Trust

Security model

Helios holds credentials for your clients' most sensitive systems, so the security model is documented plainly here: how tenants are isolated, how accounts are protected, and how secrets are stored.

Tenant isolation

Every MSP on Helios is a separate tenant. Every query that touches clients, devices, tickets or settings is scoped to the requesting tenant on the server side; there is no client-side filtering to bypass. The same boundary applies to automation: a tenant's alert rules and healing scripts can only ever run against that tenant's own devices. API keys carry the same hard scoping.

Account security

• 2FA is mandatory for admins. Admin and platform accounts must enrol TOTP two-factor on first login; it is not optional. Trusted devices can skip the prompt for 30 days.
• Passkeys: any user can register WebAuthn passkeys and sign in with them.
• Intermediate login tokens (for example, the token issued between password and 2FA) cannot be replayed as session tokens.
• Client portal users are viewers: they can see and request, never change.

The credential vault

Per-client credentials live in an encrypted vault (Fernet symmetric encryption with a key held in server configuration, not in the database). Vault access is logged. The same encryption protects per-tenant integration secrets such as SMTP, IMAP and API credentials. The rule the product follows internally: prose lives in IT documentation, secrets live in the vault.

Agents and remote access

Each device agent authenticates with its own secret enrolment token; one compromised device does not impersonate another. Agents are CI-built, and remote access sessions are initiated from within Helios, so they inherit your account security including 2FA.

Ongoing practice

The platform undergoes recurring internal security audits covering tenant isolation, authorisation and injection surfaces, and findings are fixed before feature work continues. Billing is handled by Stripe; card details never touch Helios servers.

Questions a security review needs answered? Email support@heliosmip.com and you will get specifics, not marketing.