A closed ticket is not a checked fix
Your tracker records that someone closed it. Whether a different person checked the work is a team convention, not something the record can refuse to skip.
HEIMDALL · Security operations
Security work you can prove: owned, checked by a second person, on the record.
HEIMDALL is a workspace your team runs: findings, disclosures and assurance requests become records with an owner, a second person's sign-off and the evidence attached.
Tell us what you want running first. A person replies — no sequence, no newsletter.
-
A different person checks the evidence
The software refuses self-review. Independent means a different signed-in workspace member, not organisational separation.
-
SHA-256 on every evidence file
A download fails if the bytes changed. Uploads are capped at 20 MB; disk encryption and off-host backups are the operator's.
-
A hash-chained history
Re-verify it on demand. Database-local chain: export its head to independent storage to detect rollback. Not a hardware signature.
Where it stops. Not a scanner, not monitoring, no live integrations. AI is advisory and stays off until you approve a provider. The workspace holds the evidence for your programme; it does not certify it.
The problem
The work gets done. The proof goes everywhere else.
A finding gets fixed. A disclosure gets triaged. An audit question gets answered. Then the evidence lands in a ticket comment, a chat thread and a screenshot on someone's desktop — and the next audit, the next enterprise customer or the next incident asks the same question again: who decided this, what was checked, and can you show me?
Evidence goes stale where it landed
The file that proved the fix in March is a link in a chat log by July, and nobody can say whether the copy still matches what was reviewed.
Every request restarts the archaeology
The fourth questionnaire this year asks for the same records, and someone rebuilds the answers from memory and screenshots.
This is about the record of the work, not about watching your environment: scanning, detection and 24×7 coverage are somebody else's product — no connectors, no monitoring. The framing above is analysis for this page; no statistic or customer quote is claimed.
One case, end to end
From a finding past its due date to a report someone else can rely on.
Five steps, in the order the software enforces them. Each one says what it proves and where it stops.
-
1 · The issue
What needs attention first
Command orders the queue by severity and how far each record is past its service-level clock. The tiles are computed from the records in the workspace, not written for the page.
Nothing here is inferred: an empty queue says the workspace is empty, not that the environment is clean.
-
2 · The owner
An accountable person, or no movement
Every record carries its owner, severity, stage and history. The lifecycle runs server-side: a step that needs an owner, then evidence, then an independent verification will not advance without them. A workspace admin does not automatically get case-reading authority.
The button does not decide. The server does.
-
3 · The evidence
A file whose bytes are checked
Upload a file and it is fingerprinted with SHA-256. A download re-checks the bytes and fails instead of quietly serving something different. The digest proves the file is unchanged.
It does not prove the fix works. Effectiveness needs its own retest evidence, and the record says so.
-
4 · The second person
A check the author cannot give themselves
The uploader cannot verify their own evidence: the server refuses with “Verification requires a different person”. A second workspace member records the review, and closure needs that verification on the record.
Independent means a different signed-in workspace member, not organisational separation and not a third-party audit.
-
5 · The report
Something an audience can rely on
Four templates — executive, board, auditor, customer — are generated from the same records, and the artifact is downloaded with its digest.
Nothing is e-mailed. Delivery is not configured; distribution is manual.
The refusal is the product
Try to advance a record that has an owner but no evidence, and the server
answers 409 “Attach evidence before advancing”. No
role, including an administrator, talks its way past that.
This sequence is what the demo runtime shows. The demo is a separate instance with fictional data and one private workspace per visitor; behaviour there does not prove any other deployment. Ask for the link in your note and we will send it with those boundaries spelled out.
The software
What it does today
Every line below describes behaviour that exists in the product and says where it stops. No logos, no testimonials, no customer counts.
Evidence integrity
SHA-256 on every evidence file
Every uploaded file is digested on upload. If the bytes changed, the download fails instead of quietly serving something different.
Uploads are capped at 20 MB; disk encryption and off-host backups remain the operator's responsibility.
Independent review
A different person, enforced by the server
Verifying your own upload is refused, and the acceptance note has to say something specific. Closure needs a verification by someone other than the author.
Independent means a different signed-in workspace member, not organisational separation.
Gates
Server-enforced stages and roles
42 record kinds and 21 lifecycle templates run server-side: accountable owner, then evidence, then independently verified evidence, then a final authority. A workspace admin does not automatically get case-reading authority, and mutations require a CSRF token and a same-origin check.
Four report templates, 20 named assistants and 11 brief surfaces, all advisory.
Audit
A hash chain you can verify on demand
The audit trail is append-only and tamper-evident, with a verification endpoint that walks the chain and reports the first invalid sequence.
Database-local by design: export its head to independent storage to detect rollback. Application-generated, not a hardware signature.
Posture
Connector-free, by design
Data enters by file import or manual entry. There is no live SIEM, cloud, identity-provider or ticket-system ingestion, and nothing to keep credentials for.
