects, large volumes of evidentiary material, and extended time horizons. Managing this complexity requires organizational tools that can represent the investigation’s structure, track the status of multiple threads simultaneously, and provide intelligent retrieval across the full investigation archive.

VaultBook addresses all four dimensions through a combination of architectural and feature decisions that make it uniquely suited to investigative documentation.

Zero Network Requests: The Evidentiary Foundation

The most fundamental property of VaultBook for investigative work is the one that is verifiable before any other capability is used: zero network requests during all operations.

This property has specific legal and operational significance. Notes created in VaultBook are created and stored locally. The application does not transmit any content to any server at any point. There is no cloud infrastructure that holds the documentation, no vendor that could be served with a subpoena for it, no account that could be compromised to access it, and no sync metadata that creates a secondary record of when notes were created and modified by sources other than the investigator’s own device.

The verifiability of this property is itself meaningful for investigative work. An investigator who needs to establish that their case notes were maintained in a system with controlled, local-only access can demonstrate that through the browser’s network tab - opening developer tools, clearing the network log, and using VaultBook normally produces zero network activity. This demonstration takes sixty seconds and requires no technical expertise beyond knowing how to open developer tools. It is a form of documentation about the documentation environment that cloud-based systems cannot provide.

For investigators whose case notes may become exhibits or whose documentation practices may be examined in legal proceedings, the ability to demonstrate - rather than merely assert - that the note-taking system made no network requests is a meaningful evidentiary property. It establishes that the documentation was maintained in a controlled, locally-stored environment from the moment of creation.

The vault’s physical structure supports this demonstration further. The vault is a folder of files - a repository index and individual entry files in open HTML format, with attachments in a subfolder. File system metadata for these files shows creation and modification timestamps that are local device timestamps, not cloud service timestamps. The documentation has a clear local provenance that begins with the investigator’s device and involves no external system.

Version History: The Integrity Record

For evidentiary documentation, the question of whether a record has been modified since its creation is often as important as the content of the record itself. A case note that was created at the time of an observation and has not been modified since is a different category of evidence than a note that was created at one time and extensively modified later. The modification history of investigative documentation is part of its evidentiary character.

VaultBook’s per-entry version history stores snapshots in a local /versions folder with a 60-day retention window. Every time an entry is modified, a timestamped snapshot of the previous state is saved. The history modal for any entry shows the full timeline of snapshots, allows viewing any previous version, and allows restoring any previous version as the current entry.

For investigators, this version history serves multiple functions. It documents that notes were created progressively as the investigation developed - showing that the understanding recorded at each stage reflects what was known at that time, before subsequent developments. It provides a modification audit trail that can be produced to establish that notes were not retroactively altered to fit a narrative. And it enables recovery of earlier notes when a subsequent entry has been revised to incorporate new information that actually changed the meaning of the original observation.

The version history is stored entirely locally. It is part of the vault folder, subject to the same zero-network-request architecture as the current note content. There is no server that holds versions independently of the investigator’s vault. The complete modification history - from the initial note through every subsequent revision - is in the vault folder alongside the current note content.

For investigations where documentation integrity is expected to be challenged - complex criminal matters, high-stakes civil litigation, contested regulatory proceedings - the combination of local storage, zero network transmission, and per-entry version history creates an evidentiary record with documented provenance and modification history that is substantially more defensible than notes maintained in cloud applications with opaque server-side version histories.

Per-Entry Encryption: Source Protection and Operational Security

Investigative documentation frequently contains material that requires protection beyond the physical security of the device - source identities, informant contact details, confidential witness statements, undercover operation details, and preliminary findings that, if exposed, would compromise the investigation or endanger cooperating parties.

VaultBook’s per-entry AES-256-GCM encryption with PBKDF2 key derivation at 100,000 iterations provides this protection at the individual entry level. Any specific entry in the vault can be encrypted with a password known only to the investigator. Different entries can use different passwords - the source identifier list, the undercover contact log, and the preliminary findings memo can each have independent passwords, with access controlled separately.

