This is the abridged developer documentation for Oyster # Oyster documentation > Learn Oyster, from your first question to scoped Red Team plans, SOC Copilot investigations and cited answers over your own files. Oyster is a cybersecurity AI assistant made by [Red Orca](https://redorca.tech/). Ask it how an attack works and how to detect and prevent it. With a free account you can also ask about your own files and get answers that cite the passages they used, plan authorized tests inside a scope you declare, and work through incident evidence in SOC Copilot. Oyster explains and plans. It has no access to your systems and runs nothing against them. ## What Oyster is today Without an account Chat about security engineering, one message a day. The conversation stays in your browser and is never used for training. With a free account No daily limit, saved history, a choice of models, and the full workspace: your files, Red Team, Blue Team, Security Intelligence and Findings. Running tools against real hosts and connecting live security monitoring (SIEM) systems are not offered to accounts. See [Access and accounts](/get-started/access/) for exactly what each level includes. ## Browse the documentation [About Oyster](/about/)Who it is for, what it does, pricing and its limits. [Access and accounts](/get-started/access/)What you can do with and without an account. [Your first conversation](/get-started/first-conversation/)Ask, choose a depth, follow up, rate the answer. [Upload and organise files](/get-started/files/)Ask questions about your own documents, images and video. [Red Team](/guides/red-team/)Declare a scope, plan an assessment, turn findings into fixes. [Blue Team](/guides/blue-team/)SOC Copilot cases, CVE investigation, logs and response plans. [Security Intelligence](/guides/security-intelligence/)Exact CVE, CWE, CAPEC, ATT\&CK and D3FEND lookups, with sources. [Evidence and citations](/understand/evidence-and-citations/)How answers are grounded, and how to check them. [Data and privacy](/understand/data-and-privacy/)What is stored, what is used for training, and how to delete it. [FAQ](/reference/faq/)Short answers to the questions people ask first. # About Oyster > Oyster is Red Orca's free cybersecurity AI assistant. Who it is for, what it does with and without an account, a worked example, pricing and what it does not do. Oyster is Red Orca’s AI assistant for security work. Ask how an attack works and how to detect and prevent it. With a free account you can also question your own files and get cited answers, plan authorized tests inside a scope you declare, and work through incident evidence in SOC Copilot. Oyster explains and plans — it has no access to your systems and runs nothing against them. [Open Oyster](https://redorca.ai/) to start; one message a day needs no account, and a free account removes the daily limit. ## Who it is for Offensive technique is in scope as education for defenders: Oyster explains how attacks work so you can detect and prevent them. * **People learning security.** Students and career-changers who want attacks, defences and tools explained plainly, with concrete examples instead of generalities. * **Security practitioners.** Penetration testers, SOC analysts and detection engineers who want a second pair of eyes on a plan, a log, a rule or a piece of code. * **Teams doing authorized work.** Security teams that plan tests against systems they are allowed to test, and want the scope written down before anything else happens. ## What it does today What you can use depends on whether you have an account. Both are free. ### Without an account * Chat about security engineering: vulnerabilities, secure coding, hardening, threat modelling, incident response and defensive architecture. * One message a day. * The conversation stays in your browser — it is never stored on our servers and never used for training. * Files you attach go into a temporary space tied to your browser and are deleted after 30 days without use. ### With a free account * **Chat** — no daily limit, your history saved to your account, and a choice of models. One answer is generated at a time. * **Questions over your own files** — upload documents, images or video to your private workspace and ask about them. Answers cite the passages they drew on. Up to 20 uploads a day, 50 MB per document, 500 MB in total. See [Upload and organise files](/get-started/files/). * **Red Team: Scope, Recon, Planner, Fix Advisor, Code Lab** — declare what you are authorized to test first. Recon and test plans are only written for targets inside that scope, and Oyster only writes them: it does not scan, probe or run anything. See [Red Team](/guides/red-team/). * **Blue Team: SOC Copilot, Security Intel, Cook Book** — a workbench for investigations: open a case, attach evidence, build a timeline, track indicators of compromise, map activity to MITRE ATT\&CK, draft detection rules for Sigma, Splunk SPL and Elastic KQL/ES|QL, follow playbooks and export a report. See [Blue Team](/guides/blue-team/). * **Findings** — keep what you learn as findings. They are private by default; you can share one as a read-only link, or publish it to a feed other signed-in users can read. See [Findings and sharing](/guides/findings/). Not offered to accounts: running tools against real hosts, and connecting live security monitoring (SIEM) systems. Those stay with Red Orca’s own operators. ## A worked example: from a question to a detection An illustrative walkthrough of the workflow — not a recorded answer. Real answers vary with the question and the model. 1. **You ask:** “What is Kerberoasting, and how would I spot it in our Windows event logs?” 2. **What Oyster does:** explains the technique — MITRE ATT\&CK T1558.003: an attacker with any domain account requests Kerberos service tickets and tries to crack them offline to recover service-account passwords — and names the logs where it shows up. It connects to nothing and runs nothing. 3. **What you get back:** the events to watch (Kerberos service-ticket requests, Windows event ID 4769, especially RC4-encrypted tickets), a starting point for a detection rule you can draft in SOC Copilot, and hardening steps: long random service-account passwords, managed service accounts, AES-only encryption. 4. **The limits:** the answer comes from a language model. Check it against your environment and the vendor’s documentation before you act. Oyster sees your logs only if you upload them to your own workspace. ## Pricing and access Oyster is free. The same Red Orca account also opens Dolphin and Shark. | | Without an account | Free account | Openweight editions | | --------- | ---------------------------------- | ----------------------------------------------------------------------------------- | -------------------------------------------------- | | Price | Free | Free | Not yet on sale | | Chat | One message a day | No daily limit | — | | Workspace | — | Files, Red Team, Blue Team, Security Intelligence, Findings | — | | Your data | Conversation stays in your browser | Conversations are used to improve Oyster ([details](/understand/data-and-privacy/)) | Questions and files would stay on your own machine | Openweight editions — Oyster packaged to run on your own hardware — are listed in the app’s Openweight tab but are not on sale yet. ## Your data, in short * **Without an account**, your conversation stays in your browser. It is not stored on our servers and never used for training. * **With an account**, your conversations are stored in your account, visible only to you, and used to improve Oyster’s AI. That is a condition of the free account, not an optional extra. Exchanges that contain credentials are dropped from training data. You can withdraw in Settings — which also ends chat access — or delete your account and its data there at any time. * Files you upload stay in your own private workspace. Other accounts cannot see them. * Oyster’s models run on infrastructure Red Orca operates in the EU. Your conversations are not sent to a third-party AI provider. The full detail is in [Data and privacy](/understand/data-and-privacy/), the [privacy policy](https://redorca.tech/privacy#oyster) and the [terms of service](https://redorca.tech/terms#oyster). ## What Oyster does not do * Answers come from a language model and can be wrong. Verify anything you act on. * Oyster has no access to your systems. It cannot scan, probe or exploit anything, and you remain responsible for being authorized to test the systems you discuss. * It runs on Red Orca’s own hardware, so answers can take several seconds, and each account gets one answer at a time. * It is not a substitute for professional incident response, legal advice or a penetration test. ## Further reading * [Security AI should understand the attack — without becoming the attack](https://redorca.tech/blog/security-ai-understands-the-attack) * [Cybersecurity has a knowledge problem. We’re building Oyster to solve it.](https://redorca.tech/blog/cybersecurity-knowledge-problem-oyster) ## Who makes Oyster Oyster is made by [Red Orca](https://redorca.tech/), a European software company that builds