Trust, the honest version

An RMM agent is among the most privileged software an MSP installs. Here is exactly what we do to deserve that access, and what we do not claim yet.

The honest starting point

Helios is a young company, and an RMM agent is one of the most privileged pieces of software an organisation can install. We think the right response to that is not a page of borrowed logos, it is telling you plainly what we do, what we do not do yet, and letting you judge. Helios does not yet hold its own SOC 2 or ISO 27001 certificate, and we will not imply otherwise.

What we bring instead is the thing a certificate is supposed to prove. The people who build and run Helios have spent years inside large organisations that hold both: we have personally implemented SOC 2 and ISO 27001 control environments, operated under them daily, and sat on the receiving end of the recurring external audits that keep them honest. The controls on this page are not guesses at what auditors want. They are the habits that survive audits, applied here from day one, and formal certification for Helios itself is a milestone we are working towards, not an aspiration we are deferring: Cyber Essentials is being completed this year, with ISO 27001 targeted next.

Platform security

• Two-factor authentication is available using TOTP, alongside phishing-resistant passkeys (WebAuthn). New accounts can defer TOTP setup; once enabled, it is required at sign-in.
• Strict tenant isolation. Every query in the platform is scoped to your MSP's tenant. Your clients' data is never visible to another tenant, and platform staff cannot browse tenant data through the product.
• Encrypted credential vault. Client credentials you store are encrypted at rest with a key held outside the database, and every reveal is written to an access log you can read.
• Audit logging. Sign-ins, credential reveals and administrative actions are logged.
• Regular security review. The platform undergoes recurring internal security audits covering tenant isolation, authentication and the agent command path. Issues found are fixed before this page tells you about the process.
• Sessions you can kill. A password reset revokes every existing session for that account, on every device, and "sign out everywhere" does the same on demand. A stolen token dies the moment the account holder acts, not when it happens to expire.
• Breach notification. If we ever suffer a breach affecting your data, we tell you without undue delay and within 72 hours of confirming it, with what we know and what we are doing about it. That commitment lives in the Data Processing Agreement, not just on this page.

The agent

• Outbound only. The Helios agent connects out to the platform over HTTPS. It opens no inbound ports and needs no firewall holes.
• Signed on every platform. Windows agent binaries and the remote-access component are signed through Microsoft Azure Trusted Signing, with our publisher identity vetted by Microsoft. macOS agent binaries, including the remote-control component, are Developer ID signed and notarised by Apple. Linux agent releases carry a detached GPG signature you can verify against our published signing key. Agent updates are SHA-256 checked against the release manifest before installation; a mismatched or incomplete release is withheld.
• Visible actions. Every script run, patch install and remediation the platform performs on a device is recorded against that device where your technicians can see it.
• You control autonomy. Helio's ability to act is set per client: suggest only, act with technician approval, or act autonomously. Fixes Helio writes itself always require a technician's approval before they run.

Your data

• Hosted in EU data centres with Hetzner, a German infrastructure provider. Daily infrastructure-level backups are paired with verified nightly database backups: every archive is integrity-checked when it is written, and restores are actually tested on a schedule, because a backup nobody has restored is not a backup.
• Deliberately separated infrastructure. Each of our products runs as its own isolated stack with its own TLS edge and its own datastore, behind a routing layer that keeps them apart. A problem in one cannot reach into another.
• Encrypted in transit everywhere: browser to platform, agent to platform, platform to integrations.
• Yours to take. Your clients, devices, tickets and alerts are accessible over the Helios API, so your data is never hostage to your subscription.
• Kept only while you use it. Cancel and nothing is deleted straight away: your data stays exportable over the API through a wind-down period, then it is removed. Ask us to delete it sooner and we do.
• AI with boundaries. AI features run on Anthropic's Claude models. You can bring your own API key so AI traffic runs under your own agreement, and AI usage on platform keys is capped and metered per tenant.

Who else touches your data

We keep the list of sub-processors short and name every one. Data on the platform is processed only by:

• Hetzner (Germany): hosting and infrastructure.
• Anthropic: the Claude models behind Helio. Bring your own API key and AI runs under your own agreement instead of ours.
• Paddle: our reseller, which takes payments and sends invoices. Card details go straight to Paddle and never touch our servers.
• Brevo: delivery of transactional and notification email we send out.
• IONOS (EU): our domain and DNS, and the mailbox that receives inbound support and ticket email.

That is the entire list, and we tell you at least 30 days before we add to it. The terms we process your data under are in our Data Processing Agreement. Integrations you switch on yourself, such as Microsoft 365, Xero, QuickBooks, Datto, Dell and Lenovo, run under your own accounts and authorisation; we reach them only as you direct, never on our own.

Commercial trust

• Monthly billing, cancel any time from your own billing page. No phone call, no notice window, no multi-year auto-renewal.
• Flat pricing, published. What you would pay is on the pricing section, not behind a sales call.
• We run an MSP on it. Helios manages our own MSP's clients every day. When something is not good enough, we feel it before you do.
• Don't take our word for anything. We're listed on G2 and SourceForge, where nobody can edit what customers say about us.

Responsible disclosure

If you believe you have found a security vulnerability in Helios, we want to hear about it directly and we will treat you as a colleague, not a threat. Email security@heliosmsp.io with enough detail to reproduce the issue. We will acknowledge your report promptly, keep you informed while we investigate, fix confirmed issues as a priority, and credit you for the find if you would like us to. We ask that you give us reasonable time to remediate before any public disclosure, and that testing avoids accessing other tenants' data. A machine-readable version of this policy lives at /.well-known/security.txt.

Misuse: what we will not be used for

Helios can put a person on somebody else's screen, so we are plain about what it is for. It is for managing computers you are responsible for: your own organisation's, or your clients' under an agreement with them. It is never to be used to reach a computer without its owner's permission, or to take money or data from anyone. The full rules are in our Misuse policy.

• Accepted by name. Every person who uses the Helios console accepts the policy before they can connect to a machine or run anything on one. We record who, when, and from which network address.
• A confirmed address first. Remote access is not available to an account until its email address has been confirmed.
• A card check in a trial. During a trial, remote control waits for a card to pass a check with the bank. Nothing is charged, and we never see the card number.
• The person at the machine is told. When someone connects to the screen of a Windows computer through Helios, it shows a notice and a bar on screen for as long as they are connected. An account cannot switch this off.
• Risky scripts are stopped. On a trial account, a script that installs a remote access tool, or downloads a program and runs it, is refused. On every account it is reported to us.
• New accounts are checked. We look for the patterns misuse follows, including the warnings our card processor gives about a payment. A person looks at every account that is flagged.
• Misuse ends the account. It is switched off and the Helios agent is told to remove itself from every machine the account reached. A payment made with a card that was not the payer's to use goes back to the cardholder.

If Helios is on your computer and you did not agree to it, tell us at /report-abuse. You do not need an account. You can also email security@heliosmsp.io. A person reads every report. We keep an account's records. Where they show fraud or unauthorised access to a computer, we report it to the card issuer and to law enforcement. We also give them to law enforcement and to a victim's bank when they ask through the proper legal route.

Questions we want you to ask

Ask us how tenant isolation is enforced. Ask what happens to your data when you cancel. Ask what Helio is allowed to do without a human. Email hello@heliosmsp.io and you will get a straight answer from the people who built it, because there is nobody else here to hand you to.