Security

Helm is built to run the operations of professional services businesses: sensitive client data, contracts, invoices, and the AI agents that act on them. Security is not a feature we add on; it is a design constraint. This page summarizes the practices and controls we follow.

Infrastructure

Helm runs on Supabase, which hosts its data plane on AWS in SOC 2 Type II-audited regions. Our application tier is deployed on Vercel. Production infrastructure is configured as code and managed through version-controlled deployment pipelines.

Data encryption

• In transit. All connections to Helm use TLS 1.2 or higher. HSTS is enabled on gethelm.ai.
• At rest. Customer data is encrypted at rest using AES-256 at the storage layer.
• Secrets. Credentials, API keys, and integration tokens are stored encrypted and never exposed to client-side code.

Workspace isolation

Helm is multi-tenant. Every row in the database carries a workspace ID and is protected by Postgres row-level security policies. A query from one workspace cannot read or modify data in another workspace, even if the application layer is compromised. Agent memory, documents, tasks, and integration credentials are all workspace-scoped.

Authentication and access

• Passwords. Stored as bcrypt hashes. We enforce reasonable minimum complexity.
• Two-factor authentication. Available to all users via authenticator apps.
• Session management. Sessions are short-lived and refreshed via rotating tokens. You can review and revoke active sessions from User Settings.
• Role-based access. Workspace roles (Owner, Admin, Member, Guest) control what each user can see and do. Guests and client-portal users see only the data scoped to them.

AI safety and data handling

Helm's AI agents use third-party language model providers (primarily Anthropic) as sub-processors. Customer Content is sent only as needed to fulfill a request and is not used to train foundation models. Each agent has a configurable autonomy level (observe, suggest, or auto-execute) so you decide how much an agent can do without human review. High-risk operations (payments, destructive writes, external communication) are logged and auditable.

Application security

• Code review is required for every production change; CI runs linting, type checking, and automated tests before deploy.
• Dependencies are monitored for known vulnerabilities.
• Input is validated at edge functions and the database layer.
• We sanitize user-submitted content to prevent XSS, and parameterize queries to prevent SQL injection.
• Rate limits and abuse protections guard authentication and sensitive endpoints.

Monitoring and incident response

Application and database logs are retained and reviewed. We monitor error rates, latency, and anomalous access patterns. If we discover a security incident that affects your data, we will notify affected workspaces without undue delay and provide details about scope, cause, and remediation.

Backups and availability

Databases are backed up on a continuous basis with point-in-time recovery. Backup data is encrypted and access is restricted to on-call engineers. We target high availability but recommend exporting critical records periodically using the built-in Import / Export tools.

Compliance

Helm's hosting providers are SOC 2 Type II audited. We support privacy requests (access, deletion, portability) under GDPR, UK GDPR, and CCPA/CPRA. A Data Processing Agreement is available on request for customers subject to those regimes. Contact privacy@gethelm.ai.

Responsible disclosure

If you believe you've found a security vulnerability in Helm, please report it to security@gethelm.ai. Include steps to reproduce and any relevant artifacts. We investigate every report in good faith, will not pursue legal action against researchers acting within this policy, and credit researchers in our changelog where desired.

Out of scope:

• Denial-of-service or volumetric attacks.
• Issues requiring physical access to a user's device or social engineering of Helm staff.
• Findings in third-party services we depend on. Please report those to the vendor directly.

Contact

Security questions? Email security@gethelm.ai. For privacy matters see our Privacy Policy; for commercial terms see our Terms of Service.