Security

Overview

Your datasets and reports are business information, and we treat them that way. This page describes the measures in place today. It is not a certification or a guarantee. If you have a security question, contact us at contact@rbhelix.com.

Accounts and sessions

• Passwords are stored only as salted PBKDF2-SHA256 hashes, never in readable form.
• Email verification is required before an account can be used.
• Your session cookie is HttpOnly, Secure and SameSite=Lax, and we store only a hash of the session token.
• Sessions expire after 14 days of inactivity and are revoked when you log out, change your password or reset it.
• Login and other sensitive endpoints are rate-limited to slow down password-guessing and similar attacks.

Data in transit and at rest

All traffic to the website and the service is encrypted in transit with TLS (HTTPS).

Account data is stored in Cloudflare D1, and uploaded files and reports are stored in Cloudflare R2 in a private bucket with no public links. Cloudflare encrypts stored data at rest.

Access control and customer isolation

Every request is authorised on the server. Each customer can access only their own datasets, requests, results, reports and billing data, and ownership is checked on every request.

Results become visible to you only after RBHelix publishes them. Published report versions are kept as version history.

Uploads and file checks

Uploaded files go through the checks listed below before they are accepted.

Uploaded files are not currently scanned by an antivirus engine. These checks reduce risk, but please upload only files from sources you trust.

• Only allowed file types and extensions are accepted (CSV, XLSX and ZIP archives containing CSV or XLSX files).
• File contents are checked against the expected file signature.
• ZIP archives are inspected and rejected if they contain unsafe paths, nested or encrypted archives, or signs of a zip bomb.
• File size limits apply according to your plan.

Payments

Card payments are processed by Stripe, which is responsible for the security of card data. RBHelix never receives or stores your full card number. Stripe webhooks are signature-verified before we act on them.

Administrative access and audit

Administrative access is limited to RBHelix administrators. Administrative actions, such as downloading a customer dataset or publishing results, are recorded in an audit log.

What we do not claim

RBHelix does not currently hold ISO 27001, SOC 2 or other security certifications, and we do not claim HIPAA or PCI DSS compliance. If your organisation requires a specific certification, please contact us before uploading data.

Your part

• Use a strong password that you do not use anywhere else.
• Keep private dashboard and upload links confidential.
• Log out when you use a shared or public device.
• Upload only the data the analysis needs, and avoid sensitive personal data.

Reporting a vulnerability

If you believe you have found a security issue, please email contact@rbhelix.com with the details and steps to reproduce it. Please do not access other customers' data or disrupt the service while testing, and give us reasonable time to fix the issue before sharing it publicly.