Internet Supply Chain
Intelligence
Illuminating the internet supply chain operating within your application.
Modern web apps assemble themselves at runtime from code, media, and data served by dozens of third-party vendors, almost none of it visible to the owner, and none of it to the user. SBOMs and vendor questionnaires describe what should load. SCVue™ shows you the facts: every vendor, every resource, every outbound payload, captured and analyzed as evidence.
The foundational question SCVue™ answers: “Can I trust this website and its contents to be consistent with what the creator intended, or is it susceptible to manipulation or influence?”
Supply Chain Integrity
The suppliers inside your application
Modern web applications are commonly assembled from parts supplied by other people. A single page load can quietly reach out to dozens of other companies: an analytics provider, an advertising network, a font service, a video player, a chat widget, a payment processor, a content delivery network, a fraud detection service. Each of those is a supplier. Each is a place where data can leave, where code you did not write can run, and where a problem in someone else's business becomes a problem in yours.
That collection of suppliers is your digital supply chain, and for most organizations it is invisible. Your supply chain is not only the vendors you contracted. It is the code you maintain and the technology integration partners you build on, together with everything they load in turn.
SCVue™ is about knowing and identifying the technology dependencies inside your applications. By examining their code, resources, data, and runtime network communication, you can see what your sites and apps really do, who they depend on from both a technology and a third-party integration standpoint, and where risk enters your supply chain.
Vendor Discovery
Every vendor, host, and service the app actually loads, resolved to real companies and products.
Runtime Behavior Profiling
What the code really does: scripting, tracking, fingerprinting, and outbound payloads.
Resource Baselining
Every resource content-addressed by SHA-256 and validated as known, trusted code.
Continuous Monitoring
Scheduled recaptures detect any change and raise alerts the moment behavior shifts.
Who Can Use SCVue
Built for individuals, business, governments, academia, and researchers
SCVue helps people and organizations run comprehensive, continuous monitoring across a wide range of specialties and industries. It is a robust tool for organizations managing their own applications and internal portals, and it supports integration providers just as fully, whether they rely partly or entirely on third-party vendors.
Diligence Services Providers
Vetting, risk assessment, background and screening, audit and review.
Vulnerabilities in Your Own Supply Chain
Across the technology and software products you depend on, and the people who impact them, through all five classes of supply chain: people, knowledge, financial, digital, and physical.
Assessments of Other Companies' Applications
For possible partnership, acquisition, competitive analysis, vulnerabilities, or dependencies.
Deep Research and Competitive Analysis
The measurement works from the outside, with no source code and nothing to install, whether the work is commissioned by the company or carried out independently.
Public-Facing Portfolios
Organizations managing or overseeing multiple sites that service the public domain.
Individuals and Businesses
Validating the trustworthiness of a web-based product.
Legal, Compliance, and Auditors
Compliance with legal terms, GDPR, flow-down clauses, and jurisdictions.
Software Vendors
Knowing and documenting your third-party dependencies, SBOM style work.
Testers and Penetration Test Teams
Validating that services and behavior run as designed and developed.
Risk Managers
Understanding third-party risk in technology supply chains.
See where you fit
Our Solutions pages set out how these engagements run, and what the work product looks like for each.
Distinctive
What makes SCVue™ distinctive is its evidence-based approach
It is built with intent, to confirm the application is performing as expected without a narrowed view. We have a ten analysis engine process, with comparison modeling, vendor discovery, continuous monitoring, and influence factor flagging. Performing only one or a couple of these processes can leave a blind spot in the future.
Evidence, Not Claims
Reports what code and traffic are observed to do, never what a manifest declares.
The Whole Chain, Not the First Hop
A page loads a tag, the tag loads a script, that script calls a service nobody put on the vendor list. SCVue follows all of it.
Three Independent Axes
Compare any report across time, capture context, and page.
Risk & Influence Factors
Is the code risky? Are the parties behind it flagged? Two questions, answered together.
Privacy by Design
A local, private workspace keeps all data in the browser. Cloud storage receives only data whose POST payloads have been scrubbed of PII.
Method
How SCVue Works
One capture can get you started.
01
Capture
Import a HAR capture, or let SCVue capture remotely from real browsers on real devices in cities worldwide, with scripted interaction.
02
Parse & Normalize
One deduplicated data model across apps, versions, collections, views, and calls.
03
Analyze
Ten engines profile code, traffic, payloads, media, entities, and infrastructure.
04
Report & Monitor
Dashboards, baselines, deltas, and alerts in a comprehensive Analyst Toolkit.
Platform
One capture. Everything it can tell you.
Every request, every file, every server and every cookie, recorded once and reviewed from more than forty angles.
Various Capture Scenarios
Sites serve different code, different trackers, and different third-party libraries depending on the device, the location and the browser. Capture plans replay the same browser interaction every time, device profiles set what the site thinks it is serving, and locations set where the session browses from.
Real-Time Validation and SBOM Generation
As resources load, each response body is hashed with SHA-256 and validated against the Single Source of Truth registry, identifying known code by software, version, vendor and provenance. SCVue builds an SBOM from what is actually observed loading and reconciles any declared CycloneDX or SPDX SBOM against it, so shadow dependencies surface instantly.