AI agents. Its other products are Dolphin, which makes outbound sales calls and sends email, and Shark, which keeps a team’s organizational memory. One account signs you in to all three. Questions: . # Access and accounts > What you can do in Oyster without an account and with a free Red Orca account, how to sign up, and the agreement every account accepts. Oyster has two levels of access, and both are free. You can open [redorca.ai](https://redorca.ai/) and ask a question straight away; a free Red Orca account opens the rest of the workspace. ## What each level includes | | Without an account | Free account | | ---------------------------------------------------------------- | ------------------------------------------------------------------- | ---------------------------------------------------------- | | Chat | One message a day | No daily limit | | Follow-up questions | Each message is answered on its own | The conversation’s earlier messages are taken into account | | Prompt length | Up to 4,000 characters | No fixed character limit | | Model | One smaller model | A choice of models | | History | Kept in your browser only | Saved to your account | | Attached files | 5 a day, 100 MB in total, in a temporary space tied to your browser | 20 a day, 500 MB in total, in your private workspace | | Questions over your files (RAG Analyst) | — | Yes, with citations | | Projects | — | Yes | | Red Team: Scope, Recon, Planner, Fix Advisor, Code Lab | — | Yes | | Blue Team: SOC Copilot, Security Intel, Cook Book, Notes, Shield | — | Yes | | Findings and sharing | — | Yes | | Long-term memory | — | Yes, and you control it | The full list of numbers is on [Limits and quotas](/reference/limits/). ## Create an account 1. Open [redorca.ai/login](https://redorca.ai/login) and choose to create an account, or continue with Google. 2. Confirm your details and sign in. 3. Read and accept the agreement (below). Chat opens as soon as you accept. One Red Orca account signs you in to Oyster, Dolphin and Shark. If you already have an account on [redorca.tech](https://redorca.tech/), use the same email and password — but sign in once on redorca.ai, because a sign-in on one site does not carry over to the other. ## The agreement Before your first message, a signed-in account is asked to accept Oyster’s agreement. The part that matters most: **conversations in your account are used to improve Oyster’s AI.** That is the condition of the free account. Exchanges that contain credentials are dropped from training data rather than redacted. You can read the agreement again, or withdraw it, at any time in **Settings** (the wheel in the sidebar footer). Withdrawing does two things immediately: your chats are excluded from every dataset built afterwards, and your chat access ends, because acceptance is what grants it. You can accept again later. A model that has already been trained cannot be untrained. Without an account nothing is stored on our servers and nothing is used for training. See [Data and privacy](/understand/data-and-privacy/). ## Next * [Your first conversation](/get-started/first-conversation/) * [Upload and organise files](/get-started/files/) # Manage conversations > Start, continue, rename, pin, edit and delete conversations in Oyster, and know when a fresh chat gives better answers. With an account, every conversation is saved to your account and listed under **History** in the sidebar. Without an account, history is kept in your browser only. ## The basics * **Start:** click **New Chat**. A fresh chat opens immediately, and a new visit always opens a clean chat rather than your last one. * **Continue:** pick any chat from History. It loads its messages and you carry on with the full context of the conversation. * **Rename or pin:** use the **⋯** menu on a history row. Pinned chats stay at the top. * **Edit a message:** hover your own message and choose **Edit**. It resends with your change and regenerates the replies below it. * **Delete:** **⋯** → **Delete**. Deleting the open chat opens a fresh one; other chats are untouched. ## When to start a new chat * When you switch to an unrelated topic. Long, mixed threads dilute the context and slow answers down. * The model has a limited context window, so a fresh chat for a new task usually gives sharper answers. * Keep one focused thread per task, and pin the ones you come back to. ## If a conversation will not open You see an error with a **Try again** button rather than a blank screen. Retry; if it persists, the conversation may have been deleted. Your other conversations are unaffected. # Upload and organise files > Add documents, folders, images, video and notes to Oyster, follow their processing, and ask questions that cite the passages from your own files. Oyster can answer from your own material: a scope document, an architecture note, a log export, a screenshot, a recorded walkthrough. Answers about your files cite the passages they used. ## Add material Use the **+** button next to the message box: | Option | What it takes | | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Upload Files** | PDF, Word (`.docx`), and text and code files — Markdown, logs, JSON, CSV, YAML, configuration files, HTML, SQL, shell and PowerShell scripts, and source code in common languages | | **Upload Folder** | A whole directory; folder structure is kept | | **Upload Image** | PNG, JPEG, WebP, GIF, BMP, TIFF and SVG. Oyster reads text in the image and describes it | | **Upload Video** | MP4, MOV, WebM, MKV, M4V and AVI. Oyster transcribes the audio with timestamps and describes sampled frames | | **Create Note** | Text you type straight in | With an account, files go into the active [project](/get-started/projects/). Without an account, they go into a temporary space tied to your browser, which is deleted after 30 days without use. ## Follow processing Each item shows a status chip while it is processed. Once it says **ready**, it is searchable. * Large files, and video especially, take longer. * **failed** shows the reason when you hover it. An unsupported or damaged file is refused rather than half-read. * The sparkle icon summarises an item; **×** removes it. ## Ask about your files Ask in chat, or switch to **RAG Analyst** in the sidebar (account needed) for questions answered from your project’s files. Each answer lists its sources; click one to read the exact passage, and for video, the timestamp it came from. See [Evidence and citations](/understand/evidence-and-citations/). ## What happens to sensitive content * Location data (GPS) is removed from image metadata. * Secrets that appear in files — keys, tokens, passwords — are masked in previews and in the search index. The original file is still yours to view. * Your files are visible only to you. See [Isolation](/understand/isolation/). ## Limits | | Without an account | Free account | | --------------- | ------------------------ | ------------------------ | | Uploads per day | 5 | 20 | | Total storage | 100 MB | 500 MB | | Document | 50 MB | 50 MB | | Image | 25 MB | 25 MB | | Video | 100 MB, up to 30 minutes | 100 MB, up to 30 minutes | | Folder | 800 files, 250 MB | 800 files, 250 MB | ## Troubleshooting * **The answer ignores my file.** Check that it says **ready**, then name the file or its subject in the question. * **Upload refused.** Check the size and type above, and your daily allowance. * More on [Troubleshooting](/reference/troubleshooting/). # Your first conversation > Ask Oyster a question, choose how deep the answer should go, follow up, stop or edit a message, and rate the answer. Open [redorca.ai](https://redorca.ai/), type your question in the box at the bottom and press **Enter**. **Shift + Enter** starts a new line. The answer streams in as it is written. ## Choose a depth Above the message box, **Depth** sets how much detail you get: | Depth | What you get | | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | | **Quick** (default) | A plain-language answer of roughly 100–220 words, answer first. | | **Technical** | Concrete mechanisms, protocol details, detection signals, failure modes and mitigations. | | **Guided** | An organised defensive or lab workflow in numbered stages, with prerequisites, checkpoints, expected observations, cleanup and hardening. | | **Lab** | A reproducible workflow for your own approved lab, with assumptions, placeholders, validation, rollback, cleanup and audit points. | Start with Quick and switch up when you need the detail. ## Follow up With an account, Oyster takes the earlier messages of the conversation into account, so “and the second one?” works. Without an account, each message is answered on its own; include the context in the question. Each account gets one answer at a time. If Oyster is busy with many people, it tells you and shows your place in line — wait rather than resending. ## While and after it answers * **Stop** ends an answer that is going the wrong way. * **Edit** (hover your own message) changes it and regenerates the replies below it. * **👍 / 👎** rate the answer. A thumbs-down with a correction tells Oyster what the answer should have been, and that correction is recalled on your next message. * **Pin** keeps an answer easy to find, and **save as Finding** keeps what you learned. See [Findings and sharing](/guides/findings/). ## Pick a model With an account, the picker in the sidebar footer lets you choose a model. Larger models give stronger answers to harder questions but are slower. Without an account, Oyster uses one smaller model. ## Suggested questions An empty chat shows a few suggested questions. Click one once: it opens the chat, sends the question and streams the answer. ## Next * [Verify an answer](/guides/verify-an-answer/) before you act on it. * [Write better questions](/guides/better-questions/). # Install Oyster as an app > Install Oyster on Android, iPhone, iPad or your desktop so it opens in its own window like an app. Oyster can be installed from the browser, so it opens in its own window from your home screen or dock. It is the same Oyster as on [redorca.ai](https://redorca.ai/), with the same account. ## Android, and desktop Chrome or Edge When your browser can install Oyster, a download icon appears in the sidebar footer. Click it and confirm **Install app**. You can also use the browser’s own menu → **Install app**. ## iPhone and iPad 1. Open [redorca.ai](https://redorca.ai/) in **Safari**. 