A 14-entry connector catalog exists and is exercised against controlled transport responses only — never a live external service.
Deployment and exit
Yours to run, yours to leave with
Docker Compose brings up the API, a worker, PostgreSQL and an evidence volume behind HTTPS on infrastructure you control. Everything can leave in one signed archive: records, relations, comments, evidence bytes and the audit chain.
The manifest is HMAC-SHA256 with a deployment-held key; restoring that archive elsewhere is a documented runbook, not an automated import.
What you buy
The Security Operations Sprint
HEIMDALL is the software. The paid work is five working days that stand up one gated workflow in your workspace: real findings, evidence reviewed by a second person, one leadership artifact, and a handover you keep.
Pick one workflow in the scoping call
One of three
Findings and fix verification
Your backlog loaded as records, with owners and severities, and fix evidence reviewed by someone other than the person who uploaded it.
One of three
Disclosure and bounty intake
Every report becomes a record in a lifecycle: intake, triage, decision. A deterministic pass flags duplicate candidates and missing information; it never decides.
One of three
Assurance evidence pack
Controls, evidence and the decisions behind them in one place, with an auditor-audience report generated from the same records.
-
Scoping call
Thirty minutes to pick the workflow and check the prerequisites: a named executive sponsor, a workspace owner with access-approval authority, an identity path (your OIDC provider, or accounts on the Red Asgard identity instance), MFA, up to five named users, and a findings export.
-
Workspace configured, workflow running
A dedicated workspace with an explicit module allowlist, roles mapped to your team, and the workflow run end to end: up to 25 records loaded, at least two evidence items reviewed by a different person, one signed case bundle.
-
Handover with a runbook
A 60-minute working session plus a written runbook: how the gates work, who owns what, how to add users, how records age, and how to export everything. One leadership artifact is generated and its digest recorded.
Fee
$6,500 fixed: 50% at signature, balance on acceptance
Duration
5 working days · ≤ 40 delivery hours
Scope
One workflow · up to 25 records · up to 5 named users
Acceptance
Written checklist. Balance not due if it is not met.
On the price. The fee is approved by Red Asgard and no customer has been quoted yet, so treat it as the offer we would put in a written proposal after the scoping call. There is no discount ladder: if the fee does not fit, we say so rather than improvise.
On hosting. Hosting is confirmed in writing before signature: a dedicated workspace on the Red Asgard-managed instance, or your own infrastructure. No managed-service promise is made on this page.
On identity. Your identity provider, or accounts on the Red Asgard identity instance, with MFA enforced. The console policy and invite mail behind that are operator work; if your identity provider cannot be connected in time, activation is blocked rather than weakened.
After handover. Five business days of best-effort configuration support, business hours, no SLA and no uptime commitment. Certification of your compliance programme and feature development are not part of the sprint.
Boundaries
What this is not
A page that only lists what a product does is a page you have to re-read later. These are the boundaries that decide whether the purchase fits, said before you ask.
What HEIMDALL is, and what it is not
You host it and you operate it. Hardening, TLS, disk encryption and off-host backups are yours. It is connector-free by design: data enters by file import or manual entry. It is not a scanner and not monitoring. AI is advisory, off by default, and behind a policy check.
- Not detection or monitoring
- Nothing watches your environment. No SIEM ingestion, no alert stream, no continuous coverage, and no 24×7 service or on-call.
- Not automation of judgment
- AI is advisory and refuses with a reason when no approved provider is configured. The always-on first pass is deterministic code — duplicate candidates, fingerprints, missing information — and it never decides. Severity, acceptance and payment stay human.
- Not report delivery
- Artifacts are generated and downloaded inside the workspace. Nothing is e-mailed; delivery is not configured.
- Not compliance certification
- The workspace can hold the evidence for a SOC 2 or ISO 27001 programme. Red Asgard does not certify it, and there is no audit-readiness guarantee.
- Not a hosted service
- Software your team runs. Hosting is confirmed in writing before signature; no managed-service promise is made on this page.
- Not tamper-proof, and not notarised
- The audit chain is tamper-evident and database-local. Export its head to independent storage to detect rollback; that is a routine you own.
The demo is a separate instance with fictional data.
One private workspace per visitor, no sign-in, no external calls and no AI. Uploads, admin changes, connectors, proposals and AI are switched off there on purpose, and workspaces are deleted after their session expires. Behaviour in the demo does not prove production behaviour, and the demo is never the product. This page itself is a static document: no analytics, nothing loaded from third parties, no cookies.
Valkra is licensed separately.
Valkra is an independently owned product, subscribed from Launch Legends on its own terms. Nothing here bundles it, resells it or implies an integration, and no data-sharing right exists in either direction.
Straight answers
Questions buyers actually ask
Each answer is written to be read as-is, and each ends with the dependency it rests on.
Do I buy software, or a service?
