HelmsteadHelmstead

Subprocessors

Version
1.1
Effective date
Choose version

You’re viewing an older version of this document

View current version
All legal docs
Table of contents

These are the companies that process information for us so we can run Helmstead. Our data processing addendum refers to this list.

We have a data processing agreement with each provider that handles customer data.

We list some providers before we switch them on, so you can see them ahead of time. The table shows which ones.

Your workspace uses one AI service: Amazon Bedrock or Microsoft Azure OpenAI. Email privacy@helmstead.co to find out which one, or to ask for any provider’s legal entity, its agreement, or where it handles remote access, logging, and backups.

Provider What it does Where
Amazon Web Services Stores the files you bring in, such as accounting exports, statements, and invoices. Runs the AI assistant through Amazon Bedrock on your prompts and the data you can see, without using any of it for training US
Microsoft Lets your team sign in with Microsoft 365. Runs the AI assistant through Azure OpenAI on your prompts and the data you can see, without using any of it for training US
Neon Stores your workspace data, including backups US
Vercel Runs the Helmstead app at app.helmstead.co, so your data passes through it but isn’t stored there US

Amazon Web Services also hosts our public website. The website’s servers, original assets, and operational logs are in the United States (us-east-1).

Amazon CloudFront delivers the public website through its global network. It processes requests, including IP addresses and request headers, and caches immutable static assets globally. We don’t route workspace data through the public website’s CloudFront distribution.

We don’t enable visitor access logs on CloudFront or the website’s load balancer. We keep website operational logs in Amazon CloudWatch for 30 days.

These providers don’t handle your workspace data. They help with product analytics, error monitoring, and sales.

Provider What it does Where
PostHog Shows us how people use Helmstead, without any message or financial content US
Sentry Records app errors with sensitive data removed, and never sees your prompts US
HubSpot Books demos and keeps the contact details people give us when they book US

We’ll tell you at least 30 days before we add or replace a provider that handles customer data. We’ll email your workspace’s notice contact and show the notice in Helmstead. You then have 30 days to object on reasonable data-protection grounds. Section 2.3 of the data processing addendum explains what happens next.

We publish each version of this list with its effective date, and keep earlier versions available.

For questions about this list, email privacy@helmstead.co.