Subprocessors
A Subprocessor is a third party that Helios Cloud Suite LLC ("Helios," "we") uses to process Customer Data. This page is the Subprocessors List referred to in the Terms of Service, the Data Processing Addendum and the Business Associate Agreement. It is the only place Helios lists its Subprocessors. Section 2 also lists, for transparency, other third-party services that receive limited data from the Service.
1. Current Subprocessors
| Name | Purpose | Data processed | Data location | BAA in place (Y/N/NA) | DPA in place (Y/N) |
|---|---|---|---|---|---|
| Anthropic | AI API for the AI support assistant, which reads support tickets and drafts replies, when the assistant is turned on for the Customer. | Support ticket text: the subject, category, status and messages of the ticket (not staff-only notes), and anything an Authorized User writes in it. When the assistant looks them up: the Customer's plan, Seat count and account status; its custom mail domain and that domain's DNS check results; an Authorized User's mailbox address, mailbox status and quota; and recent invoice numbers, amounts, dates and payment status. The assistant's tools do not read files, mail, calendars or chat. See note 1. | Stored in the United States. Processing (inference) may run in the United States, Europe, Asia and Australia by default (per Anthropic). | Y. Signed October 1, 2026. | Y. Under Anthropic's Commercial Terms, accepted with Helios's Anthropic account, which incorporate Anthropic's Data Processing Addendum. |
| Bluehost | Cloud server hardware that hosts the whole platform. | All Customer Data the Service processes runs through or is stored on this server: the application, every mailbox, all databases (workspace, sign-in, intranet, support tickets and the audit log), user accounts, intranet files and logs. Workspace files pass through it on their way to Backblaze storage. | United States. | N. Bluehost publicly states that it does not sign BAAs, prohibits storing PHI on its services, and treats doing so as grounds for termination. Helios will offer BAAs once the Service runs on a hosting provider that signs a BAA. Until then, Helios does not offer BAAs or accept PHI. | N. No data processing agreement is in place with Bluehost today. |
| Backblaze | Cloud storage for workspace files, database backups and analytics tables. | (1) Primary storage for every workspace file, including earlier versions, deleted files in the trash bin and previews. (2) Nightly compressed backups of the workspace database (user accounts, groups, shares, calendars, contacts, mail-app settings and file metadata) and of the intranet database. (3) The analytics tables (company names, account owners' email addresses, Stripe customer IDs, mailbox addresses, display names and forwarding addresses). Uploads use TLS. | United States (US East, Backblaze region us-east-005). | Y. Signed February 1, 2026. | Y. Backblaze's Data Processing Addendum. |
| Atera | Device management, for Customers that use it: enrolling company computers, monitoring their health, applying updates and settings, and remote support. | For each device a Customer enrolls: the device's name, its hardware, operating system and installed software, its network addresses, the signed-in user's username, its health, update and alert status, and the device-management actions taken on it. If a technician opens a remote-support session, what is on the device's screen during it. The Service does not send workspace files or mail to Atera. | United States (Microsoft Azure, Central US region). | Y. Signed October 1, 2026. | Y. Atera's Data Processing Addendum, which Atera's Terms of Use incorporate and which Helios accepted with its Atera account. |
| Stripe | Payment processing through Stripe's hosted checkout page, invoices and the billing portal. | The billing contact's email address, the company name, the plan, the Seat count and any campaign tags from the Helios website; the payment card and billing details the Customer enters on Stripe's hosted page; and the resulting subscription and invoice records. | United States (Stripe, LLC), and other countries where Stripe's affiliates and sub-processors operate (per Stripe's DPA). | NA. No PHI is sent to Stripe. See note 2. | Y. Stripe's Data Processing Agreement, which forms part of Stripe's services agreement accepted with Helios's Stripe account. |
Notes
Note 1: Anthropic. The AI support assistant is used only for Customers that have it turned on. Customers that sign the Business Associate Agreement should read its section on subcontractors. Customers that have signed a BAA may use the AI support assistant, but must not include PHI in support tickets; the ticket form will show a warning to that effect.
Note 2: Why Stripe is "NA" for a BAA. The Service sends Stripe only the billing details listed in the Subprocessors table: the billing contact's email address, the company name, the plan, the Seat count and website campaign tags. Payment card details are entered on Stripe's own hosted page and never pass through Helios. No workspace data (files, mail, calendars, contacts, chat or support tickets) is sent to Stripe, so Stripe does not create, receive, maintain or transmit PHI for Helios.
