Application security
- CSRF validation for state-changing forms
- Prepared database statements
- Rate limiting and idempotency controls
HelpoSoft Cloud Trust Center
Review security, privacy, reliability, AI and integration assurance in one place.
Understand what is built into HelpoSoft Cloud, what customers configure, what connected providers control and which evidence belongs in an enterprise procurement review.
This Trust Center does not claim certifications, uptime targets or recovery objectives that have not been independently completed and approved for the contracted service.
Security controls
Privacy and data
Reliability
AI governance
Assurance areas
Move from public product information to contract-specific evidence.
Each area explains controls, responsibilities, evidence to request and claims that still depend on the live Cloud environment or connected provider.
Responsibility matrix
Trust depends on more than the application.
HelpoSoft Cloud, customer administrators and connected providers each control different parts of the operating system. Procurement should assign an owner to every layer.
Built-in or operatedCustomer configuredProvider dependentEvidence required
| Area | Control model | Review focus |
|---|---|---|
| Identity and access | Built-in + customer configured | MFA, OIDC, roles, sessions and access review |
| Data governance | Shared responsibility | Data categories, retention, exports, deletion and providers |
| Reliability | Cloud operated + contract specific | Monitoring, queues, backups, incidents and recovery evidence |
| AI governance | Customer approved + provider dependent | Knowledge, modes, handoff, provider data and quality review |
| Integration security | Shared + provider dependent | Scopes, credentials, signatures, retries and revocation |
| Procurement | Evidence required | Questionnaire, architecture, terms, service levels and acceptance |
Core Cloud controls
Start with the product controls, then verify the operating evidence.
The control catalogue is deliberately specific about feature boundaries and customer responsibility.
Open security overviewIdentity and access
- TOTP MFA and recovery codes
- OpenID Connect with PKCE
- Custom roles and least-privilege permissions
Data protection
- Workspace-scoped application access
- Protected provider secrets and hashed tokens
- Private attachments and signed delivery
Tenant and site scope
- Workspace ownership checks
- Visible site-level operational scope
- Separate client workspaces where isolation is required
AI governance
- Approved knowledge sources
- Draft, assisted and automatic modes
- Provider and budget controls
Cloud operations
- Managed application releases
- Monitoring and queue-health review
- Backup and recovery process
Integration security
- Dedicated identities and minimum scopes
- Webhook signature or token validation
- Idempotency and bounded retries
Assurance boundaries
- No unsupported certification claims
- Customer configuration remains in scope
- Provider dependencies are documented
Procurement package
Request evidence that matches your actual deployment.
A useful review should cover service scope, architecture, data flows, providers, security measures, service levels, recovery, incidents, AI use, integrations, legal terms and exit responsibilities.
Service architecture and scopeSecurity and privacy measuresProvider and integration inventoryBackup and recovery evidenceIncident and support processApproved Cloud order and DPA
Run a controlled approval
Use the security questionnaire, assign owners, test a limited workspace and record conditions before production.
Open questionnaireRequest evidence