For investigative teams where multiple people need access to some entries but not others, the per-entry encryption model enables access tiering within the same vault. A senior investigator can encrypt the entries containing the most sensitive operational details with passwords not shared with junior team members, while leaving case management entries, evidence logs, and timeline reconstructions accessible without encryption.

The PBKDF2 key stretching at 100,000 iterations makes brute-force attacks on encrypted entries computationally expensive - a password-protected entry is not simply a locked file but a cryptographically hardened container where the cost of guessing the password is deliberately elevated. Combined with the zero-network-request architecture, this means that an encrypted entry is accessible only to someone with both physical access to the device and knowledge of the entry-specific password - a meaningful access control for the most sensitive investigative documentation.

Session password caching allows an investigator who has unlocked encrypted entries at the start of a working session to access those entries throughout the session without re-entering passwords for each access. The session cache is cleared when the vault is locked. This means the investigator can work efficiently across encrypted entries during an active working session while maintaining protection against device access during inactive periods.

The full-page lock screen provides immediate protection during brief absences. An investigator who steps away from their desk during a working session can lock the vault with a single action, requiring a password before any vault content is accessible again.

The Evidence Log: Sections Architecture for Evidentiary Records

The evidence log is one of the most critical documents in any investigation. It records what physical and documentary evidence was collected, when and where it was collected, who collected it, what condition it was in at collection, where it was stored, who had access to it, and every transfer of custody. This record establishes the chain of custody that makes evidence admissible and defensible in legal proceedings.

VaultBook’s sections architecture maps naturally onto the evidence log structure. A case entry can have a dedicated Evidence Log section with individual sub-entries for each piece of evidence. Each evidence entry can record - within its section - the item description, collection date and time, collection location, collecting officer or investigator, initial condition assessment, storage location, and a chronological custody transfer log.

The sections system’s collapse-and-expand capability means the evidence log for a complex case with dozens of exhibits can be navigated efficiently - expanding only the section for a specific exhibit while keeping the rest of the log collapsed. The clip count indicator on each section provides an immediate count of how many attachments are associated with that evidence entry, giving the investigator a quick visual check that all supporting documentation for each exhibit is present.

For digital evidence specifically - documents, photographs, video files, audio recordings - VaultBook’s attachment system allows the actual evidentiary files to be attached directly to the evidence log entry, organized at the section level corresponding to the specific exhibit. The attached files are indexed by VaultBook’s deep attachment processing system, making the content of those files searchable through the vault’s Q&A search.

A photograph attached to an evidence entry is processed by the local OCR engine, extracting any text content in the image - serial numbers, labels, written notations, document text visible in the photograph - and adding it to the search index. This means that searching for a specific serial number, a specific name on a document photograph, or a specific notation visible in surveillance photographs returns the evidence entries containing those images, even if the investigator did not manually record those details in the evidence log text.

Case Timeline: Building the Chronological Record

Investigators build timelines - the chronological reconstruction of events relevant to the investigation. The timeline is often the spine of the investigation, organizing all collected evidence and witness accounts into a coherent picture of what happened, when, and in what sequence.

VaultBook’s organizational tools support timeline construction through several complementary mechanisms. A dedicated Timeline page within the case hierarchy contains entries for specific events, each dated and labeled according to its evidential status - established, alleged, witness-reported, or documentary-evidence-based. Entries are organized chronologically within the timeline page, with drag-and-drop reordering as the timeline is refined.

The label system enables the timeline to be filtered by source type, by evidence strength, by subject involved, or by investigative thread. An investigator who wants to see all timeline entries supported by documentary evidence, or all entries involving a specific subject, uses the label filter to produce that view instantly - without scrolling through the full timeline or manually searching for the relevant entries.