2. Tap **Share**, then **Add to Home Screen**. 3. Confirm. Oyster now opens from its icon. ## Installed it from the old address? An app installed from `redorca.tech/oyster` before the move opens the new address in a browser tab. Remove it and install again from [redorca.ai](https://redorca.ai/). See [Moving from redorca.tech](/get-started/moving-from-redorca-tech/). # Moving from redorca.tech > Oyster moved from redorca.tech/oyster to redorca.ai on 30 October 2026. What changed, what you need to do, and how to bring browser-only history across. Oyster used to live at `redorca.tech/oyster`. Since **30 October 2026** it has its own address: [redorca.ai](https://redorca.ai/). The old links redirect there. ## If you have an account Nothing moves, because nothing needs to: your account, conversations, files, findings and memories are the same. **Sign in once on redorca.ai** — a sign-in belongs to one site, so the one on redorca.tech does not carry over. Use the same email and password, or Google. ## If you used Oyster without an account Your history lived only in your browser, on the old address. To bring it across: 1. Open [redorca.tech/oyster/migrate](https://redorca.tech/oyster/migrate) in the same browser you used before, and choose **Download my local history**. You get a JSON file. 2. Open [redorca.ai/migrate](https://redorca.ai/migrate) and choose that file. Oyster shows what it contains before importing. What moves: your anonymous chat history, your Code Lab snippets, and an answer that was still being written. What does not: any sign-in. Exporting deletes nothing. ## If you installed Oyster as an app Remove it and install again from redorca.ai. See [Install Oyster as an app](/get-started/install-app/). # Projects > A project holds one body of work in Oyster — its conversations, files, scope and findings. Create, switch, rename and delete projects. A project (or engagement) is the container for one body of work. Its conversations, uploaded files, Red Team scope, findings and long-term memory all live together, so switching projects switches the material Oyster works from. Projects need an account. ## Create a project 1. Open the project switcher at the top of the sidebar. 2. Choose **New project** and give it a name. 3. It becomes active immediately; new chats and uploads land in it. ## Switch, rename or delete Switch from the same menu at any time. Rename or delete a project from its row’s actions. A deleted project is removed from the switcher, and that cannot be undone. ## Who can see a project Only you. Every project belongs to your account, and other accounts cannot list, open or search it. See [Isolation](/understand/isolation/). ## Tips * One project per engagement or topic keeps answers focused: files from an unrelated project are not in play. * Set the [Red Team scope](/guides/red-team/scope/) in the project it belongs to. # Page not found > This page does not exist, or it moved. Search with Ctrl K, or start from the overview. # Write better questions > Get sharper answers from Oyster — be specific, use real identifiers, ask one thing at a time and pick the right tool and depth. ## Be specific * **Name the system, technology or file** you mean: “our nginx reverse proxy” beats “the server”. * **Use real identifiers:** CVE, CWE, ATT\&CK technique IDs, the exact endpoint or event ID. * **Ask one thing at a time,** then follow up to drill in. With an account, Oyster keeps the conversation’s context. * **Say what you want back:** a checklist, a detection rule, a remediation with a test, a short explanation. ## Pick the right tool | You want | Use | | ------------------------------------------------------------------------- | ---------------------------------------------------------------------- | | A concept explained | Chat, **Quick** depth | | The mechanism, signals and mitigations | Chat, **Technical** depth | | An answer from your own documents | **RAG Analyst**, after the files are **ready** | | Facts about a CVE, CWE, CAPEC, ATT\&CK technique or D3FEND countermeasure | **Security Intel** | | A plan for an authorized test | **Recon** or **Planner**, inside your [scope](/guides/red-team/scope/) | | An investigation with real evidence | **SOC Copilot** | ## If the answer is weak * Add specifics and identifiers; narrow the question. * For file questions, confirm the file is **ready** and use RAG Analyst. * Try a larger model from the footer picker. It is slower but stronger on hard questions. * Give the answer a 👎 with a correction. * Start a new chat if the thread has wandered across topics. # Blue Team > Oyster's Blue Team workspace for defenders — SOC Copilot investigations, Security Intel lookups, the Cook Book of playbooks and checklists, Notes and Shield. Blue teaming is defence: detecting, investigating and responding to threats, and hardening systems so attacks fail. Use Oyster’s Blue Team workspace for CVE triage, detection engineering, incident investigation and response planning. It needs an account and is in the sidebar under **Blue Team**. ## The tools | Tool | What it is for | | ------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [SOC Copilot](/guides/blue-team/soc-copilot/) | A case-based investigation workbench: evidence, detections, network data, timeline, indicators, MITRE ATT\&CK mapping, playbooks and reports. | | [Security Intel](/guides/security-intelligence/) | Exact lookups of CVE, CWE, CAPEC, ATT\&CK and D3FEND entries, known exploited vulnerabilities, and detection, mitigation and response questions — with sources. | | [Cook Book](/guides/blue-team/cook-book-and-notes/) | Playbook templates you can attach to a case, copyable shortcuts, ATT\&CK detection cards and triage checklists. | | [Notes](/guides/blue-team/cook-book-and-notes/) | Your own working notes. | | [Shield](/guides/blue-team/cook-book-and-notes/#shield) | A read-only reference for a separate scanner you run yourself. Nothing executes inside Oyster. | ## Common tasks * [Investigate a CVE](/guides/blue-team/investigate-a-cve/) * [Work with logs and indicators](/guides/blue-team/logs-and-indicators/) * [Turn evidence into a response plan](/guides/blue-team/response-plans/) ## Example requests * “Investigate CVE-2021-44228: severity, exploitation, affected versions, and how to detect it.” * “Write a Sigma rule to detect PowerShell encoded-command execution and explain each condition.” * “I have these indicators from an alert — which ATT\&CK techniques do they map to, and what should I check next?” * “Turn this incident evidence into a containment and remediation plan.” # Cook Book, Notes and Shield > The Blue Team reference tools in Oyster — Cook Book playbooks, shortcuts, ATT&CK detection cards and triage checklists; your own Notes; and Shield. ## Cook Book A reference library that works with [SOC Copilot](/guides/blue-team/soc-copilot/). Open **Cook Book** under **Blue Team**. It has four sections: * **Playbooks** — the playbook templates SOC Copilot uses. Browse them, and attach one to a case. * **Shortcuts** — curated commands and queries you can copy. * **ATT\&CK** — detection cards for common techniques. * **Checklists** — triage checklists. ## Notes Your own working notes, under **Notes** in the Blue Team menu. ## Shield **Shield** is a read-only reference: install and run commands, with copy buttons, for a separate scanner that you run on your own machine. Nothing executes inside Oyster. # Investigate a CVE > Look up a CVE in Oyster's Security Intel, read its severity, exploitation status and affected versions, and plan detection and mitigation. 1. **Ask Security Intel for the CVE by its identifier**, for example `CVE-2021-44228`. Open **Security Intel** under **Blue Team**. 2. **Read the direct answer**, with severity, exploitation status and affected systems, and open the sources it lists. 3. **Prioritise.** Check whether it is on the list of known exploited vulnerabilities (KEV), and its likelihood of exploitation (EPSS) where shown. 