Built in the open. Shipping continuously.

The watching half of what already ships: discovery names the printers, switches and NAS boxes, and the site relay can reach them. Next is polling them for toner, port status and capacity, so they are monitored as well as reachable.

iOS and Android alongside desktop platforms. Being scoped; honest status is that desktop estates come first.

Price a piece of work, send it, and the client accepts or declines it signed in to the portal or from the link in the email, with their name on the decision. Monthly lines go onto their contract; one-off lines bill on that month's invoice.

Helios installs as an app from the browser. A fix waiting for approval, a critical alert or an escalation lands on your phone and opens the page it is about. Each kind can be switched off per person.

Block one update everywhere, or hold every new update for a week. Before an update goes further, see how it fared on the machines that already tried it.

Limit an engineer to only the clients they should handle. A restricted engineer sees those clients and nothing else, everywhere in the platform: devices, tickets, reports, alerts, remote access. Set it per person on the Users page; by default everyone sees every client, and you always keep full access to your own account.

A script that pulls a remote-access tool off the internet, or downloads and runs an arbitrary payload, is scanned before it reaches a machine. Trial accounts are blocked from running one; paying tenants are flagged and can allowlist the domains they trust in Settings.

Switch a tenant off and every one of its agents is told to uninstall itself at its next check-in, so a laptop that was offline for the day still cleans up when it comes back. Nothing of Helios is left behind on a machine you no longer manage.

Every agent was rebuilt and re-signed after a significant improvement build: the Windows agent carries a Microsoft-verified certificate for Nexborne Ltd, the macOS agent and remote-control component are Developer ID signed and notarised by Apple, with a double-clickable installer package, and Linux releases carry a verifiable GPG signature. No unknown-publisher warnings, no Gatekeeper blocks, and the screen-sharing permission you grant on a Mac survives every future agent update instead of being asked for again.

Entra ID single sign-on is live for technician accounts: one click with the Microsoft account your team already secures, alongside passkeys and mandatory 2FA.

Passkey login, mandatory 2FA for admins, encrypted credential vault, full tenant isolation, and one-click remote access with no second vendor.

Isolate a compromised device from the network with one click, keeping only the Helios connection alive, and trigger Microsoft Defender quick or full scans on demand. The security page went from read-only to actionable.

Each client's card now shows whether one-click remote access is available on their machines, and its consent behaviour is configurable per client. User-consent protections can be raised for a client, never silently removed.

Monitoring, inventory and patching for Linux alongside Windows, Windows Server and macOS. All agents are CI-built.

Helio diagnoses a device end to end, proposes and applies a fix, then verifies it worked. Novel or risky actions always wait for a technician's approval.

Alert fires, matching playbook runs, ticket documents it, and verified fixes close themselves. 49 built-in playbooks, plus your own, and Helio saves new fixes that worked as reusable playbooks.

Crash-looping services, failing disks, blue screens and repeating error patterns in the event log raise alerts before a user rings. Every detection is curated and backtested against a live estate first, so this produces the occasional alert that matters, not an hourly noise feed.

A reboot now resolves only when the machine's own uptime shows it actually restarted, on Windows and macOS alike, and if the restart never comes Helio escalates honestly at the promised time instead of trusting the script's report. Approved-and-scheduled work goes quiet in the meantime, so the attention strip only flags decisions you still owe.

Approving a Helio fix and choosing when it runs are separate decisions now: approve the restart at 2pm and have it land out of hours, instead of clicking approve at exactly the right moment.

Inbound email is triaged and answered by Helio in seconds, with per-tenant control over how autonomous it is allowed to be.

Your clients' users describe a problem in plain English. Helio checks their company's devices and tickets, walks them through safe fixes, and raises a properly-written ticket when a human should take over.

Device CPU, memory and disk history rolls into daily trends: an "under sustained load" flag on the estate view, 60 and 90-day charts per device, and capacity sections in reports and QBRs, so the upgrade conversation is argued with data rather than anecdotes.

Trend-based warnings days before a disk fills, and a per-device health score that rolls up into client and estate views.

Agent-level detection of Windows Backup, Veeam, Acronis and more, with staleness alerts so a quietly failing backup cannot hide.

Helios now reads Veeam and Acronis directly, on top of the agent-level checks. It tracks when each job last produced a restore point, not just when it last ran, so a job that fails every night stops looking healthy.

