Platform / Security

Control who sees what—without breaking evidence integrity

Security is built into how evidence is generated, shared, and sealed—not bolted on later.

Read-only by default

Hadalian never writes back to your operational systems. We don't move money, change records, or alter history.

Every connection, permission, and share is scoped intentionally to the minimum required access.

Read-only access only
OAuth-based authentication
No credential storage
Immediate revocation

Permissions built for real workflows

Different people need different levels of access. Hadalian's permission model reflects that reality.

Permissions diagram

Internal roles

Owner / Admin

Manages system connections, users, and publication rights.

Contributor

Generates evidence, prepares binders, adds narrative context.

Reviewer

Reviews evidence and drafts without publishing authority.

External roles

Viewer

Read-only access to specific binders or data room materials.

Live Access Participant

Temporary, scoped access to system-derived views for defined periods.

External users never see more than explicitly granted—and never inherit internal privileges.

Invitations with intent

Every external interaction starts with an explicit invitation. No shared passwords. No forwarded links.

Role-specific invitations
Time-bound access windows
Automatic expiration
Manual revocation

Access is always intentional. Silence never implies permission.

Full visibility into access and activity

When evidence is relied upon, knowing who accessed it—and when—matters.

User access and authentication events
Binder publication timestamps
Document uploads and references
External stakeholder views
Audit log interface

Sealed means sealed

Evidence Binders are immutable once published.

No edits after publication
No silent document replacement
New binder required for updates
How Evidence Binders work

Controlled collaboration

Data Rooms support back-and-forth while remaining governed.

Explicit participant lists
Draft vs published labeling
Activity logging
How Data Rooms work

Data handling and residency

Designed to meet the expectations of lenders, auditors, and advisors.

US-based data residency
Encrypted at rest and in transit
Environment isolation
Strict internal access controls

Current

Documented security policies
Least-privilege internal access
Ongoing monitoring and logging

Roadmap

SOC 2 Type I
SOC 2 Type II

Certification work is driven by what stakeholders expect—not badge collection.

What this security model prevents

Untraceable document sharing
Access creep over time
Silent changes after review
Disputes over who saw what

Security that supports credibility

Make outcomes defensible without slowing down serious work.