Goalie turns narrowly verified Windows profile-failure signals into privacy-safe, cryptographically signed incidents without shipping raw logs or changing endpoint state.
Cloud management feedback can lag behind a local failure. Shipping entire Windows event streams creates privacy and noise problems, while vague heuristics risk turning an ambiguous signal into an incident—or worse, an automatic change.
A lightweight Windows service evaluates allowlisted fields locally. Only high-confidence, privacy-safe records can cross the gate. Signed delivery, a transactional bookmark, and a bounded local spool protect the evidence path through reboots and network outages.
Explicit Unknown, Drop, and Emit outcomes prevent ambiguous events from silently advancing.
Raw XML, paths, identities, and rendered messages stay on the endpoint.
Device identity, request signing, replay resistance, enrollment approval, and revocation protect ingestion.
A bounded SQLite spool and transactional bookmarks preserve delivery intent through interruption.
The .NET Windows service delivers signed HTTPS incidents to a Worker. D1 stores tenant-scoped records; Cloudflare Access protects the operator console and read APIs; Static Assets serve the dashboard; Rate Limiting and Workers observability reinforce the ingest boundary.
Goalie has not completed a Windows or Intune endpoint pilot. Native service lifecycle, device keys, packaging, reboot and offline recovery, and performance gates must pass on the fixture before rules turn on. Remediation is not a current capability.
Next in the portfolio / a web platform for Mexico’s smallest operators
Explore ChambaFluir →