Security & Compliance

Hal is built so he can watch everything and break nothing. He reads your clients’ environments, judges what he finds, and tells you what to do — but he has no path to write back to any of them. The read-only posture isn’t a setting you trust him to honor. It’s how the system is built.

Read-only by architecture

Cloud sources are read through their own APIs over connections you grant and can revoke yourself. Nothing gets installed in a tenant. The only software that ever touches an endpoint is a userspace log shipper (a Fluent Bit forwarder) that ships logs out. It is not an EDR, it carries no kernel driver, and it has no way to change the machine it runs on.

Every integration in Hal reads. None of them write. Because nothing Hal deploys runs in the kernel or pushes changes back to a client, a CrowdStrike-style outage is architecturally impossible here. The full read-only story, with the customer-facing framing, is on Trust.

The source systems stay authoritative. Microsoft 365, Google Workspace, and the rest remain your system of record. Hal keeps a searchable copy he reads from. He never reaches back to alter the original.

Per-client isolation

Each client’s data is kept separate. One client’s logs never commingle with another’s, and clients are carried under opaque identifiers rather than names. An MSP running dozens of clients through Hal gets dozens of isolated stores, not one shared pool.

Retention and deletion

Ingested log data is searchable for 365 days. When a contract ends, Hal deletes the customer’s data from his systems. Even while the data lives in Hal, your own M365, Google Workspace, and other source systems stay the system of record — Hal’s copy is a searchable cache with a retention window, not your archive.

Signed, verifiable reports

Every PDF Hal generates is cryptographically signed. You, your client, or an outside auditor can confirm a report is genuine and unaltered without taking our word for it. Drop the file at Verify a report: the check runs entirely in your browser, and a modified or forged report fails it. For the steps, see Report Verification.

Audit logging

Hal logs the actions he takes — every ingest cycle, every alert, every report he sends, every admin action in the portal. Those records hold metadata and activity — what happened, when, against which tenant — rather than a copy of the raw log data. For what’s recorded and the retention windows carriers ask about, see Audit logging.