AI security & operations for MSPs

Every escalation, every client, retained

Every escalation, every report, every note and who wrote it, recorded per client and kept for the life of your instance; the raw events behind them searchable for a year.

What the record is for

Two moments. The first is the renewal questionnaire, where your cyber-insurance carrier asks what you collect and how long you keep it, and a screenshot is not an answer. The second is the incident, six months later, where a client or their auditor asks what you knew and when.

Both of those are evidence problems, not monitoring problems. A platform that watches everything but cannot produce a record afterwards has solved the easy half.

Ingest
The current state of every Microsoft 365 and Google Workspace feed, per tenant and per content type, with when it last delivered; every triage cycle recorded per client for 90 days.
Alerts
Every alert fired, with its reasoning and the remediation served, kept for the life of the instance; the raw events behind it stay searchable for a year.
Reports
Every report generated, with its number, date, client and the model that wrote it.
Admin
Who created each note, tag, watch and chat thread, kept with the record. Optional per-user logging of portal visits and chat, off by default.
Judgments
Every escalation records the severity, the model that judged it, and the reasoning.
Signature
Every PDF is cryptographically signed and independently verifiable. Verify a report →
Prerequisite
A customer’s tenant must have audit logging enabled before Hal can pull from it. Audit logging prerequisites →
portal · events The Hal portal events list: each escalation as a dated, numbered report with its severity, the client it belongs to and the model that judged it, View and PDF beside every row, and one row expanded to show the reasoning and the numbered remediation steps
This is the record, not a view of it. Every escalation keeps its report number, its date, the client and the model that made the call, and opens as a page or downloads as the signed PDF. Expanded, it carries the reasoning and the remediation. That is what someone asking about a nine-month-old event gets shown.

Questions this raises

Why does the model that judged it matter?

Because a conclusion without its provenance is an assertion. If a decision is going to appear in a report that a client’s auditor reads, the record should say what made the call and on what evidence. That is also what makes a wrong call correctable rather than mysterious.

Can a client see their own audit trail?

Not directly. There is no client login: the portal is yours, and your client list stays in it. What you hand a client is the report, which is signed, so they or their auditor can confirm it is genuine without a login and without trusting you or us.

See what Hal surfaces on your own clients.

No deck. Ask us anything first. When you want to see Hal on your own tenants, we sign a short evaluation agreement and stand up your instance; you connect one tenant, Hal watches it for 14 days, and we walk you through what he found.

Book a walkthrough Pricing
  1. 01You ask us your questions. No deck, no demo dataset.
  2. 02You sign a short evaluation agreement, and we stand up your own instance.
  3. 03You connect one tenant from your own admin console. Hal watches it for 14 days.
  4. 04We walk through what he found. Keep going month to month, or revoke the scopes yourself and stop.