Due dates on specific investigative actions - interview scheduling deadlines, surveillance authorization expiration dates, subpoena response deadlines, reporting deadlines - surface in the sidebar Due tab. A vault-wide deadline view showing all approaching deadlines across the entire case, regardless of which investigative thread they belong to, provides the operational scheduling visibility that prevents critical deadlines from being missed.

The Timetable view shows all scheduled investigative activities in a day and week calendar format with a 24-hour timeline. The Timetable Ticker in the sidebar provides a running preview of upcoming scheduled items without requiring the full calendar view. For investigations with multiple parallel time-sensitive activities, the Timetable provides the scheduling overview that keeps all threads on track.

Subject Files: The Contact and Intelligence Layer

Every investigation involves subjects - persons of interest, witnesses, informants, cooperating parties, and potential targets. Managing information about each subject requires an organizational structure that keeps subject-specific intelligence accessible, updatable, and connected to the broader case context.

VaultBook’s entry structure with sections provides the natural architecture for subject files. Each subject has a dedicated entry with sections for identifying information, background and history, known associates, relevant financial or organizational connections, investigative actions taken, intelligence received, and planned next steps. The section headings provide consistent structure across all subject entries, making the subject files navigable as a standardized format rather than as idiosyncratic individual notes.

Per-entry encryption can be applied selectively to the subject entries that contain the most sensitive information - informant identities, undercover operative contact details, protected witness information. The investigator encrypts the entries that require protection while leaving general subject intelligence entries accessible without per-entry passwords.

The Related Entries panel in VaultBook surfaces subject entries that are semantically connected to the entry currently open - an investigator working on one subject’s file may see related entries for other subjects who have been associated in earlier notes, for evidence entries that mention the subject’s name, and for timeline entries involving the subject. The Related Entries connections are generated from local semantic analysis and refined by upvoting and downvoting suggestions, creating an increasingly accurate map of the connections within the investigation.

The Favorites panel maintains instant access to the subject files that are most actively relevant to the current phase of the investigation - the primary subjects in the active investigative thread are starred and accessible with a single click from anywhere in the vault.

Deep Attachment Indexing: The Investigation Archive

Investigations generate documents. Court records and public filings. Financial statements and transaction records. Corporate registrations and organizational documents. Surveillance logs and activity reports. Subpoena responses and discovery productions. Communication records from authorized intercepts or lawful process. Each of these document types arrives in formats - PDF, XLSX, DOCX, MSG - that contain specific evidentiary content that the investigator needs to retrieve and cross-reference.

VaultBook’s deep attachment indexing creates a fully searchable investigation archive from every document attached to the vault. PDFs are indexed through full text extraction - every word on every page of every court filing, every financial record, every corporate document in the investigation archive. XLSX and XLSM spreadsheet cell contents are indexed through SheetJS - transaction records, financial summaries, and structured data files are searchable by any cell value. PPTX slide text is indexed. MSG email file subject and body content is indexed - email records from lawful process are searchable by content. DOCX documents including embedded images are indexed.

The local OCR engine processes photographs of documents, surveillance photographs with text content, and scanned documents, extracting text content and adding it to the search index entirely on-device. A surveillance photograph that includes a vehicle license plate, a sign with a business name, or a document being handled by a subject becomes searchable by that text content through the vault’s Q&A search.

The Q&A natural language search operates across all indexed content simultaneously - note text, section text, labels, and attachment content - with weighted relevance ranking that elevates the most signal-rich matches. An investigator searching for all mentions of a specific financial institution, a specific address, a specific vehicle description, or a specific individual’s name retrieves matches from across every note and every attached document in the investigation archive, ranked by relevance.

Vote-based relevance learning refines search results over time as the investigator marks relevant results. The search engine becomes progressively more accurate for the specific investigation’s terminology and structure as it is used.

For complex financial investigations, fraud cases, and corporate misconduct investigations where documentary evidence runs to hundreds of documents and thousands of pages, the deep attachment indexing transforms the investigation archive from a filing system into a searchable intelligence resource.

