An answer without a record is an opinion.
Auditors, insurers and enterprise procurement teams do not want your dashboard. They want a dated, referenced record of what was true, in which system, checked how. This is the shape of that record.
Nine mandatory fields
Every record written by any domain carries the same nine fields. A record missing any of them is rejected at write time rather than stored incomplete.
| Field | Type | Purpose | Why an assessor cares |
|---|---|---|---|
| record_id | string | Immutable identifier, unique per tenant | Lets a finding in a report be traced back to a single record. |
| control_ref | string[] | One or more framework control identifiers | Answers “which control does this evidence relate to” without interpretation. |
| source_system | string | The platform the data came from | Distinguishes a tenant reading from a human assertion. |
| scope | string | Tenant, subscription or organisational unit | Establishes what was in scope and, by omission, what was not. |
| collected_at | RFC 3339 UTC | Moment of collection, not of display | Evidence has a shelf life; the date decides whether it is still valid. |
| method | string | Collection method and API scope used | Separates an automated read from a screenshot someone uploaded. |
| result | enum | PASS · FAIL · NOT_APPLICABLE · MANUAL | Four states, no partial credit and no score. |
| retained_until | date | Retention expiry calculated at write time | Shows retention is governed rather than accidental. |
| hash | sha256 | Hash over the canonical serialisation | Makes after-the-fact editing detectable. |
Schema version 0.3. The schema is not stable and will change before any general release. Records written under an earlier schema version are migrated forward with a superseding record rather than rewritten.
Three specimens
A pass from an automated scan, a fail with a remediation state, and a manual attestation — the three shapes you will spend most of your time looking at.
All three specimens are illustrative. The identifiers, tenant names, timestamps and hashes are invented to show the record shape. They are not from a real tenant, a real customer or a real scan — Lagan Cyber has no customers. MANUAL records are explicitly marked as attested rather than verified, because we did not check them and will not let a record imply that we did.
Settings and metadata. Not your files.
The single most common question from a prospective customer’s IT lead, answered in a table rather than a paragraph of reassurance.
| Category | Read | Not read |
|---|---|---|
| Identity | Account existence, role assignment, MFA registration state, sign-in policy configuration, licence assignment. | Passwords, password hashes, authentication secrets, individual sign-in logs beyond configuration state. |
| Documents | Sharing configuration, link policy, site and drive settings, external access settings. | File contents, file names beyond those returned inside a configuration object, document previews. |
| Transport rules, forwarding configuration, anti-malware and anti-phishing policy state. | Message bodies, subjects, attachments, mailbox contents. | |
| Infrastructure | Resource configuration, network exposure settings, key and secret expiry metadata. | Secret values, key material, database contents, application data. |
| People | Display name and work email for accounts in scope, so findings can be attributed. | HR records, performance data, absence, salary, personal contact details. |
Where an API returns more than we need in a single response, the surplus is discarded before the evidence record is written rather than stored and filtered later.
Least privilege, read-only, revocable by you
Connecting a tenant means granting an application consent. These are the scopes we ask for and what each one is for. There are no write scopes on this list, and there will not be.
| Platform | Scope | Used for | Write? |
|---|---|---|---|
| Microsoft Graph | Policy.Read.All | Conditional access and authentication policy state | No |
| Microsoft Graph | Directory.Read.All | Role assignment, account and group configuration | No |
| Microsoft Graph | Organization.Read.All | Tenant-level settings and licence state | No |
| Microsoft Graph | AuditLog.Read.All | Audit log configuration and retention state | No |
| Microsoft Graph | SharePointTenantSettings.Read.All | External sharing and anonymous link policy | No |
| Google Admin SDK | admin.directory.user.readonly | Account and 2-step verification enrolment state | No |
| Google Admin SDK | admin.directory.domain.readonly | Domain configuration | No |
| Google Admin SDK | admin.directory.rolemanagement.readonly | Admin role assignment | No |
Credentials and revocation
Tenant credentials and refresh tokens are stored encrypted at rest and are used only to run scans for the tenant that granted them. They are never used to access any other customer’s environment, and scan findings are never shared, pooled, benchmarked or aggregated across customers.
You can revoke consent at any time from your own tenant’s admin console without asking us. Revocation stops scanning immediately. Evidence records already written remain in your account until you delete them or the retention clock expires, and you can request deletion at any time.
Scope lists are as at 5 August 2026 and will change as connectors are written. Any change that widens what we can read is a change we will notify to connected customers before it takes effect.
What evidence from this platform cannot do
-
Limit 01
It does not pass your audit. An assessor may reject any evidence for any reason, including reasons that have nothing to do with its quality. We assemble the record; the judgement is theirs.
-
Limit 02
It only covers what is connected. A system you have not connected produces no evidence, and its absence is a gap in your coverage, not a pass. The platform shows unconnected scope as unknown rather than compliant.
-
Limit 03
It is a point-in-time reading. A record says what was true at the moment of collection. Between scans, a setting can change. Scan frequency is therefore a compliance decision, not a performance setting.
-
Limit 04
Hashing is tamper-evident, not tamper-proof. A content hash lets you detect that a record changed. It does not make change impossible, and we will not describe it as immutability or as a blockchain.
Want to see a record from your own tenant?
Private early access is open to a small number of UK and Ireland businesses willing to connect a tenant to unfinished software and tell us where it is wrong. There is no charge and no commitment; there is also no service level, no support desk and no guarantee the product ships.
Early access — hello@lagancyber.co.uk · we reply within two working days
Before you connect anything, read the terms and the privacy notice. Where we scan your tenant we act as your processor under Article 28 UK GDPR, and the commitments that go with that are written down rather than implied.