Book a Demo
Book a Demo Sign in
Vulnerability Disclosure Policy

Vulnerability Disclosure Policy

Version 0.1 (provisional) · Last updated: October 23, 2026

If you think you've found a security vulnerability in Helios, please tell Helios Cloud Suite LLC ("Helios", "we") privately and give us a reasonable chance to fix it before you share it with anyone else. This policy explains what you can test, how to report what you find, and what you can expect from us. A summary is on our Security Overview.

1. Scope

Helios runs the Service on these public hostnames:

  • helioscloudsuite.com and www.helioscloudsuite.com — the marketing website;
  • app.helioscloudsuite.com — the workspace (mail, files, chat, calendars and the admin console);
  • auth.helioscloudsuite.com — the sign-in service;
  • portal.helioscloudsuite.com — the admin portal and sign-up;
  • mail.helioscloudsuite.com — webmail and the mail servers;
  • intranet.helioscloudsuite.com — the intranet;
  • office.helioscloudsuite.com — the office document editor;
  • api.helioscloudsuite.com — service endpoints used by the apps and by our payment processor;
  • ops.helioscloudsuite.com — the staff-only operations console;
  • hostnames under tenants.helioscloudsuite.com.

In scope: all of the hostnames and apps listed above.

Out of scope:

  • services and websites run by third parties, including the checkout pages hosted by our payment processor and the systems of the infrastructure providers in our Subprocessors List — please report those to the provider;
  • denial-of-service or load testing, and anything that degrades the Service for others;
  • spam, and automated scanning that floods our systems;
  • social engineering or phishing of Helios staff or Customers, and physical attacks on offices or equipment;
  • accounts, data or devices that are not yours, unless the owner has given you permission.

2. How to report

Email support@helioscloudsuite.com with “Security” in the subject line.

3. What to include

  • what you found and where (the address, app or feature);
  • the steps to reproduce it;
  • what someone could do with it;
  • how we can reach you.

Please don't include other people's personal information, Customer Data or Protected Health Information (PHI) in your report. If you came across any while testing, describe what kind of data it was rather than copying it.

4. Testing in good faith

  • Use only accounts you own, or have the account holder's permission to use.
  • Don't access, change or delete data that isn't yours. Stop as soon as you've shown the issue, and tell us if you saw anyone else's data.
  • Don't degrade the service for others: no denial-of-service testing, spam, or automated scanning that floods our systems.
  • No social engineering, phishing or physical attacks against our staff or customers.
  • Keep the details confidential until the issue is fixed or we've agreed a disclosure date with you.

5. Safe harbor

This policy does not offer a safe harbor or any authorisation beyond the scope it describes.

6. What to expect

We'll review your report and keep you updated while we work on it.

  • Acknowledgement: Helios does not commit to a fixed time to acknowledge a report, but aims to respond promptly.
  • Updates and disclosure: Helios does not commit to a timeline for progress updates or public disclosure.

7. security.txt

Our contact details for security researchers are also published in machine-readable form at /.well-known/security.txt.