The Kanban Board: Investigation Thread Management

Complex investigations often involve multiple concurrent investigative threads - different aspects of the same case being developed in parallel, each at a different stage of completion. Managing the status of these threads requires a visual overview that the page hierarchy alone does not provide.

VaultBook’s Kanban Board converts labeled entries into a visual pipeline. Investigation thread entries labeled by status - “open,” “active,” “pending-evidence,” “ready-for-review,” “completed,” “suspended” - appear as cards in the corresponding columns. The board view shows the full pipeline at a glance, allowing the investigator to see which threads are active, which are blocked pending evidence or authorization, and which are ready for supervisory review.

Moving a card by dragging changes the entry’s label directly, keeping the investigation pipeline status current without any separate record-keeping. The Kanban view is always accurate because it is a projection of the vault’s label state - which is updated whenever the investigator changes an entry’s status label.

Each card in the Kanban Board links directly to the full thread entry with all its sections, attached evidence, notes, and version history. The pipeline view provides the overview; the entry provides the depth. This combination allows an investigator or supervisor to review the full status of the investigation at a glance and drill into any thread for complete detail, within the same private, local environment.

For case supervisors who need to review multiple investigative threads across a caseload, the Kanban Board provides exactly the overview visibility that supports effective supervision without requiring the investigative notes to leave the investigator’s controlled environment.

Surveillance and Field Notes: Real-Time Capture

Investigators conducting surveillance, interviews, or field operations need to capture observations in real time - before details fade, in conditions that may not permit careful organization, with varying levels of completeness depending on what the field situation allows.

VaultBook’s Threads tool provides a chat-style chronological capture interface within the vault. During a surveillance operation, the investigator types timestamped sequential observations - vehicle movement, subject activity, location changes, notable contacts - as they occur, with each entry automatically timestamped. The thread creates a real-time record of the field operation with precise local timestamps that document the sequence of observations.

After the operation, the thread can be reviewed, the most significant observations highlighted using the rich text formatting tools, and the thread reorganized into a structured surveillance report entry with sections for location, duration, subjects observed, activities documented, and evidence collected. The original thread remains as a raw contemporaneous record, while the structured report provides the organized version for case file use.

The Floating Action Button enables instant entry creation from anywhere in the vault - during a field operation, the investigator can open a new entry in seconds, capturing the essential observation before returning to the operational activity. The autosave architecture writes continuously to disk, ensuring that observations are saved from the moment of capture with no save gesture required.

The full-screen composition mode removes all interface chrome for focused entry when the investigator is in a location that requires minimal device visibility. The interface presents only the note content - no application labels, no navigation elements - reducing the visual footprint of the documentation activity.

The File Explorer and Photo Evidence Organization

Visual evidence - surveillance photographs, scene documentation photos, video stills, document photographs - requires organized management that connects each image to the case element it documents. VaultBook’s Photo and Video Explorer scans device media folders for browsing and attaching within the vault environment. An investigator who has captured photographs with a phone camera can browse those photographs within VaultBook, attach the relevant images directly to the appropriate evidence entries and sections, and have the images indexed by the local OCR engine for searchable text content.

The File Explorer provides a library view of all vault attachments organized by file type and entry. An investigator who wants to review all photographs attached across the full investigation - to ensure complete coverage of each evidence entry or to prepare an exhibit compilation - can browse the full attachment library by file type without opening individual entries. The File Explorer shows which entry each file belongs to, providing the context connection without requiring navigation through the full hierarchy.

For preparing materials for supervisory review, prosecution handoff, or regulatory submission, the File Explorer provides the organized overview of the full documentary evidence library that facilitates the assembly of organized exhibits and productions.

PDF Tools for Investigative Documentation

Investigations regularly involve PDF management tasks that arise from the volume of PDF-format documentary evidence. Subpoena productions that arrive as individual PDF files per document need to be combined into organized exhibit compilations. Large PDF productions need to be split into topically organized sections for efficient case review. PDF files received from external sources may be large and uncompressed in ways that make vault storage inefficient.

