Security
Built for data you are trusted with
Halberd reads security-relevant information about your clients. Here is how we protect it.
Read-only by design
Halberd's Microsoft Graph client has no write operations, and requests are blocked unless they are reads. Only read permissions are requested.
No stored client tokens
Halberd uses app-only certificate credentials. Access tokens are requested when needed, kept in memory until they expire and never stored. We store only each client's tenant ID.
Strict tenant isolation
Every database query is scoped to your organisation, and automated tests prove one MSP cannot read another's data.
Private evidence storage
Evidence files are stored privately and downloaded only through short-lived signed links, by signed-in members of your organisation.
Data minimisation and retention
Halberd keeps findings and a minimal inventory, not raw logs or IP addresses. Old scans are deleted after your retention period (13 months by default).
Audit trail
Connecting or disconnecting tenants, role changes, exports and billing changes are recorded in an audit log.
Hardened web application
Strict Content Security Policy, HSTS, clickjacking protection, rate limits on sign-in and onboarding, signed consent links and validated uploads.
No AI on your data
All checks are deterministic rules. Client data is never sent to AI or LLM services.
Report a security issue: security@aspenfy.com
Important: Halberd is a readiness aid and does not issue or guarantee Cyber Essentials certification. Certification is awarded only by an IASME-licensed certification body after assessment. Halberd is not affiliated with or endorsed by the NCSC or IASME.
See where a client stands in minutes
Free Cloud scope & MFA check for one client tenant. No card needed.