Trust Center
How we protect your data, the agreements we sign, and how to report a security issue. Where something isn't final yet, this page says so.
This page is the Helios Security Overview. It describes how the Service is run today. This Security Overview is informational. Helios's contractual security commitments are set out in the Data Processing Addendum and, where signed, the Business Associate Agreement.
Privacy policy
How we collect, use, share and protect information, and the choices you have over it.
Agreements and compliance
Certifications
Helios does not hold any third-party security certification today.
Helios has not yet completed an independent security audit or certification (such as SOC 2 or ISO 27001).
Data Processing Agreement
Business Associate Agreement (BAA)
After hosting moveBAAs will be available once our hosting move is complete.
Helios is built with healthcare practices in mind, but does not offer a Business Associate Agreement (BAA) today.
A BAA will be available on all paid plans once hosting moves (see /baa).
Helios will offer BAAs once the Service runs on a hosting provider that signs a BAA. Until then, Helios does not offer BAAs or accept PHI.
Subprocessors
The full Subprocessors List names each Subprocessor, what it does for the Service and where it processes data.
Our privacy policy describes how we share information with service providers (section 4, “Sharing and disclosure”) and names the subprocessor for AI assistance in support (section 4.1).
Reliability
Service level agreement (SLA)
Business and EnterpriseOur Service Level Agreement sets out the monthly uptime commitment for sign-in, mail and files on the Business and Enterprise plans, and the service credits that apply when a month falls short of it. No uptime commitment applies on the other plans. Support response-time targets are set out in the Support Policy; they are targets, not guarantees.
Status page
Backups
The workspace database and the intranet database are backed up every night to off-site object storage provided by Backblaze, one of the Subprocessors in our Subprocessors List. Mail, sign-in (identity) data and support requests are not currently backed up off the server they run on.
Workspace files are kept in object storage, not on the server. Deleted files go to a trash bin, and earlier versions of files are kept, so users can restore them under the workspace's default rules. Helios will enable object versioning or lifecycle rules on the storage that holds workspace files, so that earlier and deleted versions of files, including files in group folders, are kept for up to 30 days and then removed automatically.
Helios will keep backup copies for 30 days and then delete them.
Database backups run every night and are stored with Backblaze in the United States (US East region).
Security
Encryption in transit
Connections to the Helios workspace, sign-in service and admin portal use HTTPS (TLS). TLS certificates are issued automatically by a public certificate authority and renewed by cert-manager. Mail apps can connect to our mail servers over TLS, and files travel between the workspace and its object storage over TLS.
Helios will serve every Service hostname over HTTPS only (plain HTTP is redirected to HTTPS), will send an HSTS header on every hostname and will mark session cookies Secure, so that connections to the Service are encrypted in transit with TLS.
Sign-in and two-factor authentication
Users sign in to the Helios workspace, and the intranet and admin portal use that same sign-in (single sign-on), so each user has one Helios account.
Two-factor authentication with an authenticator app, plus backup codes, is available to every user. It is not required by default. The workspace sign-in slows down repeated failed attempts.
Helios will require two-factor authentication for every Authorized User, at minimum for Customers that have signed a BAA.
How customer organisations are kept apart
Each organisation's users are kept in their own group on a shared, Helios-operated server, with their own storage quota. By default, users can only find and share with people in their own organisation.
Users can also, by default, create public links to files that anyone with the link can open, share files by email, and share with users of other servers (federated sharing).
Each user has their own mailbox on a shared Helios mail server. The intranet is a single site shared by all customers; customers' users can read it but not post to it.
Staff access and audit log
Helios staff sign in to our operations console through a separate staff sign-in, not a customer account, and two-factor authentication is mandatory for it. Consequential staff actions require the staff member to have signed in again shortly before.
Staff actions taken through the operations console are recorded in an append-only audit log: the database refuses changes to or deletion of existing entries, our services write to it through a restricted database role that can only add and read entries, and secrets are removed from the recorded details before they are stored.
Helios staff access Customer Data only to answer a support request, with the Customer's permission, or where needed for security or legal reasons, and such access will be recorded.
Helios staff with production access undergo background checks, sign a confidentiality agreement and complete security training every year.
Infrastructure providers
The Service runs on server hardware and storage provided by the infrastructure providers named in our Subprocessors List, which also says where each of them processes data.
The current hosting provider does not sign BAAs. Helios will offer BAAs once the Service runs on a hosting provider that signs a BAA. Until then, Helios does not offer BAAs or accept PHI.
Vulnerability disclosure policy
If you think you've found a security vulnerability in Helios, please tell us privately and give us a reasonable chance to fix it before you share it with anyone else.
The full Vulnerability Disclosure Policy sets out the scope, how to report and what to expect.
How to report
Email support@helioscloudsuite.com with “Security” in the subject line.
Please include:
- what you found and where (the address, app or feature);
- the steps to reproduce it;
- what someone could do with it;
- how we can reach you.
Scope
- In scope: every Helios hostname and app listed in the scope of the full Vulnerability Disclosure Policy.
- Out of scope: services run by third parties, denial-of-service or load testing, spam and scanning that floods our systems, social engineering and physical attacks, and accounts or data that aren't yours, as listed in the full Vulnerability Disclosure Policy.
Testing in good faith
- Use only accounts you own, or have the account holder's permission to use.
- Don't access, change or delete data that isn't yours. Stop as soon as you've shown the issue, and tell us if you saw anyone else's data.
- Don't degrade the service for others: no denial-of-service testing, spam, or automated scanning that floods our systems.
- No social engineering, phishing or physical attacks against our staff or customers.
- Keep the details confidential until the issue is fixed or we've agreed a disclosure date with you.
What to expect
We'll review your report and keep you updated while we work on it. We don't commit to a fixed time to acknowledge a report, or to a timeline for progress updates or public disclosure, but we aim to respond promptly.
This policy doesn't offer a safe harbor or any authorisation beyond the scope it describes.
This policy doesn't offer a bug bounty or payment for reports.
Incident response
Helios will post notices of service incidents on its status page, will notify affected Customers of a Security Incident directly by email, and will maintain a written incident response plan.
Customers that have signed a BAA will be told of a Breach of Unsecured PHI without unreasonable delay and within 10 days of discovery. Personal-data breaches under the Data Processing Addendum will be reported without undue delay and within 48 hours.