VaultBook’s built-in PDF Merge and Split tool combines multiple PDF files into organized exhibit compilations or splits large productions into topically organized sections, entirely within the vault’s privacy boundary. The PDF Compress tool reduces file sizes for vault storage efficiency without transmitting the files to any external compression service.

For an investigator preparing a case for handoff to prosecutors or litigators, the ability to organize, merge, and compile documentary evidence within the same environment as the investigation notes - without opening external PDF applications that may leave document traces or create cloud dependencies - maintains the operational security of the case documentation through the handoff preparation phase.

The organizational challenge of complex investigations is not just storing the information but connecting it - ensuring that a piece of intelligence from one thread is visible to the investigator working on a related thread, that a subject file is connected to the evidence entries that document that subject’s activity, and that the timeline entries are connected to the witness accounts and documentary evidence that support them.

VaultBook’s label system creates these connections through cross-cutting classification. Every entry in the vault - subject files, evidence entries, timeline entries, witness interview notes, surveillance logs - can be labeled with the subjects involved, the investigative threads they belong to, the evidentiary significance they carry, and the current status of the material they contain.

Filtered views using the label filter show all entries associated with a specific subject, regardless of whether they are in the subject file section, the evidence log section, the timeline section, or the surveillance logs. A single filter operation produces a view of all vault material relevant to a specific subject - the complete intelligence picture for that subject from across every investigative thread.

Advanced compound filters combine multiple label dimensions with date and modification filters. An investigator who wants to see all evidence entries associated with a specific subject and added in the past thirty days gets that precise view in a single filter operation, without scrolling or manual searching.

Multi-tab views maintain multiple filtered perspectives simultaneously - one tab showing the active thread’s evidence log, another showing the subject file for the primary subject, a third showing the timeline for the relevant time period. Each tab preserves its state independently, allowing the investigator to work across multiple case perspectives without repetitive navigation.

Analytics: Investigation Portfolio Awareness

Investigators managing multiple concurrent cases need visibility into the status and activity patterns of their full caseload. VaultBook’s analytics panel provides this visibility through canvas-rendered charts.

The label utilization chart shows the distribution of labels across all vault entries - for an investigator who uses labels for case names, investigative thread status, and evidence categories, this chart provides an immediate picture of where attention is concentrated across the full caseload and which cases have the largest documentation footprint.

The 14-day activity line chart shows note creation and modification patterns across the past two weeks. For a case supervisor reviewing an investigator’s work, this chart provides objective visibility into documentation rhythm - which cases are receiving active documentation, which have been dormant, and whether the documentation pattern is consistent with reported case status.

The pages utilization chart shows where in the vault hierarchy documentation is concentrated - which case pages are receiving active entries and which are archival. The entry count, file count, and storage size provide the quantitative scale context for the investigation portfolio.

For investigative units that need to maintain documentation standards across a team, the analytics provide a self-audit capability that supports consistent documentation practice without requiring external reporting systems.

Open-Source Intelligence: The RSS Reader for Case Monitoring

Modern investigations increasingly rely on open-source intelligence - publicly available information gathered from news sources, regulatory filings, court records, corporate databases, and other open channels. Monitoring these sources consistently over the course of an investigation requires a system for tracking what has been published and when, without that monitoring activity leaving a trace in external cloud services.

VaultBook’s built-in RSS Reader monitors multiple feeds within the vault’s privacy boundary. An investigator following a complex corporate fraud case can set up feeds for the relevant company’s regulatory filing notifications, local business news, court docket services for the relevant jurisdiction, and public records publication services. The RSS Reader checks these feeds within the vault - no external service records which feeds are being monitored, no usage data leaves the device, and the monitoring activity itself is not visible to any external party.

