Data Protection
Technical Security Standards
The security controls we build and operate to.
Version 1.0 · Last updated 11 November 2026
How to read this page
These are the standards we build and operate to. Older client systems are brought up to them as part of ongoing maintenance. If a control is not yet in place on your system, we will tell you when you request your Compliance Pack.
Controls
| Area | Standard |
|---|---|
| Encryption in transit | HTTPS (TLS) on all public traffic to hosted systems |
| Encryption at rest | Provider-level storage encryption on our hosting and managed database platforms; off-site backups are encrypted before they leave the server |
| Passwords | Stored only as salted hashes (such as bcrypt), never in plain text |
| Access control | Role-based permissions, with users limited to what their role requires |
| Sign-in protection | Rate limiting or lockout on repeated failed logins; two-step verification on Helvino's staff platform, and on client systems that support it |
| Audit trails | Logging of sign-ins and sensitive actions on systems that handle personal data |
| Isolation | Each hosted application runs in its own container with its own database and private network; databases on our servers are not exposed to the internet |
| Server access | Administrative access by SSH key, limited to authorised staff |
| Application security | Server-side input validation, output sanitisation and secure HTTP headers |
| Patching | Security updates to servers and software dependencies, prioritised by severity |
| Backups | Production databases dumped hourly on the server, with nightly encrypted off-site copies for systems in our managed backup programme |
| Secrets | Keys and credentials are stored in environment configuration, not in source code |
Security reports
Security researchers can report vulnerabilities privately using the contact on our Security & Trust page. We acknowledge reports and work on a fix before any public disclosure.