Obala AI platform

Obala AI gives your team a private AI research assistant for security, intelligence and investigative work. It combines purpose-built Obala models with document understanding, current-source web research and reusable knowledge, all in one Obala web application.

Obala responds in British English and is designed for professional users working on authorised engagements, from penetration testing and malware research to incident response, policy review and investigative analysis.

Obala is developed by ScaryByte to improve and enhance cybersecurity operations and allow law-enforcement agents to operate in-house technologies without the need to be technical.

Obala was created and developed by Karim Jaber, the CEO at ScaryByte. It is positioned as an enterprise and law-enforcement-grade research platform.

1. Open Obala. Open chat.obala.ai, or the Obala cloud portal address provided by your administrator, in Firefox, Chrome or Edge.
2. Sign in. Use the account your administrator has created for you. Self-registration is switched off, so contact your administrator if you need access or a password reset.
3. Check your model. The model picker in the message box shows the Obala Synapse model that will answer, with your current selection shown by name. The picker lists only the models your administrator has enabled for you. See models.
4. Start a chat. Type a question, pick one of the suggested starting points, or attach files with the + button in the message box.

Suggested starting points

The Synapse models offer starting points for common research tasks. Select one and replace any placeholder with your actual question or identifier.

For a larger case, ask for an investigation plan first. Managed reconnaissance and pentest execution are currently unavailable; discussion and analysis of research material remain separate from running tools.

Obala Synapse on Obala Cloud

Model availability for your organisation is confirmed when you register.

Thinking controls and answer room

Use the controls shown for the selected model. Thinking, reply length and available context are different settings. Long histories, files and tool results leave less room for a reply; check notices about reduced space or a cut-off answer. A thinking indicator does not promise an expandable transcript of internal reasoning.

In longer chats, Obala Synapse 1.0 and Obala Synapse 1.0 Flash can prepare a working summary of earlier conversation and tool evidence to leave room for the next answer. Your original messages and evidence remain saved, and Obala can retrieve exact earlier passages from the same conversation when needed. Preparing a continuation adds processing time; the chat shows its progress. A summary is a working aid and may not contain every detail, so ask for the original passage when exact wording matters. If a continuation cannot be prepared, Obala reports the problem and keeps the originals. Each request still has a context limit, and a single oversized message may need to be split. This feature continues the current conversation; it does not train the model or create memory across separate chats.

Where delegation is enabled, Obala can use sub-agents and wait for their returned work before combining an answer. This adds model calls and time; it does not expand the context available to each individual request. Background delegation is not currently enabled.

Accepted formats

Obala accepts common office documents and a wide range of developer and infrastructure files. Upload via the + button in the message box, then check the upload and processing status before relying on the file in an answer. If the file exceeds a limit, uses an unsupported format or cannot be read, follow the reported error; a successful upload alone does not mean its text has been processed.

Formats not accepted

• doc
• epub
• msg
• odt
• ppt
• audio
• video
• bin
• exe
• archives

Legacy Office formats such as .doc or .ppt should be converted to .docx, .xlsx or .pptx first. Audio and video are not processed. The upload reader extracts text from supported screenshots and photos. Image features depend on the selected model; text recognition is not a guarantee that every visual detail is understood. Files without an extension (for example a bare Dockerfile or .env) should be renamed with a recognised extension before upload, such as Dockerfile.txt or app.env.

Two ways to organise material

Knowledge and reusable material

Knowledge collections and notes are available where enabled for your account and selected model. Use a collection for reference material you want to revisit, with access controlled by its owner or administrator. Uploaded and indexed material can inform answers without training the model’s weights.

Document tools and investigation reports

A large source may appear as a clearly labelled report overview with its full original embedded as a PDF attachment and included in the ZIP. The overview does not claim every field is printed. Chat summaries and bounded previews are separate from complete original downloads.

1. Define the question. Provide the identifier and what you want to establish. Synapse and Flash can select an investigation method for a person, organisation, email, phone, username, domain, IP address, repository or file. A method guides the work; it does not itself run a lookup.
2. Follow collection. Watch each source’s status. A queued or running source has not finished; a returned record does not prove every source succeeded. Keep the lookup reference.
3. Check the same lookup. Ask “Check the status of this lookup and wait for the existing results.” Status reads retained state without placing a new provider query. Interrupted or uncertain work stays identified as such; it is not silently submitted again.
4. Explore the full result. Open the results panel, expand records and nested fields, move through pages and use original downloads. Ask “Show more detail from this retained lookup” to inspect received data rather than repeat the lookup.
5. Correlate with evidence. Compare dates, identifiers and source context. A shared name, old exposure or matching username is an observation, not proof of present ownership, identity or compromise. Ask the assistant to separate confirmed links from possibilities.
6. Create a report. Choose Create PDF report in the results panel, or ask for an Obala PDF from that retained lookup. This snapshots the received evidence without rerunning the lookup. Wait for publication before downloading the report and originals.

Keep an investigation in a case

Open Investigations, choose New and record the case title and objective. Reopen an existing case to continue from its evidence, findings and open questions. In a chat with Obala Cases enabled, ask to bind that chat to the chosen case. Creating or binding a case is explicit; existing chats are not automatically turned into investigations.