When a monitored feed surfaces a significant development - a new regulatory filing, a court hearing scheduled, a news report mentioning a key subject - the investigator can capture it as a vault entry using the URL-to-Entry tool, which saves the web content directly to the vault as a fully indexed entry associated with the relevant case. The captured entry is immediately searchable through the Q&A search, connected to other case entries through the label system, and part of the investigation archive from the moment of capture.

For investigators who track multiple cases simultaneously, separate RSS feeds can be monitored for each case and organized through the label system so that new items are immediately associated with the correct case context. The investigator’s monitoring activity - which cases are being watched, which publications are being tracked, what kinds of developments are being sought - stays entirely within the vault.

Password Security for Investigative Accounts

Investigators conducting covert online investigations, managing multiple undercover accounts, or accessing secure systems for authorized investigations require strong, unique passwords for each account and system. Managing these credentials securely - without reusing passwords or storing them in vulnerable systems - is an operational security requirement that many investigators handle inadequately through memory or through insecure notes.

VaultBook’s built-in Password Generator creates strong, cryptographically secure passwords within the vault environment. A generated password is created and displayed within the vault, can be copied for immediate use, and can be noted in the relevant operational entry - all within the same zero-network-request environment as the investigation documentation. The password never passes through any web service, browser plugin, or cloud password manager that could be a vector for exposure.

For investigations involving undercover digital operations, the ability to generate, record, and manage credentials within the vault’s privacy boundary - alongside the operational documentation that provides context for each credential’s use - supports the operational security of the entire digital investigation activity.

A Practical Investigative Vault Structure

To make the organizational approach concrete, consider how an investigator handling a complex financial fraud case might structure a VaultBook vault.

At the top level of the page hierarchy: pages for Case Overview, Subjects, Evidence Log, Timeline, Witness Files, Surveillance Records, OSINT, and Administration.

Within the Case Overview page: an entry for the case synopsis and scope, an entry for the working theory of the case, an entry for the prosecution/referral strategy memo, and an entry for outstanding investigative actions. The case synopsis entry uses callout blocks to highlight the central allegation, the known facts, and the current working hypothesis. Version history on the working theory entry preserves every revision as the understanding develops.

Within the Subjects page: one entry per subject, structured with sections for identifying information, background, known associates, financial connections, investigative actions taken, and intelligence received. The entries for the most sensitive subjects - cooperating witnesses, confidential informants, undercover operatives - are encrypted with entry-specific passwords. All subject entries carry a label for the subject’s name (using a case identifier, not a real name, for the most sensitive subjects), enabling cross-vault filtering by subject across evidence, timeline, and surveillance entries.

Within the Evidence Log page: entries organized by evidence category (Financial Records, Communications, Physical Evidence, Digital Evidence), each structured with sections per exhibit. Each exhibit section contains description, collection details, custody log, and the evidentiary file attached at the section level. Deep indexing makes every attached document searchable by content.

Within the Timeline page: entries for each significant event, dated and labeled by evidentiary status and subject involved. The label filter produces subject-specific timeline views or evidence-strength-filtered views as needed.

Within the Witness Files page: entries for each witness, structured with sections for background, account of events, corroborating evidence connections, reliability assessment, and interview log. Due dates on follow-up interview actions surface in the sidebar Due tab.

Within the Surveillance Records page: individual entries for each surveillance operation, containing the Threads-captured real-time log and the structured surveillance report. Attached photographs are indexed by OCR for searchable visual evidence content.

Within the OSINT page: entries for significant open-source intelligence items captured through the RSS Reader and URL-to-Entry tool, labeled by subject and relevance.

The Kanban Board shows the investigative thread pipeline across all case areas. The Due tab shows all outstanding investigative deadlines across the full case. The AI Suggestions carousel surfaces the entries most relevant to the current day’s investigative focus based on usage patterns.

This structure is coherent from the first case entry and remains coherent as the investigation grows to hundreds of entries and thousands of pages of documentary evidence - because the organizational system is built on principles that scale: page hierarchy for broad structure, labels for cross-cutting connections, deep indexing for content retrieval, and behavioral intelligence for contextual surfacing.

The Handoff Package: Preparing for Prosecution or Litigation

When an investigation concludes and the case is handed off to prosecutors, litigators, or regulatory bodies, the investigative documentation package must be organized, complete, and in a form that the receiving party can navigate and use effectively.

VaultBook’s built-in tools support the preparation of a handoff package from within the vault environment. The File Explorer provides a complete overview of all attached documentary evidence organized by file type and entry, facilitating the assembly of organized exhibit lists. The PDF Merge and Split tool combines document productions into organized exhibit compilations. The PDF Compress tool reduces file sizes for efficient transmission.

The export from the vault is straightforward: the vault folder contains all entries in open HTML format with all attachments in a standard subfolder. A prosecutorial team that receives the vault folder receives a complete, organized, searchable investigation archive that can be opened in any browser - without any proprietary software, without any account, and without any cloud service dependency.

For investigations that are expected to generate legal proceedings, this handoff architecture - a self-contained folder of files in open formats, with a self-contained browser application for navigation and search - is substantially more useful and more defensible than a cloud export from a subscription service that the prosecutorial team would need to access through a specific vendor’s interface.

The investigation record that begins with the first case note in VaultBook ends with a complete, organized, locally-stored archive that is ready for handoff, long-term retention, and potential recall for related proceedings - in a form that is as permanent and as accessible as the storage medium it lives on.

The Connecting Thread: Privacy as Operational Necessity

For investigators, privacy is not a preference or a philosophical position - it is an operational requirement. An investigation whose documentation can be accessed by the subjects of the investigation is a compromised investigation. An investigation whose source identities can be reached through server-directed legal process has exposed those sources to risk they accepted on the understanding that the investigator would protect them. An investigation whose evidentiary records are held on vendor servers creates chain of custody ambiguities that opposing counsel will exploit.

VaultBook’s zero-network-request architecture addresses all of these operational requirements through a single architectural decision: the vault stays on the investigator’s device. No subject can access it through the vendor. No legal process directed at the vendor reaches it. No server breach exposes it. The chain of custody for the documentation is clear, local, and defensible.

The investigator who maintains their case notes, evidence logs, and subject files in VaultBook is an investigator whose documentation practices are consistent with their operational obligations - and whose evidentiary records, when the case reaches the point where they matter most, are as defensible as the investigation itself deserves.

VaultBook - your personal digital vault. Private, encrypted, and always under your control.

Investigations that result in prosecution, litigation, or regulatory action generate documentation that must be preserved for extended periods - sometimes decades. The investigative file is an evidentiary record that may be called upon in appeals, related proceedings, or subsequent investigations that build on the original case.

VaultBook’s local-first architecture provides an unusually strong foundation for long-term investigation archive preservation. The vault is a folder of files in open formats - repository index and entry files in HTML, with attachments in a subfolder. These files will be readable by any browser or HTML viewer indefinitely. The single HTML application file that opens the vault is self-contained - if VaultBook as an organization were to cease to exist, the vault files would remain fully accessible and navigable through any modern browser for as long as web standards exist.

This permanence guarantee is materially different from what cloud-based documentation systems provide. A case file in a cloud system is accessible as long as the vendor operates the service and the organization maintains an account. An investigation archive in a VaultBook vault is as durable as the storage medium it resides on - which, with appropriate backup practices, means indefinitely.

For investigators preparing for case closure, the vault provides a clean archive export: the entire investigation file - notes, evidence logs, subject files, timelines, and all attached documentary evidence - in a folder that can be archived, transferred to a prosecutorial or litigation team, or stored for long-term retention without any cloud service dependency or account maintenance requirement.

The investigation built and documented in VaultBook is an investigation whose records are as defensible, as organized, and as privately maintained as the work itself deserves. From the first case note to the final evidence log, from the source identifier that must be protected to the chain of custody record that must be inviolable, VaultBook provides the documentation architecture that serious investigative work requires.