Trust.

Tenant isolation, checked by machine

Every table carries the business it belongs to, and composite foreign keys make a reference across two businesses impossible at the database level rather than unlikely in the code. A build-time rule rejects any query that does not filter on it, so isolation cannot be forgotten in a hurry.

An audit log you can read

Who changed what, when, and from which account. Written by the same code path that makes the change, so a record cannot be edited without one.

Hosted in the EU

Data is stored and processed in European regions. Nothing is replicated outside the EU, and no customer data leaves it for support or analytics.

Sign-in through your own directory

Microsoft Entra ID, so joining and leaving follow the accounts you already manage. Removing someone from your directory removes their access here, without a separate list to remember.

Least privilege, including ours

The application connects with a role that cannot alter the schema, and reporting reads through a separate credential that cannot write at all. Access is scoped by what a job needs rather than by convenience.

Hallio is in active development and has not yet been independently audited. When that changes this page will say so, with a date and a report.