2. Other third-party services
The services below are not in the Subprocessors table in section 1. Each receives only limited data from the Service, such as network addresses, device push tokens or hostnames, and none of them hosts or stores Customer files, mail or other workspace content for Helios. They are listed here for transparency. The "When it is used / status" column says whether each one is in use today.
| Service | What Helios uses it for | Data it receives | When it is used / status | Location |
|---|---|---|---|---|
| Apple Push Notification service (Apple) | Delivers notifications to the Helios app on iPhone and iPad. | For each device signed in to the Helios app: its device push token, the app identifier, a device identifier, the notification type, and when and how often notifications are sent. The Helios app is designed to send notification content only in encrypted form, with Apple displaying a generic alert, so that Apple does not receive the content in readable form. | In use. Today through Apple's development (sandbox) service; the production service is not yet switched on. | United States (Apple Inc.), per Apple's general privacy policy; Apple publishes no location specific to this service. |
| Firebase Cloud Messaging (Google) | Would deliver notifications to the Helios app on Android. | If switched on, the same kinds of data as Apple's service: the device push token, a device identifier, the notification type and timing, and the notification content, which the app is designed to send only in encrypted form. | Only if Android push is enabled; not used today. | Global: any country where Google or its subprocessors maintain facilities (per Google). |
| Google Public DNS and Cloudflare DNS | Public DNS resolvers the Helios server uses to look up internet names. | The hostnames the Helios server looks up, including a Customer's custom mail domain while Helios checks its DNS records during mail-domain verification. The lookups come from the Helios server, not from users' devices. The mail server does its own lookups and does not use these resolvers. | In use. | Global anycast networks; the nearest site answers. |
| DNS blocklist and reputation services | Used by the mail filter to check whether inbound mail comes from known sources of spam or abuse. | The IP addresses of servers that send mail to Helios mailboxes, and domain names and addresses taken from those messages (for example the sender's domain and links in the message), sent as DNS lookups. Some checks send a one-way hashed form of the value instead. Message content is not sent. | In use for inbound mail. Several independent services are used; they are not named individually. | Various; the services are operated in several countries. |
| OpenStreetMap map tiles | Map images on intranet pages that include a map. | Loaded directly by the user's browser (or the Helios app): the user's IP address, browser user agent and which map tiles are requested, which shows the area being viewed. | Only when an intranet page with a map is opened. | Served through a global content delivery network; the OpenStreetMap Foundation stores its other data in the United Kingdom and the Netherlands (per the Foundation). |
| Iconify icons | Icons on some intranet pages. | Loaded directly by the user's browser (or the Helios app): the user's IP address, browser user agent and the names of the icons requested. | Only when an intranet page with those icons is opened. | Global: servers in the United States, United Kingdom, Germany, Singapore, Japan and Australia (per Iconify). |
| Namecheap | Domain registrar for helioscloudsuite.com and host of its public DNS records. | Helios's own domain registration details and DNS records. It answers DNS lookups for Helios hostnames; those lookups come from users' DNS resolvers rather than directly from users. It receives no workspace data. | In use. | United States (Phoenix, Arizona), per Namecheap's privacy policy. |
| Nextcloud GmbH: app store and push proxy | App store: the workspace server checks it for app updates. Push proxy: Nextcloud's own official mobile apps (not the Helios app) use it to deliver notifications. | App store: the Helios server's IP address and software version; no workspace data. Push proxy: the Helios app does not use it. Helios will block push-notification registration with Nextcloud GmbH's push proxy for the Nextcloud mobile apps, so no device token is sent there. Authorized Users should use the Helios mobile app. | App store: in use. Push proxy: not used by the Helios app; registration by Nextcloud's official mobile apps will be blocked. | Germany (Nextcloud GmbH, Stuttgart); data stored on servers in the European Union (per Nextcloud). |
| MET Norway weather service | Weather on the workspace dashboard. | The coordinates of the city selected for the dashboard weather display, and the Helios server's IP address. The requests come from the Helios server, not from users' devices. | Only when a city is selected for the dashboard weather. | Norway. |
Some services used for security functions are not named on this page, for security reasons. By category: a public certificate authority issues the Service's TLS certificates; the mail filter can check message signatures against a spam-signature lookup service; and the mail app can look up a sender's avatar if an Authorized User switches that option on (it is off by default).
3. How we tell you about changes
How notice is given. Helios will tell Customers about a new or replaced Subprocessor by email to the account owner or, once available, by a notice in the admin portal, and by updating this Subprocessors List.
When. At least 14 days before a new or replacement Subprocessor starts processing Customer Data.
4. How to object to a new Subprocessor
If the Customer objects on reasonable grounds, the parties will discuss the objection in good faith. If they cannot resolve it, the Customer may terminate the affected Service by written notice and receive a pro-rata refund of prepaid fees for the remainder of the Subscription Term. The objection process is also described in section 7 of the Data Processing Addendum.
5. Last updated
This list was last updated on October 23, 2026.