Security By Design
We reject exaggerated claims and security through obscurity. Our systems are built on transparent cryptographic principles, strict role boundaries, automated testing, and responsible data minimization.
Encryption in Transit & At Rest
All external communication utilizes TLS 1.3 encryption with strict cipher suites. Sensitive credentials, tokens, and database backups are encrypted with hardware-backed AES-256 keys.
Role-Based Access & Least Privilege
Administrative access is segmented using strict Role-Based Access Control (RBAC). High-impact actions (remote wipe, factory reset) require secondary OTP or credential re-confirmation.
Immutable Audit Logging
Every policy update, remote command dispatch, user login attempt, and API call creates an immutable timestamped audit trail for complete operational governance.
Multi-Tenant Data Isolation
Customer organizations and fleet records are strictly segregated. Cross-tenant leakage is prevented at both the database schema level and the API middleware layer.
Tested Disaster Recovery
We practice verified restoration, not merely automated backup creation. Nightly off-site backups are validated periodically in isolated staging sandboxes.
Secure Software Supply Chain
Our codebases undergo automated dependency vulnerability scanning, static application security testing (SAST), and mandatory human code review prior to production releases.
Lawful Hardware Control & User Privacy
HeliumMDM provides robust fleet governance tools. However, we firmly adhere to ethical standards and Indian regulatory requirements regarding consumer privacy and device locking:
- • Informed Consent: Any enterprise monitoring or policy enforcement requires clear, documented enrollment disclosure to device users.
- • Emergency Preservation: In situations where device access is restricted due to administrative policy, emergency calling and essential dialers are never disabled.
- • Data Minimization: Helium collects only technical telemetry required for device health, asset management, and network stability. Personal media is never accessed.
- • No NBFC Claims: Helium is solely a technology and software platform. All credit and financing terms are managed independently by licensed financial institutions.
Responsible Disclosure Policy
We welcome security researchers and ethical hackers who identify potential vulnerabilities in our products or web platforms.
Please allow up to 48 hours for our technical team to acknowledge your report. We commit to reviewing all verified findings promptly.