4. **Confirm exposure.** Compare your installed version with the affected range in the cited advisory. 5. **Plan detection and mitigation.** Ask follow-up questions in chat — “How would I detect exploitation of this in web server logs?” — or draft a rule in [SOC Copilot](/guides/blue-team/soc-copilot/). See [Security Intelligence](/guides/security-intelligence/) for everything Security Intel can answer. # Work with logs and indicators > Analyse Windows, Zeek, Suricata and PCAP evidence in SOC Copilot, extract indicators of compromise, match Sigma and YARA rules and map activity to MITRE ATT&CK. 1. **Open a case** in [SOC Copilot](/guides/blue-team/soc-copilot/) and attach real telemetry: Windows event logs (EVTX or JSON), Zeek logs, Suricata EVE JSON or a packet capture (PCAP). 2. **Extract indicators.** The **IOCs** tab lists the IP addresses, domains, URLs, email addresses and file hashes (MD5, SHA-1, SHA-256) found in the evidence, without duplicates. 3. **Match detections.** The **Detections** tab runs Sigma and YARA matching over the evidence. 4. **Build the timeline.** The **Timeline** tab puts events in order across sources; **Correlation** links related events and entities. 5. **Map to ATT\&CK.** The **MITRE** tab maps observed behaviour to techniques, and **Coverage** shows what your detections cover and where telemetry is missing. ## Tips * Structured data gives real results; plain text gives empty analyses, honestly. * Private IP addresses are tagged as such, so internal hosts are easy to tell apart from external ones. * Ask the case’s **AI Assistant**, or chat, to explain a technique or an indicator in context. * Record what each item turned out to be in **Dispositions**, so the case tells its own story. # Turn evidence into a response plan > Use Oyster to turn incident evidence into a response plan — establish what happened, contain, eradicate and recover, then harden. 1. **Establish what happened** from the evidence: the timeline, the affected assets, the indicators. 2. **Contain:** what to isolate or block now. 3. **Eradicate and recover:** remove the foothold and restore safely. 4. **Harden:** the detection and configuration changes that stop a repeat, each one testable. Ask Oyster for each step with the case’s facts in the question — “Given this timeline and these indicators, what should we contain first and why?” — or attach a **playbook** to the case in [SOC Copilot](/guides/blue-team/soc-copilot/) and work through its steps. Caution Oyster is not a substitute for professional incident response. For a live incident with real impact, involve your incident response team or provider. # SOC Copilot > SOC Copilot is Oyster's case-based investigation workbench — attach evidence, run Sigma and YARA detections, analyse network captures, build a timeline, map to MITRE ATT&CK and export a report. SOC Copilot is a workbench for investigations. You open a case, attach the evidence you have, and work through it in one place, with an AI assistant beside you. It needs an account; open **SOC Copilot** under **Blue Team**. ## Cases The dashboard lists your cases with their status. **Create** a case for each investigation. Inside a case, the tabs are: | Tab | What it does | | ---------------- | ----------------------------------------------------------- | | **Overview** | Summary, status and key facts of the case. | | **Evidence** | Attach files, and analyse Windows logs and YARA matches. | | **Detections** | Sigma and YARA matching over the evidence. | | **Network** | Packet captures (PCAP), Zeek and Suricata EVE data. | | **Timeline** | Events in order across the evidence. | | **IOCs** | Indicators of compromise extracted from the evidence. | | **MITRE** | Observed activity mapped to MITRE ATT\&CK techniques. | | **Correlation** | Related events and entities, linked. | | **Graph** | Entities grouped and connected. | | **Coverage** | Which techniques your detections cover, and telemetry gaps. | | **Playbooks** | Attach a playbook template and work through its steps. | | **Dispositions** | Record what each item turned out to be. | | **Notes** | Your notes on the case. | | **AI Assistant** | Ask about the case. | | **Report** | Export the investigation as Markdown or PDF. | ## Rule Authoring **Rule Authoring**, in the view switcher at the top, drafts a detection for **Sigma**, **Splunk SPL**, **Elastic KQL** and **ES|QL** from a one-line description of what you want to catch — for example “PowerShell spawning from Office with an encoded command”. Treat a generated rule as a draft: test it against your own data before you deploy it. ## Evidence that gives real results SOC Copilot analyses real telemetry: Windows event logs (EVTX or JSON), Zeek logs, Suricata EVE JSON and PCAP files. Plain text without that structure gives empty analyses — honestly empty, not invented. ## Privacy Every account has its own SOC Copilot database. No other account can see your cases, evidence or reports. See [Isolation](/understand/isolation/). # Findings and sharing > Keep what you learn in Oyster as findings, share one as a read-only link, or publish it to the feed other signed-in users can read. Findings are where you keep what you learn: a security observation with a title, severity, the affected endpoint and method, evidence and a fix. They need an account and live under **Findings** in the sidebar. ## Create a finding * From chat: **save as Finding** on an answer. * From Code Lab: promote a snippet to a finding. See [Code Lab](/guides/red-team/fix-advisor-and-code-lab/). * By hand, in Findings. Findings are **private by default**: only you can see them. ## Share and publish * **Share** creates a read-only link to one finding. Anyone with the link can read it; nobody can change it. * **Publish** puts a finding on the community feed, where every signed-in user can read it. You can make it private again at any time; it disappears from everyone’s feed immediately and stays in your own list. * On the feed, published findings show their author’s public nickname — “User 7” until you choose one in **Settings** — never your email address. * Reading someone’s published finding, you can reuse it: that starts a new chat in your own workspace, seeded with the finding. ## Reports **Add to Report** marks the findings that belong in a report. See [Findings and reports](/guides/red-team/findings-and-reports/) for writing findings that stand up. # Memory > Oyster's long-term memory remembers facts, preferences and decisions from your conversations, per project. Turn it on or off, review it, edit it, export it or delete it. With an account, Oyster can remember useful things from your conversations — facts about your environment, preferences, decisions, instructions — and recall them in later answers. Memory belongs to a [project](/get-started/projects/) and is visible only to you. ## Settings Open **Settings** (the wheel in the sidebar footer): | Setting | What it does | | -------------------------------------- | ------------------------------------------------------------------------ | | **Use long-term memory** | Recalls your memories in answers. Off means none are used. | | **Automatically save useful memories** | Saves facts and preferences from chats without asking. | | **Ask before saving** | Holds new memories for your review instead of saving them straight away. | ## Manage your memories **Manage memories** in Settings opens your memories in three tabs: * **Active** — what Oyster currently recalls. Edit or delete any of them. * **Review** — memories waiting for your approval, when **Ask before saving** is on. Approve or reject each. * **Conflicts** — memories that contradict each other. Keep the right one. **Export JSON** downloads all of them. ## What is protected * Memory content is encrypted at rest. * Credentials, card numbers and similar secrets are blocked from being saved as memories, whatever the conversation contained. * When a memory is updated, the old version is kept on record rather than silently overwritten, and contradictions are shown to you, never resolved behind your back. ## Delete * Delete single memories in **Manage memories**. * **Delete my memories** in Settings erases all of them. * Deleting your account erases them too. See [Data and privacy](/understand/data-and-privacy/). # Red Team > Oyster's Red Team workspace — Scope, Recon, Planner, Fix Advisor and Code Lab — for planning and documenting authorized security assessments. Authorization comes first. Authorized targets only — read first Only assess systems you own or have explicit, written authorization to assess. Testing anything else is likely illegal. You remain responsible for that authorization. Red teaming is authorized, goal-driven simulation of a real attacker, to find weaknesses before someone hostile does. Use it when you have permission to assess a system and want to know how it would fail. Oyster’s Red Team workspace helps you **plan, document and fix**. It writes; it does not scan, probe or run anything against any system. It needs an account and is in the sidebar under **Red Team**. ## The tools | Tool | What it is for | | --------------------------------------------------------- | ------------------------------------------------------------------------------------ | | [Scope](/guides/red-team/scope/) | Write down exactly what you are allowed to assess. The other tools check against it. | | [Recon and Planner](/guides/red-team/plan-an-assessment/) | Turn an objective into a structured, methodology-backed plan for an in-scope target. | | [Fix Advisor](/guides/red-team/fix-advisor-and-code-lab/) | Turn a finding into concrete remediation. | | [Code Lab](/guides/red-team/fix-advisor-and-code-lab/) | A copy-only scratchpad for your own snippets. Nothing runs on Red Orca’s servers. | | [Findings](/guides/red-team/findings-and-reports/) | Record what you found, with evidence and a fix, and build the report. | ## A safe workflow 1. **Set the scope** in the engagement’s project. 