SECURITY & ARCHITECTURE

• Your data stays yours. Your frontend and database live inside your infrastructure, with your keys.
• Minimised & masked. Only the minimum data a task needs crosses to our processing layer, and personal identifiers are masked before any AI sees them.
• Nothing retained. Our processing layer is stateless and zero-retention — nothing stored, cached long-term, or used to train any model.
• Dedicated environment. Your deployment is isolated, with its own database and keys.

Deployment architecture

We use a split-plane setup. Your frontend and database stay inside your infrastructure; only Helm AI's backend (the AI logic) runs on ours. The two sides talk over one secure channel.

Data stays in your perimeter at rest. Only the minimum a task needs crosses to us — masked and encrypted — and is discarded after the response.

Your side — your perimeter

• Your source systems — ERP, CRM, databases (read-scoped). Read-only access to just the data a task needs, not the whole database.
• Helm AI frontend — runs in your environment. The app your users see is hosted on your infrastructure.
• Helm AI database — hosted on your side. Your data is stored in your environment, with the encryption keys held by you.

In the middle — secure channel

• Private link / VPN — database never public. The connection runs through a private tunnel, so your database has no public address and can't be reached from the internet.
• Mutual TLS — both sides prove identity. Encrypted, and both ends verify each other before any data moves — blocking impersonation and man-in-the-middle attacks.
• Masking gateway — personal data tokenised before the AI. Real identifiers are replaced with tokens (Aisha Rahman becomes [PERSON_7]); the map back to real values stays on your side.
• Full audit — every call logged. Every request is recorded (who, what, when, which records) to a tamper-evident log, with alerts on anything unusual.

Our side — AI backend

• Reasoning & orchestration (our IP, never shipped to you). The AI logic stays on our servers, never installed in your environment, so it can't be copied — and your team never has to maintain it.
• AI processing — stateless, zero retention. Each request is handled in memory and discarded — nothing stored, cached, or used to train any model.
• Dedicated environment. Your deployment runs in its own isolated environment, configured and located to your requirements.

Bottom line: your data stays in your perimeter at rest; only the minimum a task needs crosses to us — masked and encrypted — and is discarded after the response.

Security controls

• Work-email login — business-domain only, invite + approval; public domains rejected.
• Granular permissions — access controlled down to module / feature level, so users only reach what their role allows.
• Authorization on every object — the server re-checks permission for each record, so no one can reach data by guessing an ID.
• Short-lived, scoped tokens — sessions expire fast and carry only the permissions needed. (SSO/MFA available on request.)
• Passwords hashed (Argon2id) — one-way, never reversible.
• Data encrypted at rest (AES-256) — encryption at the storage layer, protecting against stolen disks or backup copies.
• Private networking — our backend services are not publicly exposed.

Threats & defenses

• SQL injection → parameterised queries, input validation, least-privilege DB account
• Unauthorised record access (IDOR) → server-side ownership check on every object
• Session / credential theft → short-lived rotated tokens, secure cookies, anomaly checks
• XSS / CSRF → output encoding and a strict Content-Security-Policy; anti-CSRF tokens and SameSite cookies
• Prompt injection / AI leakage → guardrails, masking, least-privilege tools
• DDoS / brute force → rate limiting, lockout, edge protection

AI & model safety

• No training on your data — contractually. We use enterprise model endpoints contracted for zero retention and no training; the terms are available on request.
• Even the model provider sees only tokens — never a real person, because masking happens before the request leaves the boundary.
• The assistant inherits the user's permissions — it can't reach records the requesting user isn't authorised to see.
• Least-privilege tools & approval gates — the AI can only call an allow-listed set of actions; sensitive or irreversible ones require human approval.
• Guardrails on scope — restricted to text, email, calendar, documents and data analysis; no image or video generation.
• Which models — primarily Google Gemini, with other enterprise models selected per use case.