# Helm security and compliance

Helm is aligned with NIST SP 800-171 Rev. 2 practices and built with the technical controls a CMMC Level 2 environment expects from an application. Helm is not itself certified; CMMC certification is an assessment of the customer's organization by an authorized assessor.

## Controls in the application

- Multifactor authentication (TOTP with recovery codes) required for every member by default
- Members join only by owner/admin invitation or SCIM provisioning from the customer's directory
- Enterprise single sign-on via OpenID Connect to Microsoft Entra ID, Okta, OneLogin, Ping Identity, or any OIDC provider; SCIM 2.0 served by Helm
- Adaptive step-up re-verification before sensitive actions
- Append-only audit log covering authentication, authorization changes, billing, integrations, API use, and record changes, with CSV export
- Server-side authorization on every request and tenant isolation on every record
- Per-request Content Security Policy, HSTS, and hardened headers
- Third-party OAuth tokens encrypted at rest with AES-256-GCM; webhooks from Stripe, Square, and HubSpot verified by HMAC signature
- A NIST SP 800-171 Rev. 2 control mapping covering all 14 families, written to attach to a System Security Plan

## What "aligned" means

Software can require MFA, log every change, control who joins, isolate tenants, and hand you a control mapping for your System Security Plan. Helm does those. CMMC certification is an assessment of your organization by an authorized assessor; Helm gives you a tool that already behaves.

## Responsibility split

- **Application (Helm):** authentication, authorization, audit, input validation, tenant isolation, encryption of stored credentials, security headers.
- **Deployment (operator):** TLS at the edge, no inbound ports, backups, host patching, log shipping.
- **Organization (customer):** policies, personnel, physical security, incident response, MFA enforcement for members.

## Reporting a vulnerability

Email support@missionsuccesssolutions.com with a description, the affected feature, reproduction steps, and impact. Please allow a reasonable period for investigation before public disclosure.

More: https://helmsapp.com/help/security · https://helmsapp.com/about.md · https://helmsapp.com/llms.txt