Security

Data handling & backups

Last updated: May 27, 2026

Where your data lives, how it's protected, how often it's backed up, and how you get it out or erased. No hand-waving, this is the actual stack we run our own agency on.

Where your data lives

Database (Neon Postgres): all structured data, tasks, clients, time entries, comments, invoices, encrypted credentials - lives in a managed Postgres database hosted in a single region. Connections run through a pooled, TLS-only endpoint.
Files (Vercel Blob): uploaded attachments, generated invoice/payslip PDFs, and logos are stored as objects with unguessable URLs. Public objects are reachable only by their random URL; we never expose a directory listing.
App (Vercel): the application itself runs on Vercel's serverless platform. Vercel processes requests but does not retain your workspace data, it reads from and writes to the database above.

Encryption

In transit: every connection, browser to app, app to database, app to file storage, is TLS-encrypted. There is no plaintext path.
At rest: the database and file storage are encrypted at rest by the platform.
Credentials, doubly: client platform passwords and API keys you store in the credential vault are additionally encrypted with AES-256-GCM using a key that lives only in our server environment, never in the database. Even with raw database access, the credential values are unreadable.

Backups

Automatic, continuous: the database is backed up continuously by the managed Postgres provider, with point-in-time recovery, we can restore to any moment within the retention window, not just nightly snapshots.
No action needed from you: backups run whether or not you do anything. There's no "remember to export" chore.
Tested: branching the production database to a fresh copy is part of our normal workflow, so restore isn't a theoretical button we've never pressed.

Retention & clean-up

Operational logs (activity, AI calls, errors) are pruned after 30 days.
Portal analytics are kept 180 days, then deleted.
Orphaned files, uploads that never got attached to anything, are swept from storage automatically after a 14-day grace window, so abandoned files don't accumulate.
Soft-deleted records (a deleted task, client, or workspace) sit recoverable for 30 days, then are permanently erased along with their files.

Multi-tenant isolation

Auctores Helm is multi-tenant: every row of workspace data carries your organisation's id, and every query is scoped to it at the application layer. One workspace cannot read another's tasks, clients, files, or credentials. Client-portal users see only the single client they belong to.

Getting your data out, or erased

Export: timesheets and invoices export to CSV/PDF from inside the app at any time.
Per-user erase: any user can request erasure of their personal data (GDPR right to be forgotten) from settings.
Workspace deletion: deleting your workspace soft-deletes it immediately and permanently erases everything, database rows and files, after a 30-day grace period. After that, it's gone, including from backups as they age out of the retention window.

What we never do

We don't sell your data.
We don't use your workspace content to train AI models.
We don't share data with advertisers or data brokers.