1. Bring in the evidence. Upload an original file or attach a retained lookup reference. Attaching or synchronising received lookup results reads existing evidence; it does not repeat a paid source query. A deliberately new lookup or continuation remains a separate action.
2. Record what is established. Keep findings, observations and open questions distinct. Link a finding to its original artifact and exact source location. Original bytes, their hashes and derived material remain separately identifiable; an interpretation does not replace its source.
3. Save a version. Use a case snapshot to record the evidence and findings used at that point. Open Versions and Open connections to inspect the retained relationships and their source references. The graph is read-only and shows bounded pages with explicit coverage.
4. Export for the next step. The case evidence ZIP contains the saved originals and inventory. A PDF report is the readable report from a case snapshot; its supporting report bundle is a separate export. Read the snapshot and coverage details to know which evidence each export includes.

Images, text and location evidence

Obala Synapse 1.0 can inspect image content. Flash uses available extracted text and metadata rather than native image understanding. The case image workflow keeps the original, extracted metadata and recognised text separately, with references back to the image. Text extraction can miss small, rotated or unclear content; inspect the original and the reported processing state.

Recorded location metadata and a location inferred from visible clues are different findings. Missing GPS metadata does not establish where an image was taken. Treat an inferred place as a hypothesis until supported by source evidence; a recognised landmark does not establish an exact camera position or capture time.

Read usage without guessing the cost

Open Usage in the selected case for recorded activity and its coverage. Physical model or source invocations and historical aggregate records are shown separately; do not add both as if each represented a new request. Unknown usage or incomplete collection remains explicit.

AI usage is shown separately from HTC for OSINT and profiling and KICU for tools. 1 HTC = R1 and 1 KICU = R1. This conversion does not set how many units an operation consumes. Where rates, allowances or an amount due are not configured or known, the view says so rather than showing a zero price. An automatic-reload preference does not mean a reload payment has been executed.

Explore retained connections

Open Connections in the results panel to explore the same retained lookup as a graph or table. This view is read-only: selecting a node or connection shows its source reference and an Open original evidence link. It does not edit evidence or start another lookup.

Connections show source records and exact matching identifiers found in those records. A matching identifier or values appearing together are observations, not proof of identity, ownership or a real-world relationship. Pages show a bounded part of the graph; check the processed-record counts, source coverage and incomplete status before drawing conclusions. Use the original evidence links and downloads to inspect the full received values.

Returned provider fields, unknown fields, nested values and duplicate observations remain available in the retained evidence. The chat answer is a summary, not the entire response. Source-imposed omissions, time limits or unavailable pages remain explicit; Obala does not invent the missing data.

Some source operations can finish later and offer updated retained results. Use Show updated results when offered. A deliberately new lookup or a different subject can consume a new provider query; changing the presentation of existing evidence should use the retained reference.

1. Open your GitHub tool settings. Find Obala GitHub in your available tools and open its personal settings. The current settings editor calls these Valves. If the tool is absent, ask your administrator to enable it for your account.
2. Save your personal connection. Enter your own GitHub access token in access_token, set token_kind to pat for a personal access token, and save. Optionally set preferred_repo to owner/repository and preferred_ref to a branch, tag or commit. Use this settings field, not a chat message. The current token field is visible text.
3. Check the connection. In a chat with the tool enabled, ask it to check your GitHub connection and list the repositories available to your account. Access follows your token’s actual repository permissions and any organisation approval.
4. Choose a repository and revision. Ask for a file, directory, search, diff, history, issue or pull request. Keep the returned commit and source links when continuing a review. Large results may require another page or a file continuation.

Browser “Sign in with GitHub” onboarding is not currently available. Reconnect by updating your own token in the same settings. To disconnect Obala, clear that saved token and save; this does not revoke the token at GitHub.

Reading a repository does not execute its code or alter it. Supported write actions are separate requests and require the repository permissions for that action. If a token expires or access is removed, the connector reports the failure rather than using another user’s connection.

Where Obala Research is enabled, ask which sources and modes are available before starting. These sources extend the research toolkit; your existing OSINT tools and ordinary web search remain available separately.

1. Check capabilities. Ask “Which Obala Research sources and modes can I use?” Availability and supported options can differ by source.
2. Start the selected lookup. State the source, mode and subject. Keep the lookup reference returned in the chat. Watch the source’s status while collection runs.
3. Follow the same work. Ask for the status of that lookup, including after reconnecting. A status check does not start a replacement lookup. If acceptance is uncertain, keep the reference and check the existing work rather than submitting it again.
4. Read or continue deliberately. “Show more retained detail” reads data already received. “Continue this lookup for more source pages” makes additional provider requests when a continuation is available. Further pages can consume supplier usage; a page limit reached with more results remains partial.
5. Create the PDF. Open the results panel and choose Create PDF report, or ask for a report from that retained lookup. Wait for file publication, then download the PDF and available originals or evidence ZIP. This uses the saved evidence without repeating the source query.

Standard plan

R16,480per user per month · USD $1,000 · default for law enforcement

Models

Obala Synapseon both plans, at the same full quality

Registration

By requestsupport@scarybyte.co.za

Plans

Plan comparison

Both plans include the Obala Synapse models at the same full quality, and future Obala Synapse versions as they are released.