Control who can see, decide, and act.

Identity and access controls

• Mandatory MFA is a default MVP control; optimizer users cannot disable it themselves.
• Role-based access separates platform, tenant, and optimizer responsibilities.
• Authentication and security-relevant access are recorded for investigation and support.
• Users receive only the permissions needed for their role and assigned accounts.

Authorized integrations, not shared passwords

HelmMind uses provider authorization flows or approved imports. The product should never ask a user to paste an advertising-platform password into a HelmMind form.

• OAuth scopes are shown during authorization.
• Connection status and freshness remain visible.
• Customers can disconnect or revoke access through the provider.
• Tokens and secrets must not appear in screenshots, logs, exports, or support tickets.

Every recommendation leaves a decision trail

HelmMind records the recommendation, supporting context, human response, owner, timestamp, and follow-up status. An AI suggestion is not allowed to become an invisible budget action.

• Approve, edit, reject, and defer remain distinct.
• Original and edited recommendations stay traceable.
• Reports preserve decision context.
• Webhook destinations require controlled administration.

Protect data through its operating lifecycle

HelmMind separates customer workspaces and limits access to authorized users and service providers. Data-health controls surface missing, delayed, or inconsistent information before it drives a recommendation.

• HTTPS/TLS is enforced for production traffic.
• Backups, restore tests, monitoring, and incident procedures match published commitments.
• Production LLM routes and subprocessors follow Privacy Policy retention and training settings.

Investigate, contain, remediate.

We investigate suspected security events, take steps to contain and remediate confirmed incidents, preserve relevant evidence, and notify affected customers or authorities when required by law or contract.

Security is shared.

• Use unique credentials and complete MFA enrollment.
• Invite only authorized users and review access as roles change.
• Grant only required platform scopes.
• Review recommendations and execution authority before approval.
• Do not send passwords, tokens, or sensitive data through forms or support messages.
• Report suspicious activity promptly.