2. **Plan** with Recon or Planner for your objective. 3. **Do the testing yourself,** with your own tools and within your authorization, capturing evidence as you go. 4. **Record findings** and attach a remediation from Fix Advisor. 5. **Curate the report** so it tells a clean story: what, impact, proof, fix. ## What Oyster will and will not do * It explains techniques, tools and defensive countermeasures, for learning and for authorized work. * Target-specific plans are written only for targets inside your scope. For anything outside it, you get general methodology and a way to reproduce the question in your own lab instead. * It never runs an action against a live system for an account. See [Safety and approvals](/understand/safety/). # Findings and reports > Record Red Team findings with severity, evidence and remediation in Oyster, and curate them into a report that tells a clean story. A finding is a recorded security observation, with severity, evidence and, ideally, a fix. Findings live in **Findings** in the sidebar; how to save, share and publish them is in [Findings and sharing](/guides/findings/). ## Reading a finding * **Severity** reflects impact and exploitability. Treat it as a prioritisation aid, not an absolute. * **Evidence** is what makes a finding credible: the request and response, the output, or the citation behind it. * **Remediation** should be specific and testable. [Fix Advisor](/guides/red-team/fix-advisor-and-code-lab/) turns a finding into concrete steps. * A finding without evidence is a hypothesis. Capture the proof before you report it. ## Producing a useful report 1. Capture findings from chat as you work (**save as Finding** on an answer), or log them by hand. 2. Give each a clear title, a severity, the affected endpoint and the evidence. 3. Attach remediation from Fix Advisor. 4. Choose **Add to Report** for the findings that belong in the report, so it tells a clean story: what, impact, proof, fix. Findings are private by default. # Fix Advisor and Code Lab > Turn findings into concrete remediation with Fix Advisor, and keep your own code snippets in Code Lab — a copy-only scratchpad where nothing runs on Red Orca's servers. ## Fix Advisor Fix Advisor turns a finding into remediation you can act on. Open **Fix Advisor** under **Red Team**, describe the issue — or paste the affected code and what you observed — and Oyster writes: * the root cause, in plain terms; * concrete changes, with code where it helps; and * a way to test that the fix works. Remediation should be specific and testable. Attach it to the finding before you report it. ## Code Lab Code Lab is a **copy-only** Python scratchpad for your own snippets. * Write, save and organise snippets. They are stored in your browser. * **Copy** a snippet to run it in your own terminal, against systems you are authorized to use. * **Promote** a snippet to a finding, with a comment and a severity, so it lands in Findings. Nothing in Code Lab executes on Red Orca’s servers. Snippets kept in your browser on the old address can be brought across with [/migrate](/get-started/moving-from-redorca-tech/). ## Example requests * “Review this FastAPI endpoint for security issues and show the CWE for each.” * “Rewrite this query handler so user input can never change the SQL statement, and give me a test for it.” # Plan an assessment with Recon and Planner > Use Oyster's Recon and Planner to turn an objective and an in-scope target into a structured, methodology-backed test plan. Recon and Planner write plans; they do not touch the target. Set the [scope](/guides/red-team/scope/) first — both tools check the target against it. ## Recon Open **Recon** under **Red Team**, enter an in-scope target and what you want to learn. Oyster writes a reconnaissance plan: what to look at, in what order, and which public sources and techniques apply. You carry it out yourself, with your own tools. ## Planner Open **Planner**, enter the in-scope target and your objective — for example “authentication and session handling of the login flow”. Oyster writes a structured test plan grounded in established methodology: phases, the checks in each, what evidence to capture, and what a finding would look like. ## Work through the plan 1. Review the plan against your rules of engagement, and remove anything they do not allow. 2. Test with your own tools, within your authorization. 3. Capture evidence as you go: requests and responses, output, screenshots. 4. Record each issue as a finding. See [Findings and reports](/guides/red-team/findings-and-reports/). ## Example requests * “Draft a test plan for the login flow of my authorized target app.example.com, focused on authentication and session handling.” * “What should a reconnaissance plan for our in-scope staging API cover, and what evidence should I keep?” * “Turn this finding into a remediation with concrete code changes and a test that confirms the fix.” # Define an authorized scope > Record the targets you are authorized to assess in Oyster's Scope panel, so Recon and Planner only write target-specific plans for systems inside it. Scope is the contract. It records what you are allowed to assess, and Oyster’s Red Team tools check every target against it. ## Set the scope 1. Open **Scope** under **Red Team** in the sidebar, in the project the engagement belongs to. 2. **Project** — name the engagement. 3. **Allowed targets** — the URLs, domains, IP ranges or repositories you are authorized to assess, one per line. 4. **Blocked targets** — anything explicitly out of scope, one per line. 5. **Allowed test types** — switch on only the kinds of testing your authorization covers. 6. Choose **Save Scope**. The **Current Active Scope** card shows what is in force. Caution The form opens with example values. Replace every one of them with your own before you save. ## How the scope is used * **Recon** and **Planner** write target-specific plans only for targets inside the active scope. * A target outside it gets general methodology and a way to reproduce the question in your own lab, instead of a plan aimed at that system. * Out-of-scope requests are recorded in Oyster’s audit log. * Each project has its own scope; switching projects switches the scope in force. ## Good practice * Keep the scope as narrow as the authorization. A wildcard covers more than you may think. * Note the authorization’s dates, and update the scope when they change. * List third-party services you must not touch as blocked targets, even when they sit next to your own systems. # Security Intelligence > Security Intel answers exact CVE, CWE, CAPEC, MITRE ATT&CK and D3FEND lookups, lists known exploited vulnerabilities, and answers detection, mitigation and incident-response questions — with sources. Security Intel answers security questions from Oyster’s own knowledge base, with the sources it used. It needs an account; open **Security Intel** under **Blue Team**. ## What you can ask * **An exact identifier:** a CVE, CWE, CAPEC, MITRE ATT\&CK technique or D3FEND countermeasure. Exact identifiers are looked up directly rather than guessed. * **Known exploited vulnerabilities:** “list known exploited vulnerabilities”. * **Detection, mitigation, incident response and cloud questions:** “how do I detect T1055 process injection”, “how do I mitigate CWE-89 SQL injection”, “incident response steps for a ransomware outbreak”, “kubernetes cluster hardening best practices”. * **Package and prioritisation questions:** “what vulnerabilities affect the npm package left-pad”, “what should I patch first: CVE-2021-44228 or CVE-2023-24489”. The empty panel offers these as examples; click one to run it. ## Reading an answer Every answer shows a confidence badge: * **Grounded in local knowledge base** — the answer is backed by retrieved records. * **Partial data** — some fields may be incomplete. Treat it with more caution. Sources are listed under the answer. Expand one to read the exact passage it came from, with its publisher and a link to the original where there is one. Some sources have a passage but no public link. ## When there is no data If an exact identifier is not in the knowledge base, you see **Not found in local knowledge base**. Oyster does not fabricate vulnerability data. Check the identifier for typos, then consult the vendor’s or the CVE record’s own advisory. ## How it differs from chat Chat answers from the model, and from your files when you ask about them. Security Intel answers from the curated knowledge base and always shows where each fact came from. Use Security Intel for facts about a specific identifier, and chat to discuss what they mean for you. See [The knowledge base](/understand/knowledge-base/). # Verify an answer > How to check an Oyster answer before you act on it — citations, identifiers, follow-up questions and confidence signals. Oyster is a fast first pass, not the final word. Answers come from a language model and can be wrong, so check anything you will act on. ## Four checks 1. **Open a citation.