Security architecture

Built to be trusted with your most sensitive governance data.

HelixGate is designed for organisations where security, compliance, and auditability are non-negotiable. Every architectural decision we have made — from infrastructure isolation to database-level immutability — reflects that.

Last reviewed: April 2026

Infrastructure

Isolated by design. Shared by nobody.

Every HelixGate customer gets their own dedicated environment — a separate database, a separate application stack, and a separate network boundary. Your data is never co-mingled with another customer's. There is no shared multi-tenant database, no shared application layer, and no shared file storage. Physical isolation is the foundation of our security model.

🏗️

Physical isolation

Each customer runs on a dedicated server with its own isolated application stack. A separate database, a separate API instance, a separate ingress layer. Cross-tenant data access is architecturally impossible — not merely prevented by application logic.

🔐

AES-256 encryption

Data is encrypted at rest using AES-256. All communications are encrypted in transit using TLS 1.3. Credentials and secrets are managed via a dedicated secrets management system — never stored in configuration files or environment variables where they could be exposed.

📜

Immutable audit trail

Every state-changing operation is logged to an append-only audit table. A database-layer immutability constraint raises an exception if any attempt is made to modify or delete an audit record — even by a database administrator. Compliance evidence that cannot be tampered with.

Security controls

Controls across authentication, data, and infrastructure.

TOTP multi-factor authentication

Time-based one-time password (TOTP) MFA enforced for admin accounts. MFA challenge state is encrypted at rest and expires automatically. MFA policy is configurable per organisation.

Role-based access control

Granular RBAC with feature-level permissions across eight configurable roles — from read-only viewer to platform administrator. All permission changes are audited with actor, timestamp, and old/new values.

Short-lived sessions with token rotation

Access tokens are short-lived. Refresh tokens rotate on every use with cryptographic binding — aligned with NIST SP 800-63B AAL2 guidance. Token reuse is detected and triggers automatic session revocation across all active sessions.

Account lockout and brute-force protection

Repeated failed login attempts trigger an automatic account lockout enforced server-side. Lockout events are logged to the immutable audit trail. Applied independently of network-level rate limiting for defence-in-depth.

Password security and forced rotation

Passwords are stored using industry-standard adaptive hashing algorithms. Configurable complexity and expiry policies are enforced per organisation. First-login and post-admin-reset password changes are mandatory before access is granted.

XSS prevention and input sanitisation

Global XSS sanitisation middleware applied to all API request bodies before processing. Parameterised queries throughout — no raw SQL string concatenation. SQL injection is not possible by design.

Soft-delete data model

Core records are never permanently destroyed. Deleted items are archived with a deletion marker, preserving a complete historical record. Permanent deletion from core tables is prohibited — enforced at the application layer and captured in the audit trail.

Encrypted backup files

Platform backup files are encrypted using AES-256 with memory-hard key derivation. Encrypted backups cannot be restored without the backup passphrase. Backup and restore operations are audit-logged with actor identity and timestamp.

Security event logging

All authentication events, permission changes, failed access attempts, and administrative actions are logged with actor identity, IP address, user agent, HTTP method, endpoint, and outcome. Logs are immutable and retained per your configured policy.

GDPR Article 17 automated retention

Automated scheduled purge of user data past your configured retention limits. Audit log anonymisation for departed users — their audit entries remain but personal identifiers are pseudonymised. Purge operations are themselves audit-logged.

Backup & Data Protection

Your data is always recoverable. Always encrypted.

HelixGate implements enterprise-grade backup and recovery strategies designed to meet the most demanding compliance frameworks. Your governance data can be recovered from any failure scenario — from a single record to a complete platform restore.

Continuous data protection

Database changes are captured continuously and shipped to encrypted off-site storage within minutes. Recovery point objectives (RPO) are measured in minutes, not hours — ensuring minimal data loss in any disaster scenario.

