Security & trust
Built to survive your security review.
Field-level encryption, complete organization data isolation, and comprehensive audit trails for every key action. Helpneer is designed so that the answer to most vendor security questionnaires is "yes."
Core Security & Compliance Pillars
Encryption at the field level
Sensitive columns are encrypted with AES-256 encryption before hitting disk. System identifiers are cryptographically tokenized so raw internal keys never leak into URLs or logs.
OWASP-aligned APIs
Every API endpoint follows OWASP guidance for input validation, sanitization, and output encoding. DOMPurify runs on user-controlled HTML paths.
Complete organization isolation
Every organization's data is strictly partitioned and isolated with guaranteed boundaries. Your team and customer records are completely private, with cross-organization access strictly prohibited.
Full audit trail
Every change to system settings, team permissions, users, and tickets is recorded with author, timestamp, and details for compliance review.
Enterprise authentication
Secure logins with encrypted sessions, two-factor authentication (2FA), protected password recovery, and single sign-on (SSO) on Enterprise.
PCI DSS for payment data
All payment processing runs through Stripe. Card data never touches Helpneer infrastructure. Billing metadata is field-level encrypted at rest.
GDPR
Architecture ready. Data export, deletion, and consent flows built in.
PCI DSS
For payment data end-to-end via Stripe. Card data never lands on our infra.
SOC 2
On the roadmap. Trust center will publish audit progress as it advances.
Security Architecture
Defense-in-depth approach with multiple layers of protection.
Field-Level Encryption
Sensitive columns are encrypted at the field level using AES-256 encryption before hitting disk. System identifiers are cryptographically tokenized so raw internal keys never leak into URLs or logs.
OWASP-Aligned Security
OWASP-aligned API security with input sanitization and XSS protection. All API endpoints follow strict security guidance for input validation, sanitization, and output safety.
Strict Data Isolation
Dedicated organization-level data separation with a full audit trail. Your data is isolated with guaranteed boundaries, keeping customer conversations and company settings 100% private.
GDPR-Ready Architecture
GDPR-ready architecture with data export, deletion, and consent flows built in. Full compliance support for data residency requirements.
PCI DSS Compliance
PCI DSS compliance for payment data. All payment processing runs through Stripe with card data never touching Helpneer infrastructure. Billing metadata is encrypted at rest.
Have a specific question?
Send our team a note at [email protected]. We answer questionnaires (SIG, CAIQ) and share our architecture doc under NDA.
Security FAQ
Common questions about Helpneer's security practices and compliance.
Is Helpneer SOC 2 compliant?
SOC 2 is on our roadmap. We're building our security controls with SOC 2 in mind and will publish audit progress in our trust center as it advances.
How is data encrypted?
Sensitive data is encrypted at the field level using AES-256 encryption. System identifiers are tokenized securely so raw internal keys never leak into URLs or logs.
How does customer data isolation work?
Every organization's records are strictly partitioned and safeguarded with dedicated boundaries. Other businesses cannot see or access your data, and cross-organization access requires explicit administrative authorization.
Do you support SSO?
SSO is available on Enterprise plans. We support standard SAML 2.0 identity providers for single sign-on integration.
How is payment data handled?
All payment processing runs through Stripe. Card data never touches Helpneer infrastructure. Billing metadata is encrypted at rest.
Ready to talk to security?
We're happy to answer security reviews, provide vendor assessments, and review our architecture.