HelmsteadHelmstead

Subprocessors

Version
1.2
Effective date
Choose version
All legal docs
Table of contents

These are the companies that process information for us so we can run Helmstead. Our data processing addendum refers to this list.

We have a data processing agreement with each provider that handles customer data.

We list some providers and changes to their services before we switch them on, so you can see them ahead of time. We identify planned changes below.

Your workspace uses one AI service: Amazon Bedrock or Microsoft Azure OpenAI. Email privacy@helmstead.co to find out which one, or to ask for any provider’s legal entity, its agreement, or where it handles remote access, logging, and backups.

Provider What it does Where
Amazon Web Services Stores the files you bring in, such as accounting exports, statements, and invoices. Runs the AI assistant through Amazon Bedrock on your prompts and the data you can see, without using any of it for training. Also provides the website hosting and planned Treasury hosting described below US; global CloudFront request processing as described below
Microsoft Lets your team sign in with Microsoft 365. Runs the AI assistant through Azure OpenAI on your prompts and the data you can see, without using any of it for training US
Neon Stores your workspace data, including backups US
Vercel Continues to run the Helmstead app at app.helmstead.co while we prepare and review AWS hosting. Your data passes through it but isn’t stored there US

We plan to move the Treasury app at app.helmstead.co from Vercel to Amazon Web Services. Vercel continues to serve public traffic while we prepare and review the AWS version. Review requests routed to AWS will use the setup described here. Public traffic will move after we accept the reviewed version.

The planned AWS setup will use:

  • Amazon Elastic Container Service (ECS) with AWS Fargate to run the application
  • An Application Load Balancer (ALB) to send requests to the application
  • Amazon Elastic Container Registry (ECR) to store packaged application code
  • A private Amazon S3 bucket to store public, immutable static assets
  • Amazon CloudWatch to store operational logs

These services will run or store data in the United States (us-east-1).

Amazon CloudFront will process application requests and responses through its global network, including requests made while you’re signed in. This processing can include IP addresses, headers, cookies, authorization tokens, query parameters, and workspace content. Dynamic application content won’t be cached at the edge. CloudFront will cache only public, immutable static assets: files whose contents don’t change.

Connections will use TLS encryption from your device to CloudFront, from CloudFront to the load balancer, and from the load balancer to the application tasks.

CloudFront, load balancer, and nginx proxy access logs will be off. Operational CloudWatch logs will expire after 30 days and exclude request bodies, cookies, authorization tokens, and sensitive query values. Sentry will continue to receive error reports with sensitive data removed.

This hosting change keeps the existing Neon database, Redis service, workbook storage, and background worker in place.

AWS is already one of our providers. Our existing AWS agreement and data processing terms apply to this hosting. Publishing this notice doesn’t record your consent or change the legal basis for processing your data.

Amazon Web Services also hosts our public website. The website’s servers, original assets, and operational logs are in the United States (us-east-1).

Amazon CloudFront delivers the public website through its global network. It processes requests, including IP addresses and request headers, and caches immutable static assets globally. We don’t route workspace data through the public website’s CloudFront distribution.

We don’t enable visitor access logs on CloudFront or the website’s load balancer. We keep website operational logs in Amazon CloudWatch for 30 days.

These providers don’t handle your workspace data. They help with product analytics, error monitoring, and sales.

Provider What it does Where
PostHog Shows us how people use Helmstead, without any message or financial content US
Sentry Records app errors with sensitive data removed, and never sees your prompts US
HubSpot Books demos and keeps the contact details people give us when they book US

We’ll tell you at least 30 days before we add or replace a provider that handles customer data. We’ll email your workspace’s notice contact and show the notice in Helmstead. You then have 30 days to object on reasonable data-protection grounds. Section 2.3 of the data processing addendum explains what happens next.

We publish each version of this list with its effective date, and keep earlier versions available.

For questions about this list, email privacy@helmstead.co.