Monitor your clients' websites and public services: uptime, response time and SSL certificate expiry. Downtime raises a ticket automatically, and so does a certificate about to lapse.

Agents passively map each client's network, and Helios identifies what it finds by vendor and device type: printers, NAS boxes, network kit. New hardware on a client network is flagged the day it appears.

Nominate one always-on machine at a site as its relay and reach the kit that will never take an agent: switches, firewalls, NAS boxes, printers, and the servers you have not installed on yet. Discovery already records which machine can see which device, and the vault already holds the logins, so the relay runs the command and reports the result back. Windows relays talk PowerShell over WinRM, Linux and network kit over SSH. A target only appears if that relay is the machine that discovered it, every command waits for a human to approve it, each target's host key is pinned so a swapped device cannot impersonate the one you trusted, and the password is never written into the command: the relay fetches it at the moment it runs and the access lands in the vault audit trail.

Winget-driven updates for everyday apps next to Windows Update, with per-client schedules and compliance scoring.

One admin approval connects a client's tenant, with no app registration to build. Licences, MFA coverage, mailbox and OneDrive health, inactive users, leaver actions (reset password and MFA, block sign-in, revoke sessions), Defender threats surfacing as tickets, and the Defender vulnerability digest: open critical and high CVEs per client with exposed device counts, on the Security page.

A condition that flickers on and off no longer fires a storm of alerts: flapping is damped at the engine, and an alert can be snoozed until its ticket closes rather than for an arbitrary number of hours.

Build a report over your own devices or clients with conditions like "RAM under 16GB", "warranty expires in the next 90 days" or any custom field you have defined, then group it, export it to a spreadsheet and save it to re-run. Alongside a dedicated SLA report showing every client's tickets against their response and resolution targets, met versus breached.

See your licence margin per client at a glance: how many seats, what you bill for them, what they cost you and the margin, worst first. Enter your cost per seat on the client's contract; billing and seat counts come from the contract and Microsoft 365 automatically.

Bill a client the way you actually sell to them: a flat monthly fee, a price per device counted live, a price per seat from Microsoft 365, and an hours allowance that nets against logged time before overage bills. One month's invoice, computed once, goes to Xero, QuickBooks or CSV with identical figures.

Add the fields your business needs (asset tag, site contact, contract reference, anything) to clients and devices. They show on the record, filter in the report builder and export with everything else.

Sign up in the UK, the US or the eurozone and the trial converts to a subscription in pounds, dollars or euros, at the price shown on the pricing page for your currency.

Log time against tickets in one tap, set an hourly rate per client, and pull a monthly billing summary with a per-client CSV export any accounting package imports. The hours you work become the invoice you send.

Connect either in Settings, map each client to a customer once, and push a month's billable time straight in as a draft invoice, line by line, matching the CSV to the penny. The walkthrough at /accounting shows exactly what Helios will and will not touch in your books.

Reusable reply templates you insert straight into the ticket reply box, and a one-click Great / Okay / Poor rating in the resolved-ticket email. No login for the client, and their rating lands on the ticket, so you can prove the service is good rather than assert it.

Client-facing portals on your own domain with your branding, plus AI-drafted quarterly business reviews you can edit and print.

Every MSP gets its own ticket address on our inbound domain: point support@yourdomain at it and every client email becomes a ticket, matched to the right client automatically. Replies from the requester thread onto the same ticket.

A per-client menu of orderable services with your questions, audience rules and named approvers who sign off from an email link. On approval the platform does the work itself where it can: leavers blocked and signed out of Microsoft 365, passwords reset, installs queued on the right device group, playbooks run. Every action lands on the ticket, and risky actions only run behind a real sign-off.

Every machine reports its age, and a price book turns warranty and end-of-life dates into a per-client replacement forecast with real numbers, so the budget conversation happens a year early rather than the week a laptop dies.

Serial numbers resolve to real coverage dates straight from the manufacturer, Dell first with more vendors in certification, feeding the hardware replacement forecast automatically.

A day-one baseline records what Helios found when it arrived at a client, so the improvement you deliver is provable later, not anecdotal. Internal reports run per client on demand and export to CSV.

Runbooks, notes and structured documentation living beside the credential vault, so everything a tech needs about a client is in one place.

A documented, key-scoped REST API over your clients, devices, tickets and alerts, with an interactive reference at /api/v1/docs, and plain-language documentation for the whole platform at /docs: limits stated, reasoning included.

One consistent visual language across every screen of the app and portal.