** Where an answer lists sources, open at least one. Does the passage actually support the claim? 2. **Check identifiers against the source.** For a CVE or a version claim, confirm the identifier and the affected range in the cited advisory. 3. **Ask for the source.** “What is your source for that?” or “Show the exact text you used.” If an answer states a specific fact with no citation, ask. 4. **Reproduce before you rely on it.** Confirm in a lab you are allowed to use, or against the authoritative documentation. ## Read the confidence signals In Security Intelligence and other grounded answers: * **Grounded** — the answer is backed by retrieved sources. * **Partial** or **none** — treat it with more caution. * A **data-gap warning** means Oyster is missing information. It is being honest, not unhelpful. * **Insufficient evidence** means nothing relevant was found. Add a document, rephrase, or accept that the material does not cover it. ## Teach it Rate answers with 👍 / 👎. A thumbs-down with a correction tells Oyster what the answer should have been, and the correction is recalled on your next message. See also [Evidence and citations](/understand/evidence-and-citations/). # FAQ > Short answers to common questions about Oyster — what it is, what it costs, training, scanning, uploads, accounts, and how it relates to Dolphin and Shark. ## What is Oyster? Oyster is a cybersecurity AI assistant made by Red Orca. It answers security engineering questions — how attacks work and how to detect and prevent them — and, with a free account, adds questions over your own files, Red Team planning inside a declared scope, the SOC Copilot investigation workbench, Security Intel and Findings. See [About Oyster](/about/). ## Is Oyster free? Yes. Without an account you get one message a day. A free Red Orca account removes the daily message limit and opens the full workspace. Openweight editions that run on your own hardware are listed in the app but are not on sale yet. ## Where is it? At [redorca.ai](https://redorca.ai/). It moved there from `redorca.tech/oyster` on 30 October 2026; see [Moving from redorca.tech](/get-started/moving-from-redorca-tech/). ## Are my conversations used for training? Anonymous conversations are never stored on our servers and never used for training. Conversations in a free account are stored in that account and used to improve Oyster’s AI — that is the condition of the free account. Withdrawing in Settings stops it and also ends chat access. See [Data and privacy](/understand/data-and-privacy/). ## Can Oyster attack or scan a system? No. For every account, Oyster explains and plans; it does not scan, probe or run tools. Red Team plans are only written for targets inside the scope you declare, and you are responsible for having authorization to test them. See [Safety and approvals](/understand/safety/). ## What can I upload? Documents (PDF, Word, text and code), folders, images and video, plus notes you type. With a free account: up to 20 uploads a day, 50 MB per document and 500 MB in total, in a private workspace only you can see. Answers about your files cite the passages they used. See [Upload and organise files](/get-started/files/). ## Does Oyster send my data to another AI company? No. Oyster’s models run on infrastructure Red Orca operates in the EU, and your conversations are not sent to a third-party AI provider. ## Why is the answer slow? Oyster runs on Red Orca’s own hardware, and each account gets one answer at a time. Larger models and higher depths take longer. When many people are asking, you get a place in line. ## Can I use it on my phone? Yes, in the browser, or installed to your home screen. See [Install Oyster as an app](/get-started/install-app/). ## Do I need a new account for Oyster? No. One Red Orca account signs you in to Oyster, Dolphin and Shark. Sign in once on redorca.ai even if you are already signed in on redorca.tech. ## How is Oyster related to Dolphin and Shark? They are Red Orca’s three agents and share one account and one sign-in. Dolphin makes outbound sales calls and sends email, Shark keeps a team’s organizational memory, and Oyster helps with security work. ## How do I delete my data? In Settings: delete single conversations and files, **Delete my memories**, or **Delete my account** to erase everything. See [Data and privacy](/understand/data-and-privacy/). ## I found a bug or a wrong answer. Use **Report a bug** in the sidebar footer for bugs. For a wrong answer, give it a 👎 with the correction. For anything else, write to . # Glossary > The terms used in Oyster and across its documentation, from citations and scope to CVE, CWE, KEV, EPSS, MITRE ATT&CK, D3FEND, Sigma and YARA. **Approval gate** — A human decision required before a real tool action may run. The model can propose an action but never approve one. Applies to Red Orca’s operators; accounts have no tool execution. See [Safety and approvals](/understand/safety/). **CAPEC** — Common Attack Pattern Enumeration and Classification: a public catalogue of attack patterns. **Citation** — The exact source passage an answer was built on. Click it to verify the claim. See [Evidence and citations](/understand/evidence-and-citations/). **CVE** — Common Vulnerabilities and Exposures: a public identifier for a specific known vulnerability, such as CVE-2021-44228. **CWE** — Common Weakness Enumeration: the class of weakness a vulnerability belongs to, such as CWE-79 for cross-site scripting. **D3FEND** — MITRE’s knowledge base of defensive countermeasures, the defensive counterpart to ATT\&CK. **Depth** — How detailed an answer is: Quick, Technical, Guided or Lab. See [Your first conversation](/get-started/first-conversation/). **EPSS** — Exploit Prediction Scoring System: an estimated probability that a vulnerability will be exploited soon. **Finding** — A recorded security observation, from a chat answer or logged by hand, with severity, evidence and ideally a fix. See [Findings and sharing](/guides/findings/). **Insufficient evidence** — Oyster’s honest signal that retrieval found nothing to support an answer. Add context or rephrase. **IOC (indicator of compromise)** — An artefact, such as a hash, IP address, domain or path, that suggests a system was compromised. **IR / DFIR** — Incident response; digital forensics and incident response. **KEV** — The Known Exploited Vulnerabilities catalogue published by the US Cybersecurity and Infrastructure Security Agency (CISA): vulnerabilities seen exploited in the wild. Prioritise these. **Knowledge base** — Oyster’s curated, source-attributed security reference material. See [The knowledge base](/understand/knowledge-base/). **Memory** — Facts, preferences and decisions Oyster remembers from your conversations, per project, under your control. See [Memory](/guides/memory/). **MITRE ATT\&CK** — A knowledge base of real adversary tactics and techniques, each with an identifier such as T1003. **Project (engagement)** — The workspace that holds one body of work: its chats, files, scope, findings and memory. See [Projects](/get-started/projects/). **RAG (retrieval-augmented generation)** — Answering by first retrieving relevant passages, then generating from them, so answers are grounded and citable. **Scope** — The targets you are authorized to assess. Target-specific Red Team plans are written only inside it. See [Define an authorized scope](/guides/red-team/scope/). **Sigma** — A generic, vendor-neutral format for detection rules over log data. **SOC Copilot** — Oyster’s case-based investigation workbench. See [SOC Copilot](/guides/blue-team/soc-copilot/). **YARA** — A pattern-matching format for identifying and classifying files, often malware. # Limits and quotas > Every limit in Oyster in one place — messages, prompt length, uploads, file sizes, storage and retention, with and without an account. ## Chat | | Without an account | Free account | | ----------------- | ------------------------- | ------------------------------------------------------------ | | Messages | 1 a day | No daily limit | | Answers at a time | 1 | 1 | | Prompt length | 4,000 characters | No fixed character limit; the model’s context window applies | | Follow-up context | Each message stands alone | Earlier messages of the conversation are included | | Model | One smaller model | A choice of models | ## Uploads | | Without an account | Free account | | -------------------------------- | ------------------------ | ------------------------ | | Uploads per day | 5 | 20 | | Total storage | 100 MB | 500 MB | | Document (PDF, Word, text, code) | 50 MB | 50 MB | | Image | 25 MB | 25 MB | | Video | 100 MB, up to 30 minutes | 100 MB, up to 30 minutes | | Folder | 800 files, 250 MB | 800 files, 250 MB | ## Retention | | | | ------------------------ | ------------------------------------------------ | | Anonymous conversations | Kept in your browser only | | Anonymous attached files | Deleted after 30 days without use | | Account data | Kept until you delete it, or delete your account | ## Not offered to accounts Running tools against real hosts, live SIEM connections, and managing the knowledge base are reserved for Red Orca’s own operators. ## Openweight Openweight editions — Oyster packaged to run on your own hardware — are listed in the app but not yet on sale. # Red Orca and contact > Red Orca is the European software company that makes Oyster, alongside Dolphin and Shark. How to reach us, report a bug or a security issue, and where the legal terms are. Oyster is made by [Red Orca](https://redorca.tech/), a European software company that builds AI agents. ## Red Orca’s products | Product | What it does | Where | | ----------- | ------------------------------------------ | ---------------------------------------------------- | | **Oyster** | Cybersecurity AI assistant | [redorca.ai](https://redorca.ai/) | | **Dolphin** | Makes outbound sales calls and sends email | [redorca.tech/dolphin](https://redorca.tech/dolphin) | | **Shark** | Keeps a team’s organizational memory | [redorca.tech/shark](https://redorca.tech/shark) | One Red Orca account signs you in to all three. ## Contact * **Email:** * **LinkedIn:** [Red Orca](https://www.linkedin.com/company/redorca) * **Bugs:** **Report a bug** in Oyster’s sidebar footer. * **Security issues:** if you believe you have found a vulnerability in Oyster, email with the steps to reproduce it, and do not disclose it publicly before we have replied. Do not access other people’s data to prove a point. ## Legal * [Privacy policy](https://redorca.tech/privacy#oyster) * [Terms of service](https://redorca.tech/terms#oyster) # Troubleshooting > Fixes for common Oyster problems — no answer, weak answers, uploads that do not process, conversations that will not open, sign-in after the move, and being slowed down. ## No answer comes back * Check the status dot in the sidebar footer. If it is red, Oyster’s service cannot be reached; wait a moment and retry. * If Oyster is busy, it says so and shows your place in line. Wait rather than resending. * Without an account you get one message a day. Sign in for no daily limit. ## The answer is weak or off-topic * Add specifics and real identifiers; ask one focused question. See [Write better questions](/guides/better-questions/). * For file questions, confirm the file is **ready** and use RAG Analyst. * Try a larger model from the footer picker for harder questions; it is slower. * Give the answer a 👎 with a correction. ## An upload does not process * Watch the chip’s status; large files and video take longer. * **failed** shows the reason when you hover it. An unsupported or damaged file is refused rather than half-read. * Check the [size limits](/reference/limits/) and your daily allowance. * Remove the item and add it again. ## A conversation will not open You see an error with **Try again**. Retry; if it persists, the conversation may have been deleted. Your other conversations are unaffected. ## A suggested question does not run Click it once: it opens the chat, sends the question and streams the answer. If nothing happens, check the status dot; sending is refused while Oyster is unreachable. ## A citation will not expand Some sources have a passage but no public link; the retrieved text is still readable. A citation from an older index may not expand — the answer text is still what the model used. ## I am signed out on redorca.ai A sign-in belongs to one site. Sign in once on redorca.ai with the same account you use on redorca.tech. See [Moving from redorca.tech](/get-started/moving-from-redorca-tech/). ## Oyster stopped loading after many reloads Reloading the app many times in a short period can get your connection slowed down or paused for a few minutes, to protect the service. Wait a few minutes and open it again, once. ## Still stuck? Use **Report a bug** in the sidebar footer, or write to . # Data and privacy > What Oyster stores with and without an account, how account conversations are used to improve Oyster, where the models run, and how to withdraw or delete your data. This page explains Oyster’s data handling in plain terms. The binding text is the [privacy policy](https://redorca.tech/privacy#oyster) and the [terms of service](https://redorca.tech/terms#oyster). ## Without an account * Your conversation stays in your browser. It is **not stored on our servers** and **never used for training**. * Files you attach go into a temporary space tied to your browser, separate from everyone else’s, and are **deleted after 30 days without use**. ## With an account * Your conversations are stored in your account and visible only to you. * **They are used to improve Oyster’s AI.** That is the condition of the free account, not an optional extra, and it is part of the agreement you accept before your first message. * Exchanges that contain credentials are **dropped** from training data, not redacted. * Files you upload stay in your own private workspace. Other accounts cannot see them. * [Long-term memory](/guides/memory/) is yours to switch off, review, edit, export and delete, and its content is encrypted at rest. ## Where it runs Oyster’s models run on infrastructure Red Orca operates in the EU. Your conversations are not sent to a third-party AI provider. All traffic to Oyster is encrypted (HTTPS). ## Your controls All in **Settings** (the wheel in the sidebar footer): | Control | What happens | | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Delete a conversation or a file | It is removed. | | **Delete my memories** | Erases every memory. | | **Export JSON** (in Manage memories) | Downloads your memories. | | **Withdraw my agreement** | Your chats are excluded from every dataset built afterwards, and your chat access ends. You can accept again later. | | **Delete my account** | Permanently deletes your account and sign-in, every conversation and message, every file, image, video and note you uploaded, and your agreement record. Type your email to confirm. | Caution One Red Orca account signs you in to Oyster, Dolphin and Shark. Deleting it from Oyster removes the sign-in for all three. A model that has already been trained cannot be untrained. ## Questions Write to . # Evidence and citations > How Oyster grounds answers in retrieved passages, what a citation shows, the difference between knowledge and file citations, and what "insufficient evidence" means. For questions about your files, and in Security Intel, Oyster retrieves the relevant passages first, then answers from them, and shows the sources it used. A citation is not decoration: it is the passage the answer was built on. ## What a citation shows Click a citation to see: * the exact passage; * where it came from — its source, publisher and section; * a link to the original, where one exists; * for video, the timestamp of the moment it came from. ## Two kinds of source * **Knowledge** citations come from Oyster’s curated security knowledge base. See [The knowledge base](/understand/knowledge-base/). * **Project** or **uploaded** citations come from a file you added. Your files and the curated knowledge are stored separately and do not bleed into each other’s results. When an answer deliberately draws on both, each citation is labelled with its kind. ## Insufficient evidence If retrieval finds nothing relevant, Oyster says the evidence is insufficient rather than inventing an answer. That is the system working correctly. Add a document, rephrase, or accept that the material does not cover the question. ## Citation unavailable Some sources have a passage but no public link; you can still read the retrieved text. If a citation will not expand, the reference may come from an older index — the answer text is still what the model used. ## Use citations to verify Read the cited passage before you act on a high-stakes answer. If an answer states a specific fact without a citation, ask Oyster for its source. See [Verify an answer](/guides/verify-an-answer/). # How Oyster works > What happens between your question and Oyster's answer — the app, Red Orca's own models, retrieval from your files and the knowledge base, and the line Oyster does not cross. ## The pieces * **The app** at [redorca.ai](https://redorca.ai/) runs in your browser. It is also [installable](/get-started/install-app/). * **Oyster’s service** receives your question, gathers the context it needs, and streams the answer back as it is written. * **The models** run on infrastructure Red Orca operates in the EU. Your conversations are not sent to a third-party AI provider. * **Retrieval** finds the passages an answer should rest on: from your own files when you ask about them, and from Oyster’s curated knowledge base in Security Intel. ## From question to answer 1. You send a question, with the depth you chose. 