Platform

The platform is organised around three ideas: collection, mapping, and service. Each is deliberately separable, so a team can adopt continuous collection without first agreeing a control taxonomy, or map an existing evidence store without changing how it is gathered.

Collection

Collectors are read-only integrations that run on a schedule and record a timestamped observation. A collector never mutates the system it observes. Where an API is not available, evidence can be posted to a signed intake endpoint from your own automation, which keeps the audit trail intact without requiring us to hold credentials.

Mapping

Controls are expressed independently of any single framework, then mapped outward. An access review performed quarterly satisfies clauses in several schemes simultaneously; recording it once and mapping it many times removes the duplication that makes multi-framework programmes expensive.

Service

Evidence is served through reviewer workspaces, scoped exports, and an API. Reviewer workspaces are time-boxed and scoped to a named engagement, so an assessor sees the evidence for the controls in scope and nothing else. Every access is logged and visible to the customer.

Deployment

Halberd runs as a managed service in the European Union, with an optional customer-managed key arrangement for organisations that require it. There is no agent to install on production hosts.