Security at helg
Your task list is private by default. Here's how we keep your account and data protected, in honest detail.
Encryption
All traffic to helg is encrypted in transit with TLS (HTTPS). Files you upload, and our database backups, are kept in Amazon S3 and encrypted at rest by that storage provider. We also send strict transport-security and other hardening headers on every response.
Passwordless sign-in
There are no passwords to steal. You sign in with a one-time magic link emailed to you, or with Apple or Google. Magic links are single-use and expire quickly.
Sessions & tokens
Sessions are opaque, server-side tokens — we store only a hash of each token, so even if our database were exposed, the tokens couldn’t be reused. You can review every active session and sign out of any device from You → Security & devices, and signing out revokes the session on our servers, not just in your browser.
Sign-in alerts
A sign-in from a device or network we haven’t seen on your account before triggers a security email with the time, approximate location, IP, and device — so an unfamiliar login is easy to spot. We’ll also email you when a calendar feed is connected to or disconnected from your account.
Account & household isolation
Each household is a strict tenant boundary. Every request is pinned to a household you actually belong to, and queries are scoped so one household can never read another’s data. The family/shared inbox is permeable by design: people see only what they’ve sent you, never your board.
Payments
Card payments are handled entirely by Stripe. Your full card number never touches our servers — we store only your subscription status and invoices. Billing webhooks are signature-verified and processed idempotently.
Abuse protection
We rate-limit authentication and the API, validate and sandbox outbound link previews against SSRF, and run health and readiness checks with graceful restarts to keep the Service stable.
Subprocessors
We rely on a small set of vetted providers — Amazon Web Services (email, file storage, and database backups), Stripe (payments), Apple and Google (optional sign-in). See the Privacy Policy for the full list and how data is shared.
Responsible disclosure
Found a vulnerability? We’d genuinely like to hear from you. Email [email protected] with details and steps to reproduce. Please give us a reasonable window to fix issues before disclosing them publicly, and don’t access or modify other people’s data while testing.
Being straight with you
We believe in describing security accurately rather than over-promising. End-to-end encryption (where not even we can read your content) is on our roadmap, not something we claim today. If a page ever overstates what we do, that’s a bug — tell us at [email protected].