2. With an account, the earlier messages of the conversation and any relevant [memories](/guides/memory/) are added as context. 3. For questions about files or identifiers, Oyster retrieves the most relevant passages first. 4. The model writes the answer from that context, and the passages it used are shown as [citations](/understand/evidence-and-citations/). 5. The answer streams to you. Each account gets one answer at a time; when many people are asking, you get a place in line. ## The line Oyster does not cross Oyster explains, plans and reviews. For every account, it has no access to your systems: it does not scan, probe or run tools against anything. Red Team plans are written only for targets inside the scope you declare. See [Safety and approvals](/understand/safety/). ## Why answers take a few seconds Oyster runs on Red Orca’s own hardware rather than on a large third-party service. That keeps your conversations with us, and it means answers can take several seconds — longer for larger models and higher depths. # Isolation > How Oyster keeps each account's projects, files, memories, findings and SOC Copilot cases apart — and anonymous visitors' files apart from each other. Everything you put into Oyster is scoped to your account, and inside it to the active project. ## What is isolated | What | Who can see it | | ------------------------------------------- | ------------------------------------------------------- | | Projects and their conversations | Only you | | Uploaded files, and answers drawn from them | Only you | | Long-term memories | Only you, per project | | Findings | Only you — unless you share a link or publish one | | SOC Copilot cases, evidence and reports | Only you: each account has its own SOC Copilot database | | Red Team scope | Only you, per project | Switching projects switches the files, memories and scope in play. Oyster resolves whose data a request may touch from who is signed in, never from an identifier in the address. ## Without an account Each browser gets its own signed visitor identity and its own temporary space for attached files, so two people on the same office or mobile network never see each other’s files. Those spaces are deleted after 30 days without use. ## Shared on purpose * **The knowledge base** is shared reference material that every account reads and none can change. Your files never enter it. See [The knowledge base](/understand/knowledge-base/). * **Published findings** are readable by every signed-in user, under your nickname, until you make them private again. See [Findings and sharing](/guides/findings/). # The knowledge base > Oyster's curated, source-attributed security knowledge base — what it contains, how it is used in Security Intel, and how it differs from your own files and from model training. Oyster keeps a curated, source-attributed knowledge base of security reference material. It is searchable reference text, not model training data: every passage keeps its source, so an answer built from it can cite where each fact came from. ## What it contains Public security references, including: * **Vulnerability and weakness records** — CVE entries, CWE weakness classes and CAPEC attack patterns, and the list of known exploited vulnerabilities. * **Adversary behaviour** — MITRE ATT\&CK techniques, with their mitigations and detection data. * **Defensive countermeasures** — MITRE D3FEND. * **Standards and guidance** from public projects such as OWASP and NIST publications, and detection content such as Sigma rules. Each source keeps its licence and attribution, and citations link back to the original where it is public. ## Where it is used **Security Intel** answers from the knowledge base and shows its sources. See [Security Intelligence](/guides/security-intelligence/). Installing, updating and managing knowledge sources is done by Red Orca’s operators; accounts read it, they do not change it. ## Your files are separate The files you upload are stored apart from the knowledge base, in your own project. A question about your files is answered from your files; curated knowledge does not leak into those results, and your files never enter the shared knowledge base. See [Isolation](/understand/isolation/). ## When it does not know If the knowledge base has nothing on a question — or no record of an identifier — Oyster says so instead of inventing an answer. # Safety and approvals > Where Oyster draws the line — it explains and plans but never acts against your systems, writes target-specific plans only inside a declared scope, and keeps every real action a human decision. Oyster helps people understand attacks so they can stop them. Its safety boundary is not the model refusing to talk about technique; it is what Oyster can and cannot do. ## For every account * **Oyster explains, plans and reviews.** It has no access to your systems. It does not scan, probe, exploit or run tools against anything. * **Scope comes first.** Red Team plans aimed at a specific target are written only for targets inside the [scope](/guides/red-team/scope/) you declare. Outside it, you get general methodology and a way to reproduce the question in your own lab. * **You are responsible for authorization.** Only assess systems you own or are explicitly authorized to test. * **Code stays with you.** Code Lab is copy-only: nothing executes on Red Orca’s servers. ## How real actions are gated Red Orca’s own operators have a separate, tightly gated tool layer that accounts do not. It sits outside the model, and the model cannot get around it: 1. The model may propose an action; it can never approve or run one. 2. Every proposed action is checked against the authorized scope and classified by risk. 3. Read-only local analysis may run; anything that touches a target needs explicit human approval, each time. 4. Destructive actions are blocked. 5. Every run is scope-checked again just before it starts, and recorded in an audit trail. ## What Oyster will not do * Act against a target that is not in scope. * Invent sources or CVEs. When it lacks evidence, it says so. * Replace professional incident response, legal advice or a penetration test. See also [Data and privacy](/understand/data-and-privacy/) and [Isolation](/understand/isolation/). # For AI agents > Machine-readable access to Oyster's documentation — llms.txt, full-text exports, a Markdown version of every page, the sitemap, and a short factual summary of Oyster. This documentation is written to be read by people and by AI assistants alike. Everything below is public and may be crawled, indexed and quoted. ## Machine-readable files | File | What it is | | -------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [`/llms.txt`](https://documentation.redorca.ai/llms.txt) | An index of this documentation, following the llms.txt convention. | | [`/llms-full.txt`](https://documentation.redorca.ai/llms-full.txt) | The complete documentation as one text file. | | [`/llms-small.txt`](https://documentation.redorca.ai/llms-small.txt) | A shorter version for small context windows. | | `/.md` | Any page as Markdown: take its address, drop the trailing slash and add `.md` — for example [`/about.md`](https://documentation.redorca.ai/about.md). The home page is [`/index.md`](https://documentation.redorca.ai/index.md). | | [`/sitemap-index.xml`](https://documentation.redorca.ai/sitemap-index.xml) | Every page, for crawlers. | Every HTML page also links its Markdown version with ``, and has a **Copy page as Markdown** button under its title. ## Crawling `robots.txt` allows every crawler on every page. Please cite the canonical HTML address of a page (`https://documentation.redorca.ai/…/`) rather than its Markdown copy. ## Oyster in brief * **What it is:** a cybersecurity AI assistant made by Red Orca, at [redorca.ai](https://redorca.ai/). * **Who makes it:** [Red Orca](https://redorca.tech/), a European software company that also makes Dolphin and Shark. One account signs in to all three. * **Price:** free. One message a day without an account; no daily limit with a free account. Openweight editions are not yet on sale. * **With a free account:** chat with a choice of models, questions over your own files with citations, Red Team planning inside a declared scope (Scope, Recon, Planner, Fix Advisor, Code Lab), Blue Team (SOC Copilot, Security Intel, Cook Book), Findings and long-term memory. * **What it does not do:** for accounts, it has no access to any system and does not scan, probe or run tools. Running tools against real hosts and live SIEM connections are reserved for Red Orca’s operators. * **Data:** anonymous conversations stay in the browser and are not used for training; account conversations are stored in the account and used to improve Oyster’s AI, a condition of the free account. Models run on infrastructure Red Orca operates in the EU. * **Documentation:** this site, [documentation.redorca.ai](https://documentation.redorca.ai/). ## Corrections If something here is wrong or out of date, write to .