Security & compliance

How we protect your data.

Auctores Helm holds your agency's client list, task history, time logs, and (optionally) encrypted credentials and Stripe keys. Treating that with anything less than full seriousness wouldn't be a product - it'd be a liability. Here's the candid version of how we do it.

Encryption

At rest

AES-256-GCM with key versioning for every credential vault entry and Stripe API key. Encryption keys live in environment variables managed by Vercel (not in the database). Key rotation supported via the CREDENTIAL_ENC_KEYS_OLD fallback list, re-encrypts run via the rotate-credential-key script. Rest of the database is encrypted at rest by Neon (AES-256, AWS KMS-backed).

In transit

TLS 1.2+ end-to-end. The custom domain serves a fresh Let's Encrypt certificate that auto-rotates every 90 days. HSTS enabled. Vercel terminates TLS at the edge; function-to-database hops stay inside AWS us-east-1.

Webhook signatures

Outgoing webhooks are signed with HMAC-SHA256 using a per-subscription secret. Receivers can verify signed-by-us before processing. A 5-minute rotation grace window lets you swap secrets without dropped deliveries.

Authentication & access

Password auth

bcrypt (12-round) hashing. No password ever stored in plaintext or logged. Reset tokens are SHA-256 hashed before storage and expire after 1 hour.

Two-factor (super-admin)

Required for super-admin / operator-console access (TOTP via authenticator apps). Roadmap: org-wide MFA enforcement for regular admins by Q3 2026.

Tenant isolation

Every Prisma query in the codebase is scoped by organizationId. The CI test suite (see src/lib/__tests__/) covers tenant-isolation invariants. A leak between two orgs would fail tests.

API tokens

Bearer tokens, SHA-256 hashed in storage (we never see the plaintext after issuance). Scope-restricted, rate-limited, instantly revocable. Tokens shown to the operator exactly once at creation.

Infrastructure

Hosting

Vercel (functions in us-east-1, AWS-backed). Neon for Postgres (also us-east-1, point-in-time recovery + encrypted backups). Vercel Blob for user-uploaded files (logos, task attachments).

Backups

Neon takes continuous WAL backups. Point-in-time restore window of 7 days on current plan, 30 days on enterprise contracts. Self-service workspace export available via Settings → Workspace → Data export.

Logging & monitoring

Function logs retained 24 hours (Vercel free) / 30 days (enterprise). Audit log for every operator action retained 90 days by default; configurable per workspace for compliance contracts. Outbound alerts (ops, ai-budget) wired into operator inbox.

Sub-processors

Auctores Helm runs on third-party infrastructure. The companies listed here process your data on our behalf. If we add a new sub-processor or change a category, we'll update this page first, and notify workspace admins by email for enterprise customers.

Vercel

Application hosting, serverless functions, blob storage

USA (us-east-1)

Neon

Postgres database hosting

USA (us-east-2)

Anthropic

AI features (Claude), task parsing, daily brief, etc.

USA

Resend

Transactional email (invites, password resets, digests)

USA

PayPal

Subscription billing

USA / Global

Stripe

Payment links for client invoices (opt-in per workspace)

USA / Global

Google

Gmail OAuth + Google Chat integration (opt-in per workspace)

USA

Compliance & attestations

SOC 2 Type II, in progress

Auctores Helm is a young product. We have not yet completed a SOC 2 Type II audit. We are working with an auditor and expect the Type I report in Q4 2026, Type II in Q2 2027. We will not claim what we don't have.

In the meantime: customers under contract receive a security questionnaire response (SIG-Lite, CAIQ-Lite) and our Data Processing Agreement. Email security@theauctores.com for either.

GDPR

Data Processing Agreement available on request. Right-to-delete: workspace admin can delete their org from Settings → Advanced (30-day grace + permanent purge by cron). Right-to-access: full CSV export of every entity from Settings → Workspace → Data export. Sub-processors listed above.

HIPAA / PCI

Auctores Helm is not HIPAA-compliant and is not PCI-DSS-attested. Don't store PHI in task details. Don't paste credit card numbers into credential vault. Stripe Payment Links handle card details, those never touch Auctores Helm servers.

Incident response

Reporting a vulnerability

If you've found a security issue, email security@theauctores.com with reproduction steps. We acknowledge within 24 hours, triage within 72, and aim to ship a fix within 14 days for high-severity issues. We don't currently run a paid bug bounty but credit researchers in release notes on request.

Customer notification

In the event of a confirmed data breach affecting your workspace, we notify the workspace admin by email within 72 hours of confirmation, with: what happened, what data was involved, what we've done, and what you should do. This obligation is also in the Data Processing Agreement.