Find the app that's phoning home
Search any address or hostname and see which program on which device reached it, and when. Names stay attached even when a browser tries encrypted DNS.
Closed beta begins on November 1, 2026
Your applications are talking. Time to see who they're talking to.
See what every program connects to and block what shouldn't be, across every device, from one console.
Every page you needHome, Flow, Activity, Network, Review, Reports, Rules, Devices
Owner + locationfor every public address your devices reach
Up to 180 daysof searchable connection history
Works on your phoneunlock, review and block from anywhere
The firewall tells you ports. Antivirus tells you threats. ShadowLatch tells you which program, on which device, reached which company, and when.
Product tour
Everything your devices connect to, in one place.
Eight pages of the same data, each answering a different question.
Start with what changed.
Open items to review, devices that need attention, what was blocked, and the apps and devices moving the most data.
The real console, shown with example data.
What teams use it for
The questions you get asked every week.
Catch new behavior the day it starts
Review flags new applications, new destinations and unusual transfers without you writing a single rule.
Block a destination everywhere
Block an app, a site, a category, a network owner or a country on one device, a group or the whole fleet. Put a policy on a schedule, turn off QUIC or IPv6, or save it as report-only to see what it would block before it blocks anything.
Let devices defend themselves
Any device that sees repeated failed logons or a port sweep blocks the address within seconds, tells every other device in the account, and shows you what it listens on and who connects.
Run client fleets from one console
Give every client its own account, switch between them with one login, apply one baseline to all of them, and send each a monthly report with your logo.
ShadowLatch for MSPsKeep evidence for audits
Up to six months of searchable connection history (longer on request) and an audit log of the changes your team makes.
How it works
Running in an afternoon.
Install the agent
Download the installer with the options you want (group, company, tray icon, DNS resolver) and run it. Devices appear in your console as soon as they check in.
Watch activity arrive
Flow, Activity and Network fill in as your devices connect. Review starts learning what's normal.
Act when something's wrong
Block or allow from any connection in a couple of clicks, or write a policy with the wizard, which shows what it would have matched in the last week. Save it as report-only if you want to watch first, then enable it on a group or everyone.
Security
Built for the people who secure everything else.
ShadowLatch holds sensitive records about your network, so access to it is locked down like any other admin tool.
How we protect your data- Roles for every userOwner, admin, analyst and viewer roles. Lock or remove someone's access in one click.
- MFA and passkeysRequire MFA for administrators and re-confirm identity before sensitive changes.
- Audit logPolicy, device and user changes are recorded with who made them and when.
- Enforced on the device itselfThe agent applies your policies locally, so a block holds even when a laptop is off your network. Threat feeds, content categories, owner and country lists are matched on the device too.
- Help built inSupport lives inside the console: articles, search, and a ? beside every setting.
- You set the historyKeep 30, 90 or 180 days depending on plan, or longer on request.
Where it fits
Built to sit beside what you already run.
Works alongside your antivirus and EDR
ShadowLatch is the network layer. It shows and controls what applications connect to, and leaves file scanning and threat hunting to the tools you already run.
Sees connections, not content
It records which program reached which address, port and name, and when. It never captures packets or opens HTTPS traffic, so it's safe to run where privacy matters.
Reports what the device observed
An allowed connection means the device tried and was permitted; a blocked one means ShadowLatch stopped it. Counts are observations, which is exactly what an investigation needs.
History as long as your plan keeps it
Every page searches the full retained window, 30 days to six months depending on plan (longer on request). Choose the length that matches how far back your team looks.
FAQ
Questions, answered.
Who is ShadowLatch for?
IT teams running Windows devices, from a handful to about a thousand, and MSPs managing devices for their clients. If you need to know which programs on your PCs and servers talk to the internet, who reaches your servers, and stop what shouldn't be happening, it's for you.
Does it replace my antivirus or EDR?
It works alongside them. ShadowLatch is the network layer: it shows and controls what each application connects to, while your antivirus and EDR keep handling files and threats. Most teams run all three together.
What does it actually record?
Connection details only: which program, on which device and user, reached which address, port and name, when, and whether it was allowed or blocked. It never captures packets or opens HTTPS traffic, which is what makes it safe to run where privacy matters. Names, paths and user names are encrypted on the device so only your administrators can read them.
Can ShadowLatch read my data?
No. Names, users, paths and destinations are encrypted on your devices and opened only in your administrators' browsers. We store ciphertext and keys wrapped to your team's passkeys, passphrases or sign-in second factor; nobody at ShadowLatch holds a key, so there is nothing we could read, hand over or be made to produce. How zero access works.
What does the agent do on each device?
It's the engine. It watches every connection as it opens, attributes it to the process and user, applies your policies on the spot, resolves the device's names so browsers can't hide behind encrypted DNS, and reports to ShadowLatch over HTTPS. It installs in minutes and runs quietly alongside your other security tools.
Which Windows versions are supported?
Windows 11 and Windows Server 2022 or newer, 64-bit. Devices need outbound HTTPS to reach the ShadowLatch console.
How far back can I look?
30 days on Core, 90 days on Control and 180 days on Complete. History is searchable across every page of the console. Need longer? Email support@shadowlatch.com.
Where do the owner and location details come from?
When IP details are turned on, ShadowLatch looks up the network owner and approximate location of public addresses, so an address like 8.8.4.4 shows up as Google rather than a bare number. You can turn it off in Settings.
Can I use it for client devices as an MSP?
Yes. Each client gets its own account with its own devices, users and encryption key; you switch between them with one login, apply one baseline to all of them, install from your RMM with deployment keys, and send each client a monthly report with your logo. Every client's devices use your seats. See ShadowLatch for MSPs, or tell us about your setup in the beta request.
Is help built in?
Yes. Support lives inside the console: articles, search, and a ? beside every setting that explains what it does. Email support@shadowlatch.com when you need a person.
What happens after the beta?
Approved beta testers keep their accounts and become founding members: 25% off for life on their first 100 seats when paid plans open. We'll email you before anything changes.
Get in before November 1.
We're inviting a small group of IT teams and MSPs. Tell us about your devices and we'll email you a registration code.