Both, and the difference matters. HEIMDALL is self-hosted software: a security workspace with a 42-kind record model, 21 lifecycle templates, 4 report templates, 20 named assistants and 11 brief surfaces; evidence is SHA-256 digested with second-person review, and the audit trail is a hash chain you can verify on demand. What you buy today is the five-working-day Security Operations Sprint, which lands one gated workflow on a dedicated workspace. There is no priced software subscription today.
Status: the offer and the fee are approved internally; the fee remains market-unvalidated and no customer has been quoted.Can I try it before we talk?
There is a hosted demo on a separate instance, seeded with fictional data. You get a private temporary workspace; nothing you do there touches a customer system. Ask for the link in your note and we will send it with the boundaries spelled out — the demo shows the workflow, it is not a trial of your own workspace.
Depends on: a visitor session that expires. The demo has no connectors, no AI provider and no production data.Does it connect to our SIEM, cloud provider, identity provider or ticket system?
No. It is connector-free by design, and because it is a purchase-condition question we say it early: data arrives from a customer export (SARIF or Threat-Dragon JSON are the supported formats) or by manual entry, up to 25 records in the sprint.
Depends on: if live ingestion is a condition of purchase, this is the wrong buy. That is a stated disqualifier, not a gap to hand-wave.Do you monitor us? Is this 24/7 detection and response?
No, none of that. It is a hard boundary, not modesty: no managed monitoring, no on-call, no 24/7 coverage and no MDR service. The engagement is configuration and enablement. HEIMDALL records and gates the work your team does in it; it does not watch your environment.
Depends on: nothing. If around-the-clock monitoring is the requirement, no version of this purchase serves you.Who can review evidence, and what stops self-review?
The server does. When the uploader tries to verify their own file, it
answers 409 “Verification requires a different
person”. In the sprint we commit to at least two evidence items reviewed
by a different person, and you supply that second reviewer. One precision,
because buyers over-read this: independent means a different signed-in
workspace member, not organisational separation and not a third-party
audit.
Can a workspace admin see or do everything?
No. Roles are enforced server-side, and a workspace admin does not automatically get case-reading authority. Insider cases are role-restricted end to end, the restricted reads are separately audited, and mutations require a CSRF token and a same-origin check.
Depends on: the workspace being provisioned correctly: an explicit module allowlist with roles mapped to your team, which is part of the sprint.Does report e-mail delivery work today?
No. Delivery transports exist and are tested against controlled responses, but no workspace has credentials configured, and the in-product status reads “delivery is not configured for this workspace”. Schedules still generate downloadable artifacts.
Depends on: relay credentials and a first observed send. Until then, reports are generated and downloaded inside the workspace and distributed manually.Does the AI analyse our data? Is AI doing the work?
No. Nothing is analysed unless an operator configures a provider that passes the policy check — tenant allowlist, a current retention approval, training and backup exclusions, and a credential. Without one the request is refused with a reason, and the assistant abstains rather than guessing. Advice is recorded as a suggestion, never as a decision. The always-on triage pass is deterministic code.
Depends on: the provider configuration, which is operator work and not part of what you buy. The refusal path is what runs by default.Are you certified? Can you help us pass SOC 2 or ISO 27001?
No certification is claimed or held, and HEIMDALL does not certify your compliance; the sprint excludes certification or attestation of compliance programmes. What the workspace does is hold the evidence for such a programme: records, evidence with digests and independent review, a hash-chained audit trail, and report artifacts for auditor audiences. There is no audit-readiness guarantee.
Depends on: if purchase is blocked unless we present our own third-party certifications or an independent penetration-test report, that is a disqualifier, not a deliverable.What does the sprint cost, and what if it does not meet acceptance?
$6,500 fixed fee. 50% ($3,250) at signature, the balance on acceptance. Acceptance is a written checklist: a workspace with an explicit allowlist, the workflow running on real records with at least 20 of 25 carrying an owner and severity, at least two independently reviewed evidence items, one signed bundle, one leadership artifact, and handover delivered. If the criteria are not met the balance is not due, and remediation is offered within five working days.
The fee, scope and terms are confirmed in the written proposal after the scoping call.Can we export everything and leave?
Yes. That is deliberate design, not a concession. Records, relations, comments, evidence bytes and the audit chain leave in one signed archive with a manifest.
Depends on: nothing external. This is live functionality. Restoring that archive elsewhere is a documented runbook, not an automated import, so plan migration with engineering time.Is Valkra part of this?
No. Valkra is an independently owned product of Launch Legends, subscribed separately. Nothing here grants or assumes any integration, redistribution, resale, revenue-share, billing or data-sharing right in either direction.
Depends on: any future arrangement would need a written agreement approved by both owners. None is authorised today.
Start
Tell us what you want running first.
One workflow, one workspace, five working days. Send a note and a person replies. If e-mail is easier, heimdall@redasgard.com works too.
A 30-minute call decides whether the sprint fits: the workflow choice, your prerequisites, and whether this is the wrong buy. If it is, we say so on the call.