Security

How your data is protected

• In transit: Helios is served over HTTPS only; plain HTTP requests are redirected.
• At rest: data lives on Amazon Web Services (US West, Oregon) and is encrypted at rest.
• Passwords: Helios never stores your password, only a salted scrypt hash of it.
• Tokens: access tokens you create are stored only as hashes, so the token itself can't be read back out of the database.
• Connecting an AI app: uses OAuth 2.1 with a consent screen. You can revoke the connection at any time.
• Abuse limits: sign-in and public forms are rate limited.

What Helios doesn't do

• It doesn't sell your data, show ads or use third-party trackers.
• It doesn't send your data to an AI provider of its own. The AI app you connect is yours.
• It doesn't read your AI app's conversations.

The full detail is in the privacy policy.

Reporting a vulnerability

Email privacy@helioscoach.com with what you found and how to reproduce it. Please give us a reasonable chance to fix it before sharing details publicly. Helios is run by one person, so there's no bounty program, but every good-faith report is read and acted on. Our security.txt has the same contact.