Convoy
Sign in Start free
SolutionsRegulatedMulti-site

For companies that can't stop.

A hospital can't stop admitting. A payments company can't stop settling. A plant can't pause the line while someone works out which laptop is talking to a server overseas.We built Convoy for places where
the downtime is the incident.

Healthcare · Behavioral health · Senior care

The BAA gets signed first. Everything else follows from it.

Clinical systems that never switch off and dozens of facilities on one network. Convoy covers every site from one console and puts the sign-in, the mailbox and the workstation in the same investigation, so a phished account doesn't become a facility-wide outage.

What Convoy covers

  • Entra ID and Google Workspace sign-ins and MFA changes
  • Microsoft 365 and Gmail mail flow and mailbox rules
  • Every workstation, through Convoy Agent
  • Firewalls and switches at every site
  • Imaging, badge and other IoT devices, seen through the network
  • Reporting built for HIPAA audits and cyber insurance questionnaires

Contract terms

  • BAA signed first, and it governs data ownership
  • 99.95% uptime commitment
  • Convoy doesn't store PHI
Financial services · Payments · Insurance

When the examiner asks who did what, you hand over the log.

Constant fraud pressure and regulators who want proof. Convoy watches identity and cloud activity across AWS, Azure, Entra ID and Google Workspace together, and every action anyone takes, a person or a playbook, is written to an audit trail you can export.

What Convoy covers

  • AWS CloudTrail and Cognito
  • AWS Cognito, Entra ID and privileged sign-ins
  • Email security and message trace
  • Every response action written to an audit log you can export
  • Evidence export for PCI DSS, NYDFS Part 500 and SOC 2 reviews
  • Convoy doesn't store cardholder data
Manufacturing · Retail · Distribution

Isolate one machine. Keep the line running.

Plants, warehouses, showrooms and e-commerce, often on flat networks with machines nobody wants to touch. Convoy reads your firewalls and switches natively, and takes one compromised host off the network while the rest of the floor keeps working.

What Convoy covers

  • FortiGate, SonicWall, Meraki and Aruba
  • Cameras, controllers and other IoT on the floor, seen through the network
  • Remote access tools like ScreenConnect
  • Shop-floor and warehouse workstations through Convoy Agent
  • Host isolation that leaves everything else online
  • Storage and infrastructure telemetry
Real estate · Property

The fake wire instruction and the hijacked inbox, caught as one.

Business email compromise goes where the closings are. Convoy reads mail flow and sign-ins side by side, so a spoofed invoice and the account takeover behind it show up as a single lead. One action pulls the message out of every mailbox.

What Convoy covers

  • Microsoft 365 and Google Workspace message logs
  • Proofpoint TAP
  • Mailbox rules, forwarding and sign-ins
  • Purge from every mailbox in one action
  • Account disable with one-click re-enable
Managed service providers

Put a real security operation behind every customer you serve. Make money doing it.

One partner agreement for the platform, Convoy Agent and operators, priced to leave room for your margin. Start with one customer, then roll out across your book.

See the partner program

What partners get

  • One agreement for the platform, Convoy Agent and operators
  • Pricing that leaves room for your margin
  • Managed, co-managed or self-managed, chosen per customer
  • Engineers on call

Tell us what you can't afford to lose.

We'll show you how Convoy protects it, using the systems and sources you actually run.

Start free · 14 daysBook a briefing