Point-in-time recovery

Restore your platform to any point in time, down to the second. Whether it's recovering from accidental deletion, data corruption, or a failed deployment — your data can be rolled back precisely.

Full platform backups

Automated full-platform snapshots capture everything — database, uploaded files, and configuration. Complete disaster recovery from a single encrypted archive, tested and verified on schedule.

Encrypted at every layer

All backups are encrypted at rest using AES-256 with managed key rotation. In-transit encryption via TLS 1.2+. Application-level backups add a second encryption layer with memory-hard key derivation.

Isolated per-tenant storage

Each tenant's backups are cryptographically isolated with dedicated access policies. No tenant can access another tenant's backup data — enforced at the infrastructure level, not just the application layer.

Tiered retention with lifecycle management

Recent backups are available for instant recovery. Older backups transition to cost-optimised archival storage automatically. Retention policies are configurable per compliance requirements — ISO 27001, NIST, or your own policy.

Compliance alignment

Designed for organisations with compliance obligations.

HelixGate's architecture is designed to support customers pursuing SOC 2 Type II and ISO 27001 certification, and to meet UK GDPR requirements as a data processor. The platform also includes built-in EU AI Act compliance tooling for organisations with AI governance obligations. We apply all OWASP Top 10 mitigations across the platform.

🔒
SOC 2-Ready
Architecture & controls aligned to SOC 2 Trust Service Criteria
📋
ISO 27001-Aligned
Information security management design aligned to Annex A controls
🇬🇧
UK GDPR Compliant
Data processor obligations met; DPA available on request
🛡️
OWASP Top 10
All OWASP Top 10 mitigations applied and documented
🤖
EU AI Act
EU AI Act compliance workflow built into the platform — risk classification, FRIA, incident management
Responsible disclosure

Found a vulnerability? Report it here.

We take security vulnerabilities seriously. If you discover a potential security issue in HelixGate, we ask that you disclose it responsibly — giving us the opportunity to address it before any public disclosure.

We commit to:

Acknowledging your report within 2 business days
Providing a resolution timeline within 5 business days
Notifying you when the vulnerability is resolved
Recognising your contribution (with your permission)

Please do not publicly disclose vulnerabilities until we have had a minimum 90-day window to address them.

How to report
1

Include a clear description of the vulnerability, steps to reproduce, and potential impact assessment.

2
Encrypt sensitive reports

For sensitive findings, request our PGP key before sending technical details. We will provide it on request.

3
Allow 90 days for remediation

We request a minimum 90-day coordinated disclosure window from the date of your report.

[email protected]
Operational commitments

What we commit to — not just what we've built.

Enterprise security teams need commitments, not just architecture diagrams. Here are the operational guarantees that back our technical controls.

Penetration testing

Annual third-party penetration testing against OWASP Top 10 and NIST guidelines. Results available to Enterprise customers under NDA. Internal security assessment tooling runs continuously.

Incident response

Security incidents acknowledged within 2 hours. Initial assessment and severity classification within 24 hours. Customer notification for confirmed breaches within 72 hours per UK GDPR Article 33.

Data deletion

Customer data permanently deleted within 30 days of contract termination. A 30-day data export window is provided before deletion. Deletion confirmation issued on request.

Encryption key management

AES-256-GCM encryption with per-tenant keys for sensitive data (TOTP secrets, backups). TLS 1.3 on all connections. Keys managed server-side with rotation on schedule.

Data Processing Agreement

DPA included on Enterprise tier and available on request for Professional tier. Covers UK GDPR processor obligations, sub-processor list, data handling, and breach notification procedures.

Compliance roadmap

Architecture designed for SOC 2 Type II readiness. ISO 27001-aligned controls. Formal certification programme planned as customer base scales. Current controls satisfy the technical requirements of both frameworks.

Enterprise-grade from day one

Security you can explain to your auditors.

We'll walk you through our security architecture in detail — physical isolation, immutable audit trails, and compliance controls — in a demo tailored to your organisation's requirements.