Continuous Monitoring
A capture describes the moment it was taken. Once a baseline is established, scheduled recaptures are compared against it, deltas are computed, and every change raises an alert deep-linked to the originating record.
Portfolio Scale
Applications group the way you design them, by department, business unit, risk owner or client, and every rollup report re-groups to match. Provider data is pooled, so what you learn about one supplier carries through to every other application that touches it.
Private and Cloud Workspaces
A private workspace keeps all data on the client machine. A cloud workspace adds team access, cross-device work and server-run monitoring, and only scrubbed data ever arrives: the PII scrub runs client-side at promotion and the server re-validates, rejecting unscrubbed payloads.
Evidence and Export
Every finding links back to the network call that produced it, with its address, headers, content and timestamp. Every report exports with all the rows your filters selected, visual reports export as images, and the filter selection lives in the page address, so any view can be bookmarked or sent to a colleague.
Analyst Toolkit
Eight Report Sections
Forty-seven reports across eight sections, built from one capture, with every finding deep-linked to the evidence it came from.
Overview
A portfolio dashboard, risk factors, supply chain map, change over time, and monitoring.
Traffic & Requests
The raw record of what the application did on the network.
Assets
Everything the application loaded, organized by what kind of thing it is.
Infrastructure & Hosting
Physical and corporate reality behind the traffic: whose servers, whose network, and where.
Data Flow & Jurisdiction
Where information goes, where it comes to rest, and whose law governs it.
Security & Behavior
Whether the application is configured to defend itself, and what its code does once it runs.
Entities & Vendors
The real-world companies, people, and products behind the technology.
References & Exposure
Everything named inside the files, whether or not it was ever contacted.
Questions
Questions it can answer
Over time, the web of services and vendors that influence an application can become a risk, and a risk not easy to react to in the short term.
Who are we actually sending our users' data to?
Not who the vendor contract says. Who the browser actually contacted, on the day you measured it.
Is any of this going somewhere it should not?
SCVue identifies the physical and legal location of the servers involved, so you can see when traffic crosses a border you care about, or lands in a jurisdiction that changes your obligations.
Are we exposed to a company we are not allowed to do business with?
SCVue cross-references the traffic against a curated intelligence catalog of companies, their owners, their sanctions status, and the influence factors attached to them.
Did something change?
Suppliers change their code without telling you. SCVue captures a baseline and compares later captures against it, so an unannounced change in a third-party script becomes a visible event rather than an invisible one.
Can we prove it?
Every finding traces back to a specific recorded network call, with its address, its response, its content, and its timestamp. Everything can be exported as evidence.
In Action
Discover and visualize from a single capture
Every screen below is analysis of a real capture, not a mockup.
Risk Factor Analysis on Every HTTP Request
- One scale: ten analysis engines roll up to High, Warning, and Info, each finding deep-linked to its report.
- Code risks: CSP and SRI weaknesses, HTTPS downgrades, runtime code generation, and fetch-to-execute patterns.
- Tracking risks: web beacons, tracking parameters, and fingerprinting in media and POST traffic.
- Evidence only: derived from captured code and traffic, never from build manifests.
Findings on a single application, each linked to its evidence.
X-Ray Every Request, Map Every Outgoing Data Flow
- Every payload: inspect what the application transmits out, decoded call by call.
- Automatic flags: device fingerprinting, personal information, cross-site and session tracking, behavior logging.
- Data flow mapping: see exactly which service providers receive data about your application and your users.
POST calls on one page, with those flagged for device fingerprinting called out.
Revealing Who Is Behind Every Resource
- Real entities: enrichment resolves observed domains to companies, software products, and individuals.
- Influence Factors: flags on the parties themselves: ownership, control, sanctions, jurisdiction.
- Deep intelligence: backed by nDiligence profiles, with on-demand enhanced reports and analyst research.
The companies operating behind one application, by country and role.
Map the Infrastructure, Hosting, and Jurisdictions
- Complete inventory: domains, hostnames, IPs, ISPs, cloud providers, CDNs, SSL certificates.
- Automatic attribution: pattern engines identify CDN and cloud-provider usage.
- Jurisdiction mapping: geo and ASN resolution shows where data is stored and served.
Hostname matrix with CDN attribution, IPs, and asset mix per host.
SCVue discovers your digital vendors
Revealing and documenting all of the providers and services utilized in your applications. Identify every jurisdiction and governing law with authority over the processing and storage of your application data, proven with captured evidence.
SCVue is built by nDiligence, which uses it on its own investigations. Editions, pricing and a free community account are at scvue.com. SCVue puts the measurement in your hands; when a question outgrows a capture, Digital Supply Chain and Equity Chain Mapping take it further.
Request a
Briefing
We walk through real-world use cases drawn from active engagements that demonstrate why supply chain integrity now requires senior-level attention and coordinated action.
Subscribe to stay informed on global supply chain integrity developments and nDiligence updates.
Copyright © 2026 nDiligence, Inc. All Rights Reserved.