VanDien Labs

We do not only advise on technology. We build it.

VanDien Labs is where product work, technical research and hands-on engineering live. Four focused applications are shipping today, and beside them sit the tools the firm runs on and the prototypes where its thinking on AI governance, intelligence and security is tested before it reaches a client. All of it leans deliberately toward local processing, privacy and clear ownership of the data path.

Discuss a custom build How engagements work

Shipping today

Four applications, on sale now.

Each one exists because the alternative was to send a confidential file to a website and hope. They are sold through the Microsoft Store, the App Store and direct purchase, and none of them phones home to do its work.

Windows, macOS & iOS
no account, no telemetry

FileSentinel for Windows and macOS

Know what is in a file before it leaves the building.

Scans folders, shares and mailboxes for personal identifiers, payment cards, health records, credentials and hidden metadata, with OCR so scanned documents and screenshots are not a blind spot. Twenty-five-plus detectors, tunable rules, and reports an auditor will accept.

FileSentinel in detail

The FileSentinel dashboard showing recent scans and a breakdown of detected sensitive data by category

NetGlobe for Windows and macOS

Every connection your machine is making, on one map.

Live socket mapping scored against threat intelligence, so "something is talking to somewhere it should not" stops being a hunch. Traceroute, MTR, WHOIS, TLS inspection and speed testing sit behind it for when the answer is simply that the link is bad.

NetGlobe in detail

NetGlobe displaying live outbound connections on a world map alongside a connection health panel

DropFile for Windows and iOS

Conversion that never uploads the document.

Media conversion and a full PDF toolkit, driven by dropping a file onto the window. The point is what does not happen: nothing is sent to a conversion website, which is the difference between a convenience and a disclosure.

DropFile in detail

The DropFile window with a document dropped onto it and conversion options shown

FraudScope for iPhone

Reads the scam, and explains the play.

Paste in the message, the invoice or the email that is asking someone to move money, and it explains the goal behind it, the tactics in use and the exact phrases doing the work. Analysis runs on the phone, with no network call, because the thing being analysed is often personal.

FraudScope in detail

FraudScope on an iPhone showing a high-risk verdict and an explanation of the tactics in a suspicious message

In the lab

Research that finds its way into the advice.

Not everything here is for sale. Some of it runs the firm, some of it is a prototype being tested against a real problem, and all of it exists because building a thing is the quickest way to learn where it breaks. The lab also runs AI-assisted engineering on itself: agents carry much of the volume, while the architecture, the approvals and the release stay with one accountable person.

Status labels are literal
a prototype is a prototype

IntelligenceIn use at VanDien

VanDien Signal Desk

The information that matters, as it happens, with its source attached.

An intelligence and data platform that captures relevant findings in real time: actively exploited vulnerabilities, SEC cyber-incident filings, vendor security advisories, cloud and SaaS provider status, economic and market data, and the reporting around all of it. When a provider goes down or a flaw in widely used software is being exploited, the firm is already reading about it before anyone has to ask.

Every finding carries its source and the time it was read, and the ranking is rule-based. An AI summary is available and off by default, because a finding you cannot trace is not intelligence.

Informs Cybersecurity · Fractional CTO

AI governanceAdvanced prototype

PromptGuard

What staff paste into an AI tool, checked before it leaves the machine.

Each prompt bound for a public or enterprise AI service is evaluated on the device against the firm’s policy, then allowed, flagged, redacted or blocked. Redacted values can be restored in the reply, so the work still gets done without the data leaving. For a regulated firm that is a data-loss question and a recordkeeping question at the same time. It is deliberately narrow: no system-wide traffic decryption, no keystroke logging, and no language model running in the background to make the call.

A small number of investment firms are invited to shape it as design partners, ahead of any general release.

Informs AI strategy · Alternative investments

Ask about design partnership

Agentic AIRunning in the lab

HomeOps

Letting an AI agent operate infrastructure without handing it the keys.

A Model Context Protocol control plane that sits between AI agents and the systems they are asked to run. The agent never receives a shell, a password or an administrator account. It gets a short list of narrow, typed actions, each rated for risk; anything that changes state waits for a person to approve it, and every call is written to an append-only audit log.

It runs against the lab’s own network and servers, and it is the working basis for how we advise clients on giving agents real access to real systems.

Informs AI strategy · Cybersecurity

Private AIIn development

Meeting Copilot

Meeting transcription and notes, designed around what never leaves the device.

A meeting assistant for macOS, with a Windows version under way, built as a working study in private AI architecture. Transcription runs on the device. A local-only mode keeps every step on the machine, and when a cloud model is permitted it receives only the question and a short window of context, never the whole meeting.

Audio is not stored, retention is set per meeting, and a verification step rejects any quotation that does not appear in the transcript.

Informs AI strategy

Also on the bench

VendorGuard
Prototype
Third-party risk monitoring for organizations without a security or procurement team: vendor intake, an evidence file, passive external checks and a score that explains itself. A clean external scan is never allowed to lower a vendor’s risk tier on its own.
CertVault
Prototype
Monitoring for certificates, DNS, domain expiry and email authentication records, with reports written for the person who owns the risk rather than the engineer. Developed in the lab from a contracted prototype.
HomeMon
Running in the lab
Lightweight infrastructure monitoring: a small hub, a read-only agent on each machine, outside-in checks, and alerting built to avoid the fatigue that teaches people to ignore alerts.
PowerLogic
Prototype
A visual builder that produces PowerShell automation for people who do not write scripts, with the guardrails built in: typed inputs, risk levels, dry runs and secrets kept out of the output.
Engineering pipeline
In use at VanDien
The AI-assisted development process the lab builds with. Specialist stages run from product definition through architecture, testing, review and release preparation, a person approves the design before anything is built, and nothing is ever deployed automatically.

Custom development

When no product fits, we build the one that does.

Usually a focused internal tool rather than a platform: the thing your team currently does with three applications, a spreadsheet and a convention nobody wrote down.

Not sure whether to build it at all? That is a build-or-buy question, and it is one of the things you can put to us as a paid engagement before any code is written.

Discovery

A defined piece of work that produces a written specification, a technical approach and a price. It is deliberately separable, so you could take the specification to another developer, and occasionally that is the right call.

Build, on terms that fit the scope

A fixed project price when the requirements are settled, time and materials when they are still moving. Working software is demonstrated at intervals rather than revealed at the end, and the source and build pipeline are yours throughout, not on handover.

Ship and hand over

Installer, code signing, update mechanism, store listing where relevant, and documentation written for whoever maintains it next, including if that is not us.

Business licensing

Buying these for a team rather than a desk.

The store listings sell one seat to one person, which is the wrong shape when the answer is forty of them across three offices. For the Windows and macOS applications we license and deploy at the organization level instead. Tell us the headcount and how you deploy software today, and you will get a quote and an honest answer about what we can support.

Ask about business licensing

Volume licensing

Keys issued in bulk against one invoice, on one renewal date, rather than a folder of individual receipts somebody has to reconcile at year end.

ii.

Managed deployment

Silent install and configuration through the tooling you already run, so nobody is walked through a setup wizard at their desk one machine at a time.

iii.

Defaults set centrally

Scan scopes, retention and reporting decided once at the organization level, so an install is correct on the day it lands rather than after a reminder email.

iv.

A named contact

The person who wrote the software answers the support mail. There is no tier one, and no ticket closed for inactivity.

Who you are working with

Written, signed, certified and shipped by the person who advises you.

All four applications were designed, engineered, packaged and released by Christopher Moskowitz, working alone with AI-assisted engineering, in C++, C#, .NET, React and TypeScript, and Swift, across the full lifecycle including security design, code signing and store certification. It is an unusual thing for a technology advisory firm to be able to say, and it is why the recommendations tend to arrive with an opinion rather than a shortlist.

About Christopher Moskowitz →

Common questions

Why build desktop software in 2026?

Because some data should not leave the building, and a web application is a promise that it will. When the work is on files that are confidential, large, or covered by an obligation you signed, running it locally is the simpler answer rather than the nostalgic one.

What does a custom build typically cost?

It is scoped before any code is written, after a short discovery that produces a specification you could hand to another developer. The build is then priced as a fixed project when the requirements are settled, or run on time and materials when they are still moving. A small internal tool and a shipping product with an installer, updates and a store listing are very different commitments, and the discovery tells you which one you are looking at.

Do we own the result?

Yes. Source code, build pipeline and documentation are handed over, and the contract says so. You are not renting your own software back from us.

Can you take over an application someone else wrote?

Often, yes. The first step is a short assessment of the code and build process to establish what it would take to make it maintainable, which occasionally concludes that a rewrite is cheaper than the rescue. We will say so if it is.

Are the four apps related to the consulting work?

Directly. FileSentinel is what we run during the data-discovery portion of a security assessment, and NetGlobe is what goes on a machine when someone reports that the network is slow. Building them is how we keep the recommendations grounded.

Can we use the tools in the lab?

Some of them, in time. Signal Desk runs the firm’s own intelligence work and is not sold. PromptGuard is open to a small number of design partners. The rest are prototypes, listed so you can see what the firm is working on rather than as something to buy.

If the tool you need does not exist, that is a solvable problem.

info@vandien.io · (551) 236-3191 · Ridgewood, NJ, serving clients worldwide

Start the conversation