Helper365

Legal

Draft

Security overview

How Helper365 protects the Service and your data, and how to report a security issue.

Last updated
Effective date
(to confirm)

Draft - pending legal review

This page is a working draft. A lawyer has not reviewed it yet, and every item marked "(to confirm)" is still open. It will change before Helper365 opens to the public.

This page describes how we protect Helper365 and the data you put into it, and how to report a security issue. It describes our practices; it is not a certification or a guarantee.

1.Hosting and infrastructure

  • The Service runs on a dedicated server in a data centre in Germany (provider: Hetzner) (to confirm), with the application, database and cache in separate containers.
  • Administrative access to the servers uses SSH keys only, and the server firewall opens only the ports the Service needs.
  • Database backups: frequency, encryption and where they are kept (to confirm).

2.Encryption

  • All traffic to helper365.co is served over HTTPS (TLS).
  • Encryption of stored data (database, files and backups): (to confirm).

3.Accounts and access control

  • Sign-in is handled by Clerk. We do not receive or store your password.
  • Every request to your data is checked against your signed-in account; roles inside the app are stored and checked on our side.
  • During the preview, the site sits behind invite codes bound to one email address. We store only a hash of each code; the access cookie is signed, HttpOnly and sent only over HTTPS.
  • Repeated unlock attempts and access requests are rate limited.

4.AI and other providers

A run sends only what it needs to the AI model provider that runs it. In this release the Service uses free model tiers, which may keep prompts under their own terms (to confirm); the Privacy Notice lists every provider. Keep confidential material out of runs until this is confirmed.

Keys and secrets for these providers are kept in server configuration, never in the code or in your browser.

5.Payments

This release takes no payment, and we hold no payment card details. When paid plans open, card details will be handled by a payment provider, not stored by us.

6.Your control over your data

In Settings > Privacy you can export your data, delete your account and choose what reaches your prompts (standing instructions, Memory, attached documents).

7.Incidents

If we learn of a security incident that affects your personal data, we will contain it, investigate it and tell you and the authorities where the law requires it, within the time the law sets (to confirm).

8.Reporting a security issue

If you find a vulnerability, email support@helper365.co with the details and the steps to reproduce it. Please give us reasonable time to fix it before you disclose it, do not access or change other users' data, and do not run tests that could degrade the Service. We do not take legal action against good-faith research that follows these rules (to confirm).