Security & trust
Encryption at the field level, tenant isolation at the database layer, and a full audit trail on every mutation. Helpneer is designed so that the answer to most vendor security questionnaires is "yes."
Sensitive columns are encrypted with PostgreSQL PGCRYPTO before they hit disk. Identifiers are obfuscated with HashIDs so raw primary keys never leak into URLs or logs.
Every API endpoint follows OWASP guidance for input validation, sanitization, and output encoding. DOMPurify runs on user-controlled HTML paths.
Every organization is a hard tenant boundary at the database layer — not a filter applied at the application layer. Cross-org access requires explicit grants.
Every mutation to configuration, permissions, users, and tickets is recorded with author, timestamp, and diff. Exportable for your compliance team.
Email/password with JWT sessions, refresh tokens, email OTP-based 2FA, and a secure forgot-password flow. SSO available on Enterprise.
All payment processing runs through Stripe. Card data never touches Helpneer infrastructure. Billing metadata is field-level encrypted at rest.
GDPR
Architecture ready. Data export, deletion, and consent flows built in.
PCI DSS
For payment data end-to-end via Stripe. Card data never lands on our infra.
SOC 2
On the roadmap. Trust center will publish audit progress as it advances.
Defense-in-depth approach with multiple layers of protection.
Sensitive columns are encrypted at the field level using PostgreSQL PGCRYPTO before they hit disk. Identifiers are obfuscated with HashIDs so raw primary keys never leak into URLs or logs.
OWASP-aligned API security with input sanitization (DOMPurify) and XSS protection. All API endpoints follow OWASP guidance for input validation, sanitization, and output encoding.
Organization-level data isolation with full audit trail. Every organization is a hard tenant boundary at the database layer with complete change history across all operations.
GDPR-ready architecture with data export, deletion, and consent flows built in. Full compliance support for data residency requirements.
PCI DSS compliance for payment data. All payment processing runs through Stripe with card data never touching Helpneer infrastructure. Billing metadata is field-level encrypted at rest.
Send our team a note at [email protected]. We answer questionnaires (SIG, CAIQ) and share our architecture doc under NDA.
Common questions about Helpneer's security practices and compliance.
SOC 2 is on our roadmap. We're building our security controls with SOC 2 in mind and will publish audit progress in our trust center as it advances.
Sensitive columns are encrypted at the field level using PostgreSQL PGCRYPTO before they hit disk. Identifiers are obfuscated with HashIDs so raw primary keys never leak into URLs or logs.
Every organization is a hard tenant boundary at the database layer—not a filter applied at the application layer. Cross-organization access requires explicit grants.
SSO is available on Enterprise plans. We support standard SAML 2.0 identity providers for single sign-on integration.
All payment processing runs through Stripe. Card data never touches Helpneer infrastructure. Billing metadata is field-level encrypted at rest.
Free plan available. No credit card required.