← Back to Newsletters

Newsletter #2 — March 2026

Welcome Back

A lot has happened since the last newsletter. We've been building out the platform's control plane, hardening security, and adding some significant new capabilities for legal production workflows. Here's the rundown.

Management Plane

Sprite now has a proper admin system. A separate Management API runs alongside the main platform with its own Go service, its own database layer, its own auth. The frontend is a full app where we can manage customers, handle entitlements, and work with licences. There's a Plugin Marketplace with a seed catalog in there too, which is starting to come together.

This is the foundation for multi-tenancy done right. Every customer gets managed centrally, but customer data, customer users and processing stay isolated.

Authentication & Identity

This one was a big piece of work, and it's about empowering customers to manage their own accounts. Each Sprite customer gets their own user pool, which means proper tenant isolation at the identity level. Local users get username/password with MFA. Federated users can authenticate via OIDC, Okta, Azure AD, whatever your organisation uses. The frontend has a full auth flow: login page, auth guard, callback handling, and automatic token refresh. It's been thoroughly documented so frontend developers can get up to speed quickly without having to reverse-engineer the flow, or deal with AWS services directly.

Hash Set Lookup

We talked about hash set management in the last newsletter. This time we've built the full lookup system. The idea is simple: compare file hashes against curated collections (NSRL for known-good, malware sets for known-bad) and classify files automatically during processing. Under the hood there's some nifty architecture that means a customer can 'subscribe' to a set just by clicking a button and it becomes immediately available.

The implementation touches most layers of the platform:

  • Aurora Postgres (Serverless and Scalable) for hash entries, DynamoDB for hashset metadata.
  • A Go importer service for bulk ingestion
  • Bloom filter builder for fast pre-filtering (this is the performance work we hinted at last time)
  • NSRL loader script for ingesting the NIST National Software Reference Library
  • API endpoints for hashset CRUD
  • Go and Python SDK updates so plugins can query hashes at processing time
  • SHA-256 hashes by default. We don't think this is controversial, most services are using SHA-256 now - just something to bear in mind.

That SDK updates is the enabler here. Any plugin can now call back into Sprite and ask "have I seen this hash before?" during processing. No local databases, no syncing, no connection strings, and no overhead.

RSMF Export

New plugin for exporting bookmarked message threads as Relativity Short Message Format (RSMF) 2.0 files. If you're working with e-discovery review platforms, this is the format they expect for chat-style data.

The workflow is bookmark-driven, same as Tempest: analysts browse message threads, bookmark what's relevant, then trigger the export with configurable date range, chunking, and attachment options. To support this, we updated eight parsers (WhatsApp, Teams, Slack, Discord, Google Chat, Kik, Signal, and SMS) to emit message_thread observables. That's a pattern we expect to reuse. Structure the data once, and multiple export and reporting plugins can consume it.

Tempest: Legal Production

Tempest has come a long way since the 48-hour proof of concept we talked about last time. It's now a proper legal production plugin: Bates-numbered single-page TIFFs, Concordance DAT and Opticon OPT load files, extracted text, and native files all packaged as a ZIP for delivery.

New in this round: family grouping, custodian assignment via Sprite's subject model, message thread rendering, slip sheets for non-producible items, and pre-flight validation so you catch problems before you produce. Still bookmark-driven, still renders in parallel.

Loadfile Verifier

This one came out of real-world pain, but the request came in at the time I was looking at Tempest. If you've ever received a loadfile DAT file and had to figure out why it won't load, encoding issues, mismatched column counts, delimiter problems, broken file path references.

The Loadfile Verifier is a standalone CLI/GUI tool that analyses and transforms DAT loadfiles. It detects encoding and BOM issues, validates columns, checks delimiters, runs per-column type and null analysis, verifies referenced file paths, and generates reports. There are also transformation commands for fixing common problems. v0.1.0 is done with full requirements coverage.

Plugin Security

In addition to the user authentication piece, we've implemented the planned hardening measures around how plugins talk to the Sprite API with two mechanisms:

  • HMAC request signing: the SDK signs every outbound request, the API verifies the signature. Signing keys rotate via a dedicated tool.
  • Plugin API keys: stored, encrypted, and validated on each run. Full key lifecycle and rotation documented.

This closes the loop on plugin-to-platform trust. Every request is authenticated and verified, and the plugins run isolated from external networks.

iOS Parser Improvements

A few cross-cutting fixes worth mentioning. Seven parsers got message_thread support (the RSMF work above drove that). We also found and fixed a SQLite WAL companion file bug that was affecting about twelve plugins, they were matching -shm and -wal files instead of the main database, which caused failures in Lambda dispatch mode. Fixes went across WhatsApp, Discord, Chrome, Firebase Analytics, Location, Photos, TikTok, WeChat, YouTube, and Withings plugins.

Frontend Updates

The frontend got a fair bit of attention this month:

  • Database & Filesystem Browsers: An interactive database browser, yes run queries directly on identified databases or across them, export the results to csv. Plus an updated filesystem browser, APFS support, and some observable preview component tweaks for inline data viewing.
  • Pipeline Builder: a new page and store for constructing analysis workflows
  • JetStream: list and detail pages rebuilt with new card components
  • Case Setup Wizard: evidence selector with source and subject hooks
  • Run Plugin modal: for bookmark-driven plugins (ties into the RSMF and Tempest workflows)
  • Dashboard updates throughout

Other Bits

  • Artifact Hasher Lambda: computes hashes of extracted artefacts during processing. In the event that the plugins don't handle it, Sprite will pick it up.
  • Plugin Lambda deploy script: automated deployment for plugin Lambdas
  • Frontend API OpenAPI spec: formal OpenAPI 3.1 spec for the control plane API
  • PyMagic plugin: file type identification via libmagic
  • Case model refactoring: plugin store, management client, and case transforms cleaned up

What's Next

The legal production workflow is shaping up well with Tempest and RSMF in place. We're continuing to expand the parser library, and there's more frontend work coming to tie the pipeline builder and bookmark-driven workflows together into a smooth experience, and we'll be looking at aLEAPP next as well.

That's it for this one. Questions, feedback, or something you'd like to see covered, drop us a line at info@wesdx.com or connect on LinkedIn. We read everything.