Endpoint defense you can audit
RECONIFIED is a single-host Windows EDR/XDR console, designed so that every process, file, port and privileged action it uses can be inspected by you or a third-party auditor.
Four rules the build never breaks
User mode only
Win32, ETW and documented Windows APIs. No minifilter, ELAM, PPL or kernel callback.
Consent before action
Each privileged action needs a matching operator grant and its own Windows UAC prompt.
Local by default
Telemetry, alerts and cases stay in SQLite under ProgramData. Egress only goes where you point it.
Tamper-evident audit
Grant, policy, containment and quarantine changes are chained with SHA-256, so edits and gaps show up.
Two executables, four crates
Tauri 2 and WebView2 render the console. Rust owns sensors, storage and actions. The UI talks to the agent over Tauri commands, not a web API.
What an audit can verify
None of these checks need the vendor. Run them on any host with RECONIFIED and compare the results with this page.
No kernel driver, no service
Confirm neither appears in the process tree or in sc.exe. Only reconified-app.exe runs, at medium integrity.
Grants match the host
Read operator-grants.json and compare it with the sign-in task, the ETW session and the firewall rule list.
The API rejects bad keys
Call /v1/health with no key and with the published development string. Both must return 401.
Listeners are loopback only
The read-only REST port 9477 and the SSO redirect port 9478 bind to 127.0.0.1 and nothing else.
Secrets are locked down
local-api-key, local-policy-key and idp.json are readable only by SYSTEM, Administrators and the current user.
The audit chain is intact
Run the verifier against tier1.db and record head_hash somewhere outside the host.
Live response is allowlisted
Send a command outside the allowlist and confirm it is refused.
No silent privilege
Firewall, terminate and ETW session creation fail from reconified-app.exe alone. A denied UAC prompt leaves the action failed.
Sign-in start is LIMITED
If RECONIFIED\Background exists on an unpackaged install, its run level is LIMITED, not HIGHEST.
Have a question?
Straight answers about what RECONIFIED does and does not do on a Windows PC.