Investigation software for a defensible case file
Whoever grants a permit or takes on a client has to be able to explain that choice years later. Noctua puts what every source returns into the same form and records where each item came from and when. Which signals are switched on is part of what makes it a Bibob, healthcare or Wwft investigation. You set those yourself; the judgement stays with your organisation.
In every case you need to know something about a party before you commit to it.
Government
Bibob and permits
A permit application whose structure does not add up, and a decision period that keeps running. Is your own investigation sufficient?
Healthcare
Contracting and care providers
A new provider wants a contract, and behind the director sits a chain of companies. You want that in view before the money moves.
Business
Customer due diligence and suppliers
A supplier you approved years ago, and a regulator asking when you last looked.
One place, whichever the source
Every source has its own entrance. In Noctua you query them from the platform and everything arrives in the same structure, matched on a unique key. The platform matches only on a unique key and does not guess on resemblance. If you draw a connection yourself that no key could establish, the network keeps showing that it came from you. What you query and what the source returns is recorded in the file, together with the moment and the user. That is what keeps the file together.
The difference shows when you have to account for it
When you have to account for the investigation, the question is not what you found. The question is how you got there.
Two depths, one file
Screening
A fixed result with a fixed structure
The company, who is behind it, where control sits, and what has changed in recent years. The content differs per application, the form does not, and the result is not open to editing.
Investigation
Going deeper from a single company
Going deeper comes into play when there is cause and a legal basis for it. From the company the investigation starts with, you query what is attached to it and retrieve what the sources return. What you may query differs per type of data and follows from your powers.
Both depths sit in the same file. The deeper work starts where the screening stopped, without a handover and without a gap in the log.
What changes after the decision
A permit runs for years and so does a contract. You set for yourself what you still want to know afterwards about the parties from the investigation.
An alert arrives in the file the investigation is already in.
The judgement stays with your organisation
Noctua flags, it does not judge. The platform grants or refuses nothing and gives no score and no final conclusion. Your organisation decides on its own and has to be able to justify that decision itself. When you weigh a flag, your assessment is placed next to the finding, with your name and the moment; the finding stays as the source gave it.
What the system flags follows from fixed rules your organisation has set. There is no model that learns from earlier files.
The report grows with the investigation. The fixed sections and the flags found are in it before you start writing. What you establish per alert and what you base that on, you add yourself. You can only close it when nothing is left open.
Your policy, written out as rules
Which sectors and grounds lead to further investigation is determined by your own organisation. In Noctua these become the flags themselves, marked in the case file as a red flag:
- Earlier case file
- If a company or person in the application already appears in an earlier case file, a red flag follows with a reference. The flag also appears when that case file belongs to another team; whether you can open it depends on your rights to it.
- Sector
- If the SBI-code (the Dutch standard industrial classification code) falls within the risk sectors you have designated and the registration was changed less than six months ago, one follows.
- Combination
- If the SBI-code was changed after the application and the director appears in an earlier case file, one follows.
Each rule can be switched on or off individually, with a threshold value where applicable. If your policy is revised, the rules change with it. We configure that together with you, so that what is in the system matches what you have established.
Two advisory reports from the National Bibob Bureau, and the refusal still did not hold. The mayor had not sufficiently reasoned why the alleged relationship amounted to a business relationship, even when the facts were assessed in conjunction.
Administrative Jurisdiction Division of the Council of State (Netherlands), 27 August 2025 · ECLI:NL:RVS:2025:4128
The advice is not the decision. What the administrative authority established itself, and on what basis, is what counts.
What your colleagues will ask
The data protection officer, IT and procurement ask largely the same questions: where the data sits, who can reach it, what the log records, and what happens if your organisation stops. Those answers are written out on one page, so you can forward them before the conversation starts.
An investigation from start to finish
No tour of screens. We work through a single investigation, from the first question to the closed case file, including the log that forms